Session matching method and system for firewall layer 2 access based on ARP hijacking

Abstract

The present application relates to the technical field of session matching, in particular to a session matching method and system based on ARP hijacking when a firewall accesses in layer 2; from the perspective of ARP message processing, the ARP hijacking function is started on the firewall, the source IP, source MAC or destination MAC information of the forwarded ARP request and response messages are monitored and modified, the layer 2 forwarded message is converted into layer 3 forwarding, and the problem of session mismatch is solved.

Description

Technical Field

[0001] This invention relates to the field of session matching technology, and more specifically, to a session matching method and system for Layer 2 access of a firewall based on ARP hijacking. Background Technology

[0002] Currently, the closest solution to the problem of abnormal session type switching during Layer 2 access via NG firewalls is the "session type forced locking" technology, which is implemented as follows: Configuration logic: Manually configure the "Session Type Locking Rule" on the NG firewall to force the communication between the PC's network segment (e.g., 192.168.1.0 / 24) and the external network to be a Layer 3 session. Regardless of whether the destination MAC of subsequent data packets is the firewall itself, the session will not be allowed to refresh from Layer 3 to Layer 2. Forwarding process: During forward packet transmission, the destination MAC of the PC data packet is the MAC of the firewall's VLANIF interface. The firewall creates a Layer 3 session and triggers a "session type locking rule" to mark the session as "cannot be refreshed to Layer 2". When transmitting return packets, the egress router encapsulates the PC's MAC address as the destination MAC address. After the packet arrives at the firewall, although the destination MAC address is not the firewall itself, the firewall still forwards the packet based on the routing information of the Layer 3 session because the session has been locked as a Layer 3 type. It does not execute Layer 2 forwarding logic or refresh the session type. If the subsequent messages sent by the PC match the locked Layer 3 session, the firewall will modify the destination MAC address of the data packet to the MAC address of the egress router interface before forwarding it to the router, thus preventing the router from dropping the data packet due to MAC mismatch.

[0003] This solution, which theoretically resolves service interruption issues by forcibly locking session types, has significant drawbacks in practical applications: First, the "session type locking rule" needs to be configured based on specific network segments. When there are many PC network segments in an enterprise network (e.g., different departments are divided into different network segments), rules need to be configured one by one, resulting in a large workload. Furthermore, rules need to be manually added when a new network segment is added. Second, if the PC network segment is dynamically allocated via DHCP or the network segment range changes, the original locking rules will become invalid, requiring readjustment and high maintenance costs. Finally, this solution only applies to already created sessions. If the NG firewall restarts or the session times out and is recreated, the locking rule needs to be retried, resulting in a "rule effectiveness delay," which may lead to service interruption for a short period.

[0004] While the session type mandatory locking scheme can alleviate the problem of abnormal session type switching, it has the following technical drawbacks: 1. High configuration and maintenance costs: This solution requires configuring locking rules based on the network segment where the PC is located. If there are M PC network segments in the enterprise network, M rules need to be configured, and each rule needs to specify parameters such as network segment address, protocol type, and forwarding direction. When M reaches dozens (such as network segments of multiple departments in a large enterprise), the workload of manual configuration increases linearly, and problems such as "network segment configuration error" and "rule conflict" are prone to occur. At the same time, when the PC network segment changes (such as changing from 192.168.1.0 / 24 to 192.168.2.0 / 24) or a new network segment is added, old rules need to be deleted and new rules need to be added manually. If the operation is missed, the sessions of the corresponding network segment will still switch abnormally, resulting in extremely high maintenance costs.

[0005] 2. Poor adaptability and inability to handle dynamic network segment environments: In scenarios using DHCP to dynamically allocate network segments (such as dynamically dividing IP segments based on VLANs) or where the network segment range is not fixed (such as temporary office network segments), the PC network segment may change frequently. However, the "session type locking rule" is statically configured and cannot automatically recognize dynamic network segments. When a PC obtains a new network segment IP, the original locking rule cannot cover the new network segment, and newly created sessions will still be refreshed from Layer 3 to Layer 2, causing service interruption. If the rules are frequently modified to adapt to dynamic network segments, it will further increase the maintenance complexity and may even cause rule confusion.

