A gateway horizontal extension system and method based on bridge control and ARP filtering

Abstract

This invention discloses a gateway horizontal scaling system and method based on bridging control and ARP filtering, relating to the field of network communication technology. The system includes an extended gateway with first and second physical network ports, respectively connecting to downstream network devices and the main gateway's LAN side; a VLAN configuration module for creating two VLANs on the switch and adding the two network ports to them to achieve data isolation; a bridging module for creating a software bridge and bridging the two VLAN interfaces; and a filtering control module for enabling the bridged firewall, configuring arptables rules to drop ARP responses from the main gateway, and configuring ebtables rules to drop ARP packets sent from the local machine to the core switch. This invention achieves low-cost horizontal scaling of the gateway through VLAN isolation, software bridging, and two-layer ARP filtering, preventing ARP pollution and traffic bypass, and improving network security and scalability.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and more specifically, to a gateway horizontal scaling system and method based on bridging control and ARP filtering. Background Technology

[0002] In current enterprise-level LANs or large-scale IoT deployments, gateway devices undertake the core functions of connecting the internal network and the external network, including routing and forwarding, NAT translation, DHCP service, and ARP response. With the surge in the number of access terminals and the continuous growth of business traffic, a single gateway device often faces throughput bottlenecks, urgently requiring a flexible and scalable gateway architecture to meet the demands of high concurrency and high availability.

[0003] A search revealed patent CN113542190A, which discloses an interconnection access gateway for TETRA systems. This solution serves as an interconnection and interoperability device for SIP gateway access devices and TETRA systems from different manufacturers. It includes a housing, a processing module and a bridging control module installed within the housing, and a first terminal radio and a second terminal radio mounted on the housing. When the interconnection access gateway is used as an interconnection and interoperability device, the first and second terminal radios connect to different TETRA systems and interconnect via the bridging control module. When the interconnection access gateway is used as a SIP gateway access device, the processing module connects to the same TETRA system via the first and second terminal radios. This solution enables interconnection between TETRA systems from different manufacturers and offers advantages such as rich functionality, low cost, and flexible node configuration.

[0004] However, this comparative literature primarily addresses the interconnection problem between dedicated TETRA communication systems. Its bridging control module is used to connect TETRA systems from different manufacturers or to enable SIP access. It does not address scenarios involving the horizontal scaling of gateways in enterprise LANs, nor does it disclose how to address security vulnerabilities such as ARP pollution and traffic bypassing the control plane in multi-gateway deployments through techniques like VLAN isolation, software bridging, and ARP filtering. Therefore, existing technologies lack a solution that can both enable horizontal gateway scaling to meet high concurrency requirements and ensure controlled ARP communication, preventing traffic from bypassing the control plane. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of the prior art, the present invention provides a gateway horizontal scaling system and method based on bridging control and ARP filtering to solve the problems mentioned in the background art.

[0006] In a first aspect, embodiments of this application provide a gateway horizontal scaling system based on bridging control and ARP filtering, including: a main gateway, a core switch, and extended gateways; The extended gateway includes: The first physical network port is used to connect to downstream network devices; The second physical network port is used to connect to the local area network side of the main gateway; The VLAN configuration module is used to create a first VLAN and a second VLAN on the network switch, and add the first physical network port to the first VLAN and the second physical network port to the second VLAN to achieve data isolation between the two physical network ports. A bridging module is used to create a software bridge inside the extended gateway and bridge the first network interface corresponding to the first VLAN and the second network interface corresponding to the second VLAN to the software bridge, so that data that was originally isolated by hardware can be forwarded in a controllable manner at the software bridge level. The filter control module is used for: Enable the bridging firewall function to allow data link layer filtering rules to process ARP packets forwarded through the software bridge; Configure the first filtering rule to discard ARP responses from the main gateway to prevent ARP pollution; Configure a second filtering rule to discard ARP packets actively sent by this extended gateway toward the core switch.

[0007] In some embodiments of this application, the lower-level network devices include switches, routers, servers, or IoT terminal devices; The LAN side of the main gateway is the core egress device of the LAN; The core switch is located in the uplink of the main gateway and is used to connect to the external network or other subnets.

[0008] In some embodiments of this application, the filtering control module is configured to: during the process of the extended gateway receiving data traffic from the lower-level network device through the first physical network port and forwarding the data traffic to the second physical network port via the first VLAN, the software bridge and the second VLAN, block the ARP responses sent by the main gateway to the lower-level network device through the first filtering rule, and at the same time prevent the extended gateway itself from sending ARP requests or responses to the core switch through the second filtering rule.

[0009] In some embodiments of this application, enabling the bridging firewall function specifically involves setting the operating system parameter / proc / sys / net / bridge / bridge-nf-call-arptables to true, thereby allowing arptables to process ARP packets forwarded through the software bridge.

[0010] In some embodiments of this application, the first filtering rule is implemented using the arptables tool, with the specific command being: arptables-AFORWARD-s[main gateway IP address]-jDROP.

[0011] In some embodiments of this application, the second filtering rule is implemented using the ebtables tool, with the specific command being: ebtables -AOUTPUT -pARP -o [network interface name corresponding to the second VLAN] -jDROP.

[0012] Secondly, embodiments of this application provide a gateway horizontal scaling method based on bridging control and ARP filtering, applicable to a network environment including a main gateway and a core switch, comprising the following steps: S1. Connect the second physical network port of the extended gateway to the local area network side of the main gateway, and connect the first physical network port of the extended gateway to the downstream network device; S2. Create the first VLAN and the second VLAN on the network switch; S3: Add the first physical network port to the first VLAN, and add the second physical network port to the second VLAN; S4. Create a software bridge inside the extended gateway, and bridge the first network interface corresponding to the first VLAN and the second network interface corresponding to the second VLAN to the software bridge; S5. Enable the bridging firewall function of the extended gateway, allowing data link layer filtering rules to process ARP packets forwarded through the software bridge; S6. Configure the first filtering rule to discard ARP responses from the main gateway; S7. Configure a second filtering rule to discard ARP packets actively sent by this extended gateway to the core switch.

[0013] In some embodiments of this application, the method for creating a software bridge is as follows: by setting the value of the operating system parameter / proc / sys / net / bridge / bridge-nf-call-arptables to 1, arptables is allowed to process ARP packets forwarded through the software bridge.

[0014] In some embodiments of this application, the configuration method for the bridging firewall function is specifically implemented using the arptables tool, with the specific command being: arptables-AFORWARD-s[main gateway IP address]-jDROP.

[0015] In some embodiments of this application, the configuration method of the first filtering rule is specifically implemented by the ebtables tool, with the specific command being: ebtables-AOUTPUT-pARP-o[network interface name corresponding to the second VLAN]-jDROP.

[0016] Compared with the prior art, the beneficial effects of the present invention are: 1. This invention enables multiple gateways to work collaboratively on ordinary commercial gateways through VLAN isolation and software bridging technology, without the need to replace expensive high-end dedicated gateway equipment or carry out large-scale modifications to the existing network topology, thus significantly reducing the hardware costs and upgrade barriers for enterprise-level network and IoT deployments.

[0017] 2. This invention configures two-layer filtering rules using arptables and ebtables. On the one hand, it discards ARP responses from the main gateway to prevent the spread of false ARP information; on the other hand, it prevents the extended gateway from sending ARP packets to the core switch, ensuring that all ARP communication is conducted under the control plane monitoring, thus fundamentally eliminating the security risks of traffic bypassing the control plane.

[0018] 3. This invention bridges two VLAN interfaces to a software bridge, forcing data that was originally isolated by hardware to be forwarded at the software level. This allows for the application of a unified access control policy on the bridging path, ensuring that all traffic passing through the extended gateway is subject to network management policies and avoiding policy bypass issues caused by hardware pass-through forwarding. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0020] Figure 1 The system architecture diagram provided for this invention; Figure 2 The data flow and control logic diagram provided for this invention; Figure 3 The module logic diagram provided for this invention; Figure 4 The method flowchart provided by the present invention. Detailed Implementation

[0021] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0023] Example 1 Please see Figure 1 This invention provides a gateway horizontal expansion system based on bridging control and ARP filtering. To achieve the above objectives, this invention is implemented through the following technical solution: The system is applied in a network environment that includes a main gateway and a core switch, and mainly includes an expansion gateway. The expansion gateway, together with the network switch, the main gateway, the core switch, and the subordinate network devices, constitutes a complete network topology.

[0024] Specifically: such as Figure 1 As shown, the network environment in this embodiment includes the Internet, a core switch, a main gateway, network switches, extension gateways, and lower-level network devices. The core switch is located in the uplink of the main gateway and is used to connect to the Internet or other subnets. The main gateway, as the core exit device of the local area network, undertakes core functions such as routing forwarding, NAT translation, and DHCP service between the internal and external networks. The network switch connects the main gateway and the extension gateway and supports VLAN segmentation. The extension gateway is the core device of this invention, used to achieve horizontal expansion of the gateway. Lower-level network devices include switches, routers, servers, or IoT terminal devices, which are various terminals or lower-level networks that the extension gateway needs to serve.