[0006] 3. Delayed Implementation and Incomplete Business Continuity Guarantee: The core of this solution is "locking the created session type." However, if the NG firewall restarts, the session times out (e.g., the default session timeout is 30 minutes), or network fluctuations cause the session to disconnect, it needs to be recreated. When a new session is created, the "session type locking rule" needs to wait for the first data packet (usually a forward packet sent by the PC) to trigger before it takes effect. If a return packet arrives at the firewall after the new session is created but before the rule takes effect, it will still trigger a session type refresh, causing a short-term business interruption (usually lasting 1-3 minutes), which cannot fully guarantee business continuity. Summary of the Invention

[0007] This invention addresses the problems of high configuration and maintenance costs, poor adaptability, and delayed effectiveness in existing session matching methods, which cannot fully guarantee business continuity. It proposes a session matching method and system based on ARP hijacking for Layer 2 access of firewalls. From the perspective of ARP packet processing, by enabling ARP hijacking on the firewall, the source IP, source MAC, or destination MAC information of forwarded ARP request and response packets is monitored and modified, converting Layer 2 forwarded packets into Layer 3 forwarded packets, thereby solving the session mismatch problem in the prior art.

[0008] The specific implementation details of this invention are as follows: A session matching method for Layer 2 access of a firewall based on ARP hijacking is proposed. First, the ARP hijacking function is deployed on the NG firewall to intercept and modify the ARP packets between the egress router and the PC gateway. The egress router is forced to encapsulate the destination MAC of the return packet as the MAC of the NG firewall's VLANIF interface, ensuring that the return packet always triggers the firewall's Layer 3 forwarding logic and preventing the original Layer 3 session from being refreshed into a Layer 2 session.

[0009] To better implement this invention, the session matching method for Layer 2 access via a firewall based on ARP hijacking further includes the following steps: Step S1: Capture ARP packets passing through the NG firewall in real time from the interface of the NG firewall operating in switching mode or Layer 2 mode, parse the opcode, sender IP field, sender MAC field, target IP field, and target MAC field of the packet, and filter out ARP packets that are the same as the VLANIF network segment; Step S2: Receive the parsed ARP packet and perform targeted modifications based on the parsed ARP packet type; if the ARP packet type is an ARP request packet and the local machine does not have an ARP entry with the target IP field, intercept the ARP request packet, replace the send IP and sender MAC with the IP and MAC of the NG firewall, and keep the destination address unchanged; if the packet type is an ARP reply packet, directly intercept it; if an ARP entry with the target IP exists, the NG firewall constructs an ARP response packet, and the senderIP and sendmac of the response packet are the IP and MAC of the VLANIF interface; Step S3: The modified ARP request packet is forwarded to the PC gateway through the NG firewall, and an ARP response packet is returned from the PC gateway. After the ARP response packet arrives at the NG firewall, the NG firewall recognizes the destination MAC as its own interface MAC. After receiving the ARP response packet, it creates a neighbor table entry. If the terminal does not receive an ARP response, it will request again. At this time, the firewall has already learned the destination's neighbor table and will respond directly.

[0010] To better realize the present invention, step S2 further includes the following steps: Step S21: Receive the parsed ARP packet and determine the ARP packet type; Step S22: If the ARP packet type is an ARP request packet, determine whether the destination IP of the request is in the same network segment as the vbn interface. If so, perform ARP hijacking and determine whether there is an entry for the requested address. Otherwise, modify the ARP request packet and send it. Step S23: If the ARP packet type is an ARP response packet, determine whether the destination IP of the response is itself. If so, learn the ARP entry.

[0011] To better realize the present invention, step S22 further includes the following steps: Step S221: After the return packet arrives at the egress router, the router queries the routing table to determine that the network segment where the PC is located is a directly connected network segment, sends an ARP request packet, transmits it to the NG firewall through the Layer 2 network, captures the ARP request packet and parses the key fields; Step S222: Receive the parsed ARP request packet, change the sender IP field of the ARP request packet from "IP address of the downstream port of the egress router" to "IP address of the NG firewall VLANIF interface", change the sender MAC field from "MAC address of the downstream port of the egress router" to "MAC address of the NG firewall VLANIF interface", and keep everything else unchanged; Step S223: Forward the modified ARP request message to the PC gateway through the NG firewall, and return an ARP response message from the PC gateway.