[0025] In this embodiment, the extended gateway specifically includes the following components: a first physical network port, a second physical network port, a VLAN configuration module, a bridging module, and a filtering control module.

[0026] The first physical network port is used to connect to downstream network devices, such as... Figure 1 As shown, the first physical network port connects to downstream network devices via a network cable, including but not limited to switches, routers, servers, or IoT terminal devices. The second physical network port is used to connect to the LAN side of the main gateway, such as... Figure 1 As shown, the second physical network port is connected to the LAN interface of the main gateway via a network cable.

[0027] The VLAN configuration module is used to create a first VLAN and a second VLAN on the network switch, adding the first physical network port to the first VLAN and the second physical network port to the second VLAN to achieve data isolation between the two physical network ports. In this embodiment, the first VLAN is preferably VLAN 15, and the second VLAN is preferably VLAN 16. However, those skilled in the art should understand that the VLAN numbers can be flexibly configured according to the actual network environment, as long as the two physical network ports are in different VLANs. Through this VLAN isolation configuration, data between the first and second physical network ports cannot be directly forwarded through the hardware switch, thus forcing all data that needs to be transmitted between the two network ports to be processed by the CPU of the extended gateway, laying the foundation for subsequent controllable forwarding and filtering control.

[0028] The bridging module creates a software bridge within the extended gateway and bridges the first network interface corresponding to the first VLAN and the second network interface corresponding to the second VLAN to the software bridge. This allows data that was originally isolated by hardware to be forwarded controllably at the software bridge level. Specifically, after the VLAN configuration module creates VLAN 15 and VLAN 16 on the network switch, the extended gateway's operating system automatically generates corresponding virtual network interfaces, such as eth0.15 (corresponding to the first VLAN) and eth0.16 (corresponding to the second VLAN). The bridging module creates a software bridge, for example named br-lan2, using the bridging function of the Linux system, and then adds the two virtual interfaces eth0.15 and eth0.16 to this software bridge. In this way, the two physical network ports that were originally isolated by VLANs are connected at the software level through this software bridge, but all data packets forwarded through the software bridge can be monitored and controlled by the bridging module.

[0029] The filter control module is one of the core innovations of this invention, used to perform a series of filter control operations. Specifically, it includes: First, the filtering control module enables the bridging firewall function, allowing data link layer filtering rules to process ARP packets forwarded through the software bridge. In this embodiment, this function is implemented by setting operating system parameters, specifically the command: `echo1> / proc / sys / net / bridge / bridge-nf-call-arptables`. This parameter instructs the Linux kernel's bridge module to also pass ARP packets passing through the software bridge to arptables for processing, thus enabling subsequently configured ARP filtering rules to take effect.

[0030] Secondly, the filtering control module is used to configure the first filtering rule to discard ARP responses from the main gateway to prevent ARP pollution. In this embodiment, the first filtering rule is implemented using the arptables tool, specifically with the command: arptables-AFORWARD-s10.168.5.1-jDROP, where 10.168.5.1 is the IP address of the main gateway. The function of this rule is: when the extended gateway forwards data packets through the software bridge, if it detects an ARP response packet with the main gateway as the source IP address, it will discard it directly. The technical effect of this is to prevent the main gateway's ARP responses from spreading to lower-level network devices, avoiding lower-level network devices directly sending traffic to the main gateway, thereby ensuring that all traffic must be forwarded through the extended gateway.

[0031] Secondly, the filtering control module is used to configure a second filtering rule to discard ARP packets actively sent by this extended gateway towards the core switch. In this embodiment, the second filtering rule is implemented using the ebtables tool, with the specific command: ebtables -AOUTPUT -pARP -oeth0.16 -jDROP, where eth0.16 is the network interface corresponding to the second VLAN. The function of this rule is to prevent the extended gateway itself from sending any ARP request or response packets towards the core switch through the second physical network port. The technical effect of this is to ensure that the ARP entries on the core switch side are not interfered with by the extended gateway, and to force all communication related to the main gateway and the core switch to be conducted via packet forwarding rather than direct ARP communication, thereby preventing traffic from bypassing the extended gateway's control plane.

[0032] Through the collaborative work of the above four modules, this embodiment constructs a complete gateway horizontal scaling system, which can achieve horizontal scaling of gateway processing capabilities while ensuring network security and controllability.

[0033] In this embodiment, the entire system workflow is as follows: Data traffic sent by lower-level network devices first arrives at the first physical network port of the extended gateway, then enters the first network interface corresponding to the first VLAN, then enters the software bridge, undergoes forwarding processing by the bridging module in the software bridge, arrives at the second network interface corresponding to the second VLAN, and finally is sent to the LAN side of the main gateway through the second physical network port. The main gateway then performs further routing and forwarding to the core switch and the Internet. Throughout the entire data flow process, the filtering control module is always in a monitoring state: on the one hand, it blocks ARP responses sent by the main gateway to lower-level network devices through the first filtering rule to prevent ARP pollution; on the other hand, it prevents the extended gateway itself from sending ARP requests or responses to the core switch through the second filtering rule, ensuring that all ARP communication is carried out under the monitoring of the control plane and preventing traffic from bypassing the extended gateway for direct forwarding.

[0034] The beneficial effects of this embodiment are as follows: Through VLAN isolation and software bridging technology, multiple gateways can work collaboratively on ordinary commercial gateways without replacing expensive high-end dedicated gateway equipment, significantly reducing the hardware cost of enterprise-level network and IoT deployments; through two-layer ARP filtering rules, ARP pollution is effectively suppressed, improving network security and controllability; and through software bridging, controllable forwarding is achieved, ensuring that all traffic passing through the extended gateway is subject to network management policies, avoiding policy bypass issues caused by hardware pass-through forwarding.

[0035] Example 2 Please see Figure 2 This invention provides a data flow and control logic implementation for a gateway horizontal expansion system based on bridging control and ARP filtering. To achieve the above objectives, this invention is implemented through the following technical solution: Based on embodiment 1, this embodiment further describes in detail the data flow inside the extended gateway and the specific working logic of the filtering control module.

[0036] Specifically: such as Figure 2 As shown in the diagram, this embodiment focuses on the data processing flow and the role of filtering rules within the extended gateway. It can be clearly seen from the diagram that data sent by the lower-level network device first arrives at the first physical network port, then enters the first network interface (corresponding to the first VLAN), then enters the software bridge, and after being forwarded by the bridging module, arrives at the second network interface (corresponding to the second VLAN). Finally, it is sent to the main gateway through the second physical network port, and then forwarded by the main gateway to the core switch.

[0037] In this embodiment, there is a close interaction between the filtering control module and the software bridge. The filtering control module is responsible for configuring and managing three key functions: enabling the bridging firewall function, configuring the first filtering rule, and configuring the second filtering rule.

[0038] Regarding enabling the bridging firewall function, such as Figure 2 As shown by the dashed arrow, the filtering control module sends a command to the software bridge to enable the `bridge-nf-call-arptables` function. Once enabled, all ARP packets forwarded by the software bridge are passed to arptables for processing, allowing subsequent ARP filtering rules to take effect. In this embodiment, this function is enabled by setting a Linux kernel parameter, specifically: `echo1> / proc / sys / net / bridge / bridge-nf-call-arptables`. When this parameter is set to 1, the software bridge will simultaneously invoke the arptables framework for rule matching when forwarding ARP packets.

[0039] Regarding the configuration of the first filtering rule, such as Figure 2 As shown, the first filtering rule configured by the filtering control module operates on the path between the software bridge and the main gateway, specifically by discarding ARP responses from the main gateway. In this embodiment, the first filtering rule is implemented using arptables, and its complete command is: arptables-AFORWARD-s[main gateway IP address]-jDROP. The mechanism of this rule is as follows: when the main gateway sends ARP response packets to the network, these ARP response packets enter the second physical network interface of the extended gateway through the network switch, and then enter the software bridge. During the forwarding process of the software bridge, because the bridge-nf-call-arptables function is enabled, these ARP response packets will be checked by the arptables rule chain. When an ARP response packet with the source IP address being the main gateway IP address is matched, the first filtering rule will directly discard these packets, preventing them from being forwarded to the first physical network interface through the software bridge, thereby preventing downstream network devices from receiving ARP responses from the main gateway.

[0040] Regarding the configuration of the second filtering rule, such as Figure 2 As shown, the second filtering rule configured by the filtering control module applies to ARP packets sent by the extended gateway itself towards the core switch. Specifically, it discards ARP requests or responses actively sent by the extended gateway towards the core switch. In this embodiment, the second filtering rule is implemented through ebtables, and its complete command is: ebtables -AOUTPUT -pARP -o [network interface name corresponding to the second VLAN] -jDROP. The mechanism of this rule is as follows: when the extended gateway's own protocol stack attempts to send ARP packets outward through the second network interface (corresponding to the second VLAN), these packets will be checked by the ebtablesOUTPUT chain before leaving the extended gateway. When a packet with the protocol type ARP and the output interface being the second network interface is matched, the second filtering rule will directly discard these packets, preventing them from being sent to the network switch and the core switch through the second physical network port.