[0012] To better realize the present invention, step S23 further includes the following steps: Step S231: If the egress router does not receive a simulated response from the firewall, it will send a broadcast ARP request again. At this time, the PC gateway will receive the request and send an ARP response packet. After the ARP response packet arrives at the NG firewall, it will be captured and parsed. Step S232: Change the source IP of the ARP response packet from "PC's IP" to "NG Firewall VLANIF Interface IP", change the source MAC from "PC's MAC" to "NG Firewall VLANIF Interface MAC", and leave the destination IP and destination MAC unchanged.

[0013] To better realize the present invention, step S3 further includes the following steps: Step S31: The return packet from the external network is transmitted to the egress router via the operator. The router queries the ARP table and finds that the MAC address corresponding to the network segment where the PC is located is the MAC address of the NG firewall VLANIF interface. Therefore, the destination MAC address of the return packet is encapsulated as "NG firewall VLANIF interface MAC", the source MAC address is the MAC address of the egress router interface, and the destination IP address is the IP address of the PC. Step S32: After the return packet arrives at the NG firewall, the NG firewall identifies the destination MAC as its own interface MAC, goes through a Layer 3 forwarding session, and forwards the packet to the PC based on the routing information in the session.

[0014] To better realize the present invention, step S3 further includes: Step S33: The PC gateway sends a new forward packet with the destination MAC address being the VLANIF interface MAC address of the NG firewall. After the packet arrives at the NG firewall, it is matched with a Layer 3 session. Step S34: Based on the routing information of the Layer 3 session, the NG firewall modifies the destination MAC of the packet to the MAC of the downstream interface of the egress router and modifies the source MAC to the MAC of its own corresponding interface, and forwards it to the egress router. Step S35: After receiving the data packet, the outgoing router detects that the destination MAC address of the data packet is its own interface MAC address, forwards it normally to the operator's network, and the service communication returns to normal.

[0015] Based on the aforementioned session matching method for firewall Layer 2 access based on ARP hijacking, in order to better implement this invention, a further proposed system for session matching during firewall Layer 2 access based on ARP hijacking is provided, which is used to execute the aforementioned session matching method for firewall Layer 2 access based on ARP hijacking; including a data packet processing module, a data packet interception module, a data packet modification module, and a data packet forwarding module. The data packet processing module is used to capture ARP packets passing through the NG firewall in real time from the Layer 2 forwarding path of the NG firewall, parse the opcode, sender IP field, sender MAC field, target IP field, and target MAC field of the packet, and filter out ARP packets that are the same as the VLANIF network segment. The data packet interception module is used to receive parsed ARP packets; The data packet modification module is used to perform targeted modifications based on the parsed ARP packet type; if the ARP packet type is an ARP request packet and the local machine does not have an ARP table entry with a target IP field, the sender IP field and sender MAC field in the ARP request packet are modified; if the packet type is an ARP reply packet, it is directly intercepted. The data packet forwarding module is used to forward the modified ARP request packet to the PC gateway through the NG firewall and return the ARP response packet from the PC gateway. After the ARP response packet arrives at the NG firewall, the NG firewall recognizes the destination MAC as its own interface MAC and directly matches the created Layer 3 session without triggering the slow forwarding process. Based on the routing information in the Layer 3 session, the ARP response packet is forwarded to the PC gateway.

[0016] The present invention has the following beneficial effects: (1) This invention automatically intercepts and modifies ARP learning ARP entry hijacking modules, eliminating the need to manually configure network segment locking rules on the firewall. Regardless of the number of network segments on the PC or whether new network segments are added, the firewall can process ARP learning ARP entry requests / responses in real time, automatically guiding the egress router to establish a mapping with the firewall, thus reducing maintenance costs.

[0017] (2) In scenarios where DHCP dynamically allocates network segments or network segment ranges change, the PC's IP address or network segment will change dynamically, rendering the static locking rules of existing technologies ineffective. However, in this invention, the firewall modifies the packet based on the PC's current IP address every time the outgoing router sends an ARP request, ensuring that the ARP mapping always matches the PC's actual network segment. Even if the PC's network segment changes from 192.168.1.0 / 24 to 192.168.2.0 / 24, the firewall can automatically adapt without manual adjustment, demonstrating excellent compatibility.

[0018] (3) This invention guides the egress router to establish the correct ARP mapping in advance through ARP hijacking. When the return packet arrives at the firewall, the destination MAC is already the firewall itself. There is no need to trigger the slow transfer process. It directly matches the Layer 3 session. Moreover, the session protection linkage module will prohibit session type refresh in real time. Even if the firewall restarts or the session times out, the newly created session will still maintain the Layer 3 type due to the correct ARP mapping. There is no delay in the effect, which fully guarantees the continuity of business.

[0019] (4) This invention only modifies the ARP packets for “PC communication with external network”, without interfering with the ARP communication of other devices in the same VLAN, thus avoiding impact on internal services; at the same time, ARP hijacking is only used to force data frames to be forwarded through the firewall layer 3, without tampering with core communication information such as IP address and port, and without forging false ARP mappings, so there is no risk of data leakage or network deception, and the security is high. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the firewall provided by the present invention accessing the network in a Layer 2 manner.

[0021] Figure 2 The system framework diagram provided for this invention.

[0022] Figure 3 The ARP processing flowchart provided by this invention.

[0023] Figure 4 A flowchart for ARP request processing provided by the present invention.

[0024] Figure 5 A flowchart for ARP response processing provided by this invention. Detailed Implementation

[0025] To more clearly illustrate the technical solutions of the embodiments of the present invention, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments, and therefore should not be regarded as a limitation on the scope of protection. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "set up," "connected," and "linked" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0027] The complete English translations of the technical terms and abbreviations used in this embodiment are as follows: NG Firewall (Next-Generation Firewall, NGFW): A next-generation firewall that, while possessing the functions of a traditional firewall, adds capabilities such as deep packet inspection, application identification, and accelerated session forwarding. It relies on session tables to achieve efficient data forwarding. This embodiment focuses on the session type control issue in its Layer 2 access scenario.

[0028] Layer 2 Access: This refers to network devices (such as NG firewalls) operating at the data link layer of the OSI model, with interfaces using switch mode, forwarding data based on MAC addresses, without performing routing calculations, and only isolating broadcast domains through VLANs.

[0029] VLANIF Interface (VLAN Interface): A logical Layer 3 interface created on an NG firewall for a specific VLAN. It has an IP address and can act as a gateway for terminal devices (such as PCs) to enable communication between Layer 2 and Layer 3 networks.

[0030] Switch Mode: A working mode of the NG firewall interface. In this mode, the interface only processes Layer 2 data frames, forwards data packets based on the MAC address table, does not participate in IP routing, and is equivalent to the function of a switch interface.

[0031] Session: A data structure in NG firewalls that records connection information between two communicating parties (such as a PC and an external network device). It includes fields such as source IP, destination IP, source port, destination port, protocol type, forwarding type (Layer 3 / Layer 2), and outgoing interface. It is used to accelerate the forwarding efficiency of subsequent packets in the same connection. Layer 3 sessions are based on route forwarding, and Layer 2 sessions are based on MAC address forwarding.

[0032] ARP (Address Resolution Protocol) is a network protocol used to translate IP addresses into physical MAC addresses. Devices obtain the MAC address corresponding to a target IP by sending ARP request messages and return the mapping relationship by sending ARP response messages, ensuring the correct delivery of data frames at the data link layer.

[0033] ARP hijacking: In this solution, it specifically refers to the NG firewall actively monitoring and modifying the source IP, source MAC, or destination MAC fields of ARP packets, so that other devices in the network (such as egress routers and PCs) recognize the firewall as the device corresponding to the MAC address of the communication target, forcing data frames to pass through the firewall's three-layer forwarding logic. This is a functional technique that is different from malicious ARP spoofing attacks.