[0041] In this embodiment, fine-grained control of ARP communication is achieved through the coordinated operation of the aforementioned dual filtering rules. The first filtering rule (arptables) primarily controls incoming ARP communication, preventing the ARP information of the main gateway from spreading to lower-level networks; the second filtering rule (ebtables) primarily controls outgoing ARP communication, preventing the ARP information of the extended gateway itself from interfering with the ARP entries on the core switch side. The combination of these two rules ensures that all ARP communication related to the extended gateway is conducted under the monitoring of the control plane, thereby fundamentally eliminating the security risks of traffic bypassing the control plane.

[0042] Furthermore, this embodiment also demonstrates the logical relationships between the various modules within the extended gateway. The VLAN configuration module is responsible for creating the first and second VLANs and assigning physical network ports to the corresponding VLANs; the bridging module is responsible for creating a software bridge and bridging the two VLAN interfaces; and the filtering control module is responsible for configuring the bridged firewall and filtering rules. These three modules work together to form a complete and controllable forwarding channel.

[0043] The beneficial effects of this embodiment are as follows: through the dual-layer filtering mechanism of arptables and ebtables, fine-grained control of ARP communication is achieved, which not only prevents external ARP pollution but also avoids internal ARP interference, greatly improving the security and stability of the network; the data flow and the position of the filtering rules are clearly shown in a graphical way, making the technical solution of the present invention easier to understand and implement.

[0044] Example 3 Please see Figure 3 This invention provides a module logic relationship of a gateway horizontal expansion system based on bridging control and ARP filtering. To achieve the above objectives, this invention is implemented through the following technical solution: Based on Embodiments 1 and 2, this embodiment further describes in detail the logical relationship and interaction process between the functional modules inside the extended gateway.

[0045] Specifically: such as Figure 3 As shown in the diagram, this embodiment divides the internal modules of the extended gateway into three core modules according to their functions: a VLAN configuration module, a bridging module, and a filtering control module, as well as four physical / logical interfaces: a first physical network port, a second physical network port, a first network interface (corresponding to the first VLAN), and a second network interface (corresponding to the second VLAN). The control relationships and dependencies between the modules are clearly shown by arrows in the diagram.

[0046] The filtering control module is the core of the entire system, responsible for initiating and coordinating configuration operations of other modules. Specifically, a configuration relationship exists between the filtering control module and the VLAN configuration module. The filtering control module sends instructions to the VLAN configuration module, requesting it to create a first VLAN and a second VLAN on the network switch. This operation is the first step of this invention, aiming to achieve data isolation between the two network ports at the physical layer, creating conditions for subsequent controllable forwarding. In this embodiment, the first VLAN is preferably VLAN 15, and the second VLAN is preferably VLAN 16, but in practical applications, these can be flexibly adjusted according to network planning.

[0047] A configuration relationship also exists between the filtering control module and the bridging module. The filtering control module sends instructions to the bridging module, requesting it to create a software bridge within the extended gateway. The creation of the software bridge is crucial for achieving controllable forwarding in this invention. It connects two VLAN interfaces that were originally hardware-isolated at the software level, enabling data forwarding under CPU control. In this embodiment, the software bridge is created using the `bridge-utils` tool on the Linux system, specifically with the command: `brctladdbrbr-lan2`. Then, two VLAN interfaces are added to the bridge: `brctladdifbr-lan2eth0.15` and `brctladdifbr-lan2eth0.16`.

[0048] After receiving instructions from the filtering control module, the VLAN configuration module is responsible for the specific VLAN configuration operations. It communicates with the network switch via SNMP protocol or command-line interface, creates the specified VLAN on the switch, and assigns the physical network ports of the extended gateway to the corresponding VLANs. Specifically, the VLAN configuration module adds the first physical network port to the first VLAN and the second physical network port to the second VLAN. After this operation, the first and second physical network ports are isolated at the hardware level, and data between them cannot be directly forwarded through the switch.

[0049] After a physical network port is added to a VLAN, the operating system of the extended gateway will automatically generate the corresponding virtual network interface. For example... Figure 3 As shown, after the first physical network port is added to the first VLAN, a first network interface (e.g., eth0.15) is generated; after the second physical network port is added to the second VLAN, a second network interface (e.g., eth0.16) is generated. These two network interfaces are logical interfaces at the operating system level, used to handle network communication for the corresponding VLANs.