[0034] Slow Path Forwarding: In NG firewalls, the forwarding path used for packets that do not match the fast forwarding rules or require special handling (such as session query or route recalculation) requires a complete protocol parsing, session verification, and route query process. The forwarding efficiency is lower than that of fast forwarding, but it can ensure the correctness of the forwarding logic.

[0035] In enterprise network architectures, the NG firewall is a core security and forwarding device. Its session acceleration forwarding function is key to improving network throughput. The NG firewall creates a session table for the first transmitted data packet, and subsequent data packets on the same connection are directly matched to the session table for fast forwarding, eliminating the need for time-consuming operations such as repeated route lookups and protocol parsing. Depending on the access method, NG firewall sessions are divided into two categories: Layer 3 Session: When the NG firewall interface is working in routing mode, or when it is a Layer 2 access but the destination MAC of the data packet is the MAC of the firewall's own interface, the firewall will perform route calculation and create a Layer 3 session for the data packet. Subsequent data packets will be forwarded based on the routing information of the Layer 3 session. Layer 2 Session: When the NG firewall accesses the network in Layer 2 mode (the interface is operating in switching mode) and the destination MAC address of the data packet is another device (such as a PC or switch), the firewall forwards the packet directly based on the MAC address table, creating a Layer 2 session. Subsequent data packets do not undergo routing calculations.

[0036] To simplify network topology and reduce the number of Layer 3 devices, enterprises often adopt an "NG firewall Layer 2 access" architecture: The uplink and downlink interfaces of the NG firewall are configured in switching mode, assigned to the same VLAN, and a VLANIF interface is created as the gateway for the PC. In this architecture, when forward packets (PC → external network) are transmitted, because the PC gateway points to the VLANIF interface, the destination MAC address of the data packet is the MAC address of the firewall's VLANIF interface. The firewall creates a Layer 3 session and routes the packet to the egress router, which then forwards it to the carrier network. This process ensures normal communication.

[0037] However, during the transmission of return packets (external network → PC), the egress router queries its routing table and finds that the PC's network segment is a directly connected segment. It then directly sends an ARP request to obtain the PC's MAC address and encapsulates the destination MAC address of the return packet with the PC's MAC address. When this return packet reaches the NG firewall, although it can find the previously created Layer 3 session, because the destination MAC address is not the firewall's own, the firewall triggers a slow forwarding process to re-determine the forwarding logic—ultimately deciding to perform Layer 2 forwarding based on the MAC address table and refreshing the original Layer 3 session to a Layer 2 session. Subsequent new packets sent by the PC, upon reaching the firewall, will match the refreshed Layer 2 session and be forwarded directly in Layer 2 mode (without modifying the destination MAC address). The egress router, upon receiving the packet, finds that the destination MAC address is not its own and will discard the packet, causing service interruption. This problem frequently occurs in scenarios such as enterprise office networks and campus networks that rely on NG firewalls for Layer 2 access, severely impacting business continuity and urgently requiring a technical solution.

[0038] Example 1: This embodiment first deploys the ARP hijacking function on the NG firewall to intercept and modify the ARP packets between the egress router and the PC gateway, forcing the egress router to encapsulate the destination MAC of the return packets as the MAC of the NG firewall's VLANIF interface, ensuring that the return packets always trigger the firewall's Layer 3 forwarding logic, and preventing the original Layer 3 session from being refreshed into a Layer 2 session.