[0050] After receiving instructions from the filtering control module, the bridging module is responsible for creating a software bridge and bridging the first and second network interfaces to the software bridge. For example... Figure 3 As shown, the bridging module adds these two network interfaces as bridge ports to the software bridge, ensuring that data forwarding between them must pass through the software bridge. After this operation, the two physical network ports, originally isolated by hardware, are connected at the software level via the software bridge. However, all data packets forwarded through the software bridge can be monitored and controlled by the bridging module.

[0051] After completing VLAN configuration and software bridge creation, the filtering control module further configures the bridging module. Specifically, the filtering control module sends a command to the bridging module, requesting it to enable the bridged firewall function by setting the ` / proc / sys / net / bridge / bridge-nf-call-arptables` parameter to true. This operation causes the software bridge to simultaneously invoke the arptables framework for rule matching when forwarding ARP packets.

[0052] Finally, the filter control module is responsible for configuring the specific filter rules. For example... Figure 3 As shown, the filtering control module configures the first and second filtering rules to the bridging module. The first filtering rule, implemented using arptables, is used to discard ARP responses from the main gateway; the second filtering rule, implemented using ebtables, is used to discard ARP packets actively sent by this extended gateway towards the core switch. Once these two rules are configured, the filtering control function of the entire system is complete.

[0053] In this embodiment, the interaction sequence and dependencies between modules embody the core design philosophy of this invention: first, physical isolation is achieved through VLANs; then, controllable connectivity is achieved through software bridges; and finally, fine-grained control is achieved through filtering rules. This layered design gives the system excellent modularity and scalability, allowing each module to be independently optimized and upgraded without affecting the normal operation of other modules.

[0054] Furthermore, this embodiment also illustrates the relationship between the extended gateway and external network devices. The first physical network port connects to the downstream network device, the second physical network port connects to the LAN side of the main gateway, and the uplink of the main gateway connects to the core switch. This connection method ensures that all traffic from the downstream network devices must be processed by the extended gateway before reaching the main gateway and the core switch.

[0055] The beneficial effects of this embodiment are as follows: through clear module division and logical relationship description, the internal working principle of the present invention is revealed, enabling those skilled in the art to accurately understand the functions and interaction methods of each module, facilitating configuration and debugging in actual deployment; the modular design makes the system have good maintainability and scalability, and the configuration parameters of each module can be flexibly adjusted according to actual needs.

[0056] Example 4 Please see Figure 4This invention provides a gateway horizontal scaling method based on bridging control and ARP filtering. To achieve the above objectives, this invention is implemented through the following technical solution: This embodiment describes in detail the specific steps of the gateway horizontal scaling method implemented based on the aforementioned system. This method can be applied to a network environment containing a main gateway and a core switch, and achieves gateway horizontal scaling through seven ordered steps.

[0057] Specifically: such as Figure 4 As shown, the method provided in this embodiment includes the following seven steps, which are executed sequentially in the order of S1 to S7: S1: Connect the second physical network port of the extended gateway to the LAN side of the main gateway, and connect the first physical network port of the extended gateway to the downstream network device. This step is the physical deployment phase and requires hardware connection to be completed in the actual network environment. Specifically, technicians should prepare an extended gateway device running a Linux operating system, ensuring it has at least two usable physical network ports. Connect one of the physical network ports (i.e., the second physical network port) to the LAN port of the main gateway via a network cable, and connect the other physical network port (i.e., the first physical network port) to the downstream network device or downstream switch via a network cable. After completing the physical connection, the extended gateway can establish a physical path with the main gateway and the downstream network.

[0058] S2: Create the first and second VLANs on the network switch. This step requires configuration on the network switch connecting the main gateway and the extension gateway. Technical personnel should log into the switch's management interface and create two different VLANs, such as VLAN 15 and VLAN 16. These two VLANs will be used to isolate the two physical network ports of the extension gateway, preventing data between them from being directly forwarded through the switch hardware. When creating the VLANs, ensure that the switch port connected to the main gateway is configured in trunk mode, allowing these two VLANs to pass through, so that the extension gateway can receive traffic from the corresponding VLANs.

[0059] S3: Add the first physical network port to the first VLAN, and add the second physical network port to the second VLAN. This step involves port assignment on the switch. The technician should configure the switch port connected to the first physical network port of the extension gateway in access mode and assign it to the first VLAN (e.g., VLAN 15), and the switch port connected to the second physical network port of the extension gateway in access mode and assign it to the second VLAN (e.g., VLAN 16). After this configuration, the first and second physical network ports are completely isolated at the hardware level, and any communication between them must be processed by the CPU of the extension gateway.

[0060] S4: Create a software bridge within the extended gateway and bridge the first network interface corresponding to the first VLAN and the second network interface corresponding to the second VLAN to the software bridge. This step is configured within the extended gateway's operating system. After the switch completes VLAN configuration, the extended gateway's operating system will automatically generate the corresponding VLAN virtual interfaces, such as eth0.15 (corresponding to the first VLAN) and eth0.16 (corresponding to the second VLAN). Technicians need to use Linux bridging tools to create the software bridge; the specific commands are as follows: Brctl_addbr_br-lan2; Brctl_addif_br-lan2_eth0.15; Brctl_addif_br-lan2_eth0.16; Ip_link_set_br-lan2_up; After completing the above commands, eth0.15 and eth0.16 are added to the software bridge br-lan2, and data can be forwarded between them via the software bridge. Simultaneously, since the two physical network ports are VLAN-isolated at the hardware level, all data that needs to be forwarded between them must pass through this software bridge, thus achieving controllable forwarding at the CPU level.

[0061] S5: Enable the bridging firewall function of the extended gateway, allowing data link layer filtering rules to process ARP packets forwarded through the software bridge. This step is achieved by modifying Linux kernel parameters; the specific commands are as follows: echo_1> / proc / sys / net / bridge / bridge-nf-call-arptables; This command sets the kernel parameter `bridge-nf-call-arptables` to 1, causing the software bridge to pass ARP packets to the arptables framework for processing when forwarding them. To ensure this setting remains effective after a system reboot, you can add this command to the system's startup script or modify the ` / etc / sysctl.conf` file by adding the line `net.bridge.bridge-nf-call-arptables=1`.

[0062] S6: Configure the first filtering rule to discard ARP responses from the main gateway. This step is implemented using the arptables tool, with the specific command as follows: arptables_-A_FORWARD_-s_10.168.5.1_-j_DROP; The 10.168.5.1 setting needs to be replaced with the IP address of the primary gateway in the actual environment. This command adds a rule to the arptables FORWARD chain: when the software bridge forwards ARP packets, if the source IP address of the packet is equal to the IP address of the primary gateway, it will be discarded. To ensure that the rule remains effective after a system restart, the arptables rule can be saved to a file and loaded at system startup. The specific command is as follows: arptables-save> / etc / arptables.rules; Then add arptables-restore to the system startup script < / etc / arptables.rules。

[0063] S7: Configure a second filtering rule to discard ARP packets actively sent by this extended gateway towards the core switch. This step is implemented using the ebtables tool, with the specific command as follows: ebtables_A_OUTPUT_-p_ARP_-o_eth0.16_-j_DROP; Here, eth0.16 needs to be replaced with the network interface name of the corresponding second VLAN in the actual environment. This command adds a rule to the ebtables OUTPUT chain. When the extended gateway itself sends a packet, if the packet's protocol type is ARP and the output interface is the second network interface, it will be discarded directly. Similarly, to ensure rule persistence, the ebtables-save and ebtables-restore commands can be used to save and load the rule.

[0064] In this embodiment, the execution order of the above seven steps has a strict logical structure. S1 Physical connection is fundamental; hardware deployment must be completed before subsequent configuration can proceed. S2 and S3 VLAN configuration are performed at the switch level and must be completed before software bridge creation to ensure that VLAN interfaces can be correctly generated. S4 Software bridge creation is performed at the operating system level and must be performed after VLAN interfaces are generated. S5 Enabling the bridged firewall is a prerequisite for filtering rules to take effect and must be completed before configuring filtering rules. S6 and S7 Filtering rule configuration is the final step and must be performed after all prerequisites are met to ensure that the rules can be correctly applied.

[0065] By executing the above seven steps completely, this embodiment constructs a complete gateway horizontal scaling method. In actual operation, data traffic sent by the downstream network devices is forwarded along the following path: downstream device - first physical network port - first VLAN - software bridge - second VLAN - second physical network port - main gateway. Throughout the forwarding process, the bridging firewall function enabled in S5 ensures that ARP packets can be checked by filtering rules; the first filtering rule configured in S6 discards ARP responses from the main gateway, preventing downstream devices from directly establishing ARP communication with the main gateway; the second filtering rule configured in S7 prevents the extended gateway itself from sending ARP packets towards the core switch, ensuring that the ARP entries on the core switch side are not interfered with.

[0066] The beneficial effects of this embodiment are as follows: it provides a complete and operable set of methods and steps, which can be followed by those skilled in the art to deploy the technical solution of the present invention in a real network environment and realize the horizontal expansion of the gateway; each step has specific operation guidance and command examples, which lowers the threshold for technical implementation; the logical relationship between the steps is clear, ensuring the correctness and effectiveness of the entire configuration process.