[0039] The session matching method for Layer 2 access of the firewall based on ARP hijacking specifically includes the following steps: Step S1: Capture ARP packets passing through the NG firewall in real time from the interface of the NG firewall operating in switching mode or Layer 2 mode, parse the opcode, sender IP field, sender MAC field, target IP field, and target MAC field of the packet, and filter out ARP packets that are the same as the VLANIF network segment; Step S2: Receive the parsed ARP packet and perform targeted modifications based on the parsed ARP packet type; if the ARP packet type is an ARP request packet and the local machine does not have an ARP entry with the target IP field, intercept the ARP request packet, replace the send IP and sender MAC with the IP and MAC of the NG firewall, and keep the destination address unchanged; if the packet type is an ARP reply packet, directly intercept it; if an ARP entry with the target IP exists, the NG firewall constructs an ARP response packet, and the senderIP and sendmac of the response packet are the IP and MAC of the VLANIF interface; Step S2 specifically includes the following steps: Step S21: Receive the parsed ARP packet and determine the ARP packet type; Step S22: If the ARP packet type is an ARP request packet, determine whether the destination IP of the request is in the same network segment as the vbn interface. If so, perform ARP hijacking and determine whether there is an entry for the requested address. Otherwise, modify the ARP request packet and send it. Step S22 specifically includes the following steps: Step S221: After the return packet arrives at the egress router, the router queries the routing table to determine that the network segment where the PC is located is a directly connected network segment, sends an ARP request packet, transmits it to the NG firewall through the Layer 2 network, captures the ARP request packet and parses the key fields; Step S222: Receive the parsed ARP request packet, change the sender IP field of the ARP request packet from "IP address of the downstream port of the egress router" to "IP address of the NG firewall VLANIF interface", change the sender MAC field from "MAC address of the downstream port of the egress router" to "MAC address of the NG firewall VLANIF interface", and keep everything else unchanged; Step S223: Forward the modified ARP request message to the PC gateway through the NG firewall, and return an ARP response message from the PC gateway.

[0040] Step S23: If the ARP packet type is an ARP response packet, determine whether the destination IP of the response is itself. If so, learn the ARP entry.

[0041] Step S23 specifically includes the following steps: Step S231: If the egress router does not receive a simulated response from the firewall, it will send a broadcast ARP request again. At this time, the PC gateway will receive the request and send an ARP response packet. After the ARP response packet arrives at the NG firewall, it will be captured and parsed. Step S232: Change the source IP of the ARP response packet from "PC's IP" to "NG Firewall VLANIF Interface IP", change the source MAC from "PC's MAC" to "NG Firewall VLANIF Interface MAC", and leave the destination IP and destination MAC unchanged.

[0042] Step S3: The modified ARP request packet is forwarded to the PC gateway through the NG firewall, and an ARP response packet is returned from the PC gateway. After the ARP response packet arrives at the NG firewall, the NG firewall recognizes the destination MAC as its own interface MAC. After receiving the ARP response packet, it creates a neighbor table entry. If the terminal does not receive an ARP response, it will request again. At this time, the firewall has already learned the destination's neighbor table and will respond directly.

[0043] Step S3 specifically includes the following steps: Step S31: The return packet from the external network is transmitted to the egress router via the operator. The router queries the ARP table and finds that the MAC address corresponding to the network segment where the PC is located is the MAC address of the NG firewall VLANIF interface. Therefore, the destination MAC address of the return packet is encapsulated as "NG firewall VLANIF interface MAC", the source MAC address is the MAC address of the egress router interface, and the destination IP address is the IP address of the PC. Step S32: After the return packet arrives at the NG firewall, the NG firewall recognizes the destination MAC as its own interface MAC, directly follows the Layer 3 forwarding session, and forwards the packet to the PC based on the routing information in the session.

[0044] Step S3 further includes: Step S33: The PC gateway sends a new forward packet with the destination MAC address being the VLANIF interface MAC address of the NG firewall. After the packet arrives at the NG firewall, it is matched with a Layer 3 session. Step S34: Based on the routing information of the Layer 3 session, the NG firewall modifies the destination MAC of the packet to the MAC of the downstream interface of the egress router and modifies the source MAC to the MAC of its own corresponding interface, and forwards it to the egress router. Step S35: After receiving the data packet, the outgoing router detects that the destination MAC address of the data packet is its own interface MAC address, forwards it normally to the operator's network, and the service communication returns to normal.