[0067] In conclusion, the above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A gateway horizontal scaling system based on bridging control and ARP filtering, characterized in that, include: Main gateway, core switch and expansion gateway; The extended gateway includes: The first physical network port is used to connect to downstream network devices; The second physical network port is used to connect to the local area network side of the main gateway; The VLAN configuration module is used to create a first VLAN and a second VLAN on the network switch, and add the first physical network port to the first VLAN and the second physical network port to the second VLAN to achieve data isolation between the two physical network ports. A bridging module is used to create a software bridge inside the extended gateway and bridge the first network interface corresponding to the first VLAN and the second network interface corresponding to the second VLAN to the software bridge, so that data that was originally isolated by hardware can be forwarded in a controllable manner at the software bridge level. The filter control module is used for: Enable the bridging firewall function, allowing data link layer filtering rules to process ARP packets forwarded through the software bridge; Configure the first filtering rule to discard ARP responses from the main gateway to prevent ARP pollution; Configure a second filtering rule to discard ARP packets actively sent by this extended gateway toward the core switch.

2. The gateway horizontal scaling system based on bridging control and ARP filtering according to claim 1, characterized in that, The lower-level network devices include switches, routers, servers, or IoT terminal devices; The LAN side of the main gateway is the core egress device of the LAN; The core switch is located in the uplink of the main gateway and is used to connect to the external network or other subnets.

3. A gateway horizontal scaling system based on bridging control and ARP filtering according to claim 1, characterized in that, The filtering control module is configured to: during the process of the extended gateway receiving data traffic from the lower-level network device through the first physical network port and forwarding the data traffic to the second physical network port via the first VLAN, the software bridge and the second VLAN, block the ARP responses sent by the main gateway to the lower-level network device through the first filtering rule, and at the same time prevent the extended gateway itself from sending ARP requests or responses to the core switch through the second filtering rule.

4. A gateway horizontal scaling system based on bridging control and ARP filtering according to claim 1, characterized in that, Enabling the bridging firewall function specifically involves setting the operating system parameter / proc / sys / net / bridge / bridge-nf-call-arptables to true, thereby allowing arptables to handle ARP packets forwarded through the software bridge.

5. A gateway horizontal scaling system based on bridging control and ARP filtering according to claim 1, characterized in that, The first filtering rule is implemented using the arptables tool, with the specific command being: arptables-AFORWARD-s[main gateway IP address]-jDROP.

6. A gateway horizontal scaling system based on bridging control and ARP filtering according to claim 1, characterized in that, The second filtering rule is implemented using the ebtables tool. The specific command is: ebtables -AOUTPUT -pARP -o [the network interface name corresponding to the second VLAN] -jDROP.

7. A gateway horizontal scaling method based on bridging control and ARP filtering, characterized in that, For network environments that include a main gateway and a core switch, the following steps are included: S1. Connect the second physical network port of the extended gateway to the local area network side of the main gateway, and connect the first physical network port of the extended gateway to the downstream network device; S2. Create the first VLAN and the second VLAN on the network switch; S3: Add the first physical network port to the first VLAN, and add the second physical network port to the second VLAN; S4. Create a software bridge inside the extended gateway, and bridge the first network interface corresponding to the first VLAN and the second network interface corresponding to the second VLAN to the software bridge; S5. Enable the bridging firewall function of the extended gateway, allowing data link layer filtering rules to process ARP packets forwarded through the software bridge; S6. Configure the first filtering rule to discard ARP responses from the main gateway; S7. Configure a second filtering rule to discard ARP packets actively sent by this extended gateway to the core switch.

8. A gateway horizontal scaling method based on bridging control and ARP filtering according to claim 7, characterized in that, The software bridge is created by setting the operating system parameter / proc / sys / net / bridge / bridge-nf-call-arptables to 1, thereby allowing arptables to process ARP packets forwarded through the software bridge.

9. A gateway horizontal scaling method based on bridging control and ARP filtering according to claim 7, characterized in that, The specific method for configuring the bridging firewall function is as follows: it is implemented through the arptables tool, and the specific command is: arptables-AFORWARD-s[main gateway IP address]-jDROP.

10. A gateway horizontal scaling method based on bridging control and ARP filtering according to claim 7, characterized in that, The configuration method for the first filtering rule is as follows: it is implemented through the ebtables tool, and the specific command is: ebtables -AOUTPUT -pARP -o [network interface name corresponding to the second VLAN] -jDROP.

Images