[0045] Working principle: NG firewalls rely on sessions to speed up data forwarding. When the firewall accesses the network in a Layer 2 manner (uplink and downlink interfaces operate in switching mode), such as... Figure 1As shown. If the PC gateway points to the firewall's VLAN interface, when the firewall receives a forward packet and finds that the destination MAC address is its own, it will create a Layer 3 session, then route it to the egress router, and then forward it to the ISP. When the return packet arrives at the router, it queries the routing table and finds that it is a directly connected network segment. Therefore, it directly requests the PC gateway's ARP information, with the destination MAC address of the packet encapsulating the PC gateway. After receiving this packet, the firewall queries the session and can find the session. It needs to go through the slow forwarding process to query the egress interface. Because the destination MAC address is not its own, it goes through the Layer 2 forwarding process to refresh the session to Layer 2. Subsequent packets sent by the PC gateway arrive at the firewall and, finding that the session is a Layer 2 forward, it sends them directly to the router without modifying the MAC address. The router discards the packets because the MAC address is not its own, causing service anomalies. This embodiment, from the perspective of ARP packet processing, enables ARP hijacking on the firewall to monitor and modify the source IP, source MAC, or destination MAC information of forwarded ARP request and response packets, converting Layer 2 forwarded packets into Layer 3 forwarded packets, thereby solving the session mismatch problem in the prior art.

[0046] Example 2: This embodiment is based on the above embodiment 1, such as... Figure 3 The diagram illustrates the ARP request message processing flow.

[0047] Packet interception and parsing: After the return packet arrives at the egress router, the router queries the routing table to determine that the network segment where the PC is located is a directly connected network segment, and sends an ARP request packet (target IP = PC's IP address, target MAC = broadcast MAC address FF:FF:FF:FF:FF:FF, sender IP = egress router's downstream port IP, sender MAC = egress router's downstream port MAC). This packet is transmitted to the NG firewall through the Layer 2 network. The ARP packet interception module captures the packet and parses the key fields. Message Modification: The ARP message modification module receives the parsed ARP request message, modifies the sender IP from "outgoing router downstream port IP" to "NG firewall VLANIF interface IP address", and modifies the sender MAC from "outgoing router downstream port MAC" to "NG firewall VLANIF interface MAC address", leaving other information unchanged; Message forwarding: The modified ARP request message is forwarded by the NG firewall to the PC, and the PC returns an ARP response message.

[0048] (2) PC ARP response message processing flow Packet interception and parsing: If the egress router does not receive a simulated response from the firewall (e.g., the simulated response times out), it will send a broadcast ARP request again. At this time, the PC will receive the request and send an ARP response packet (destination IP = egress router downlink port IP, destination MAC = egress router downlink port MAC, source IP = PC's IP, source MAC = PC's MAC). After the packet arrives at the NG firewall, the ARP packet interception module captures and parses it. Message Modification: The ARP message modification module changes the source IP of the ARP response message from "PC's IP" to "NG Firewall VLANIF Interface IP", and the source MAC from "PC's MAC" to "NG Firewall VLANIF Interface MAC". The destination IP and destination MAC remain unchanged (still the IP and MAC of the outgoing router).

[0049] Data forwarding process: (1) Return message forwarding and session maintenance process The return packets from the external network are transmitted to the egress router via the operator. The router queries the ARP table and finds that the MAC address corresponding to the network segment where the PC is located is the MAC address of the NG firewall VLANIF interface. Therefore, the destination MAC address of the return packet is encapsulated as "NG firewall VLANIF interface MAC", the source MAC address is the MAC address of the egress router interface, and the destination IP address is the IP address of the PC. When the return packet arrives at the NG firewall, the firewall identifies the destination MAC as its own interface MAC and directly matches the previously created Layer 3 session. Without triggering the slow forwarding process, the firewall forwards the packet to the PC based on the routing information in the session.

[0050] (2) Subsequent PC message forwarding process The PC sends a new positive message (such as accessing an external website), with the destination MAC address being the VLANIF interface MAC of the NG firewall (because the gateway points to this interface). After the message arrives at the firewall, it is matched with a Layer 3 session. The firewall modifies the destination MAC address of the packet to the MAC address of the downstream interface of the egress router and modifies the source MAC address to the MAC address of its own corresponding interface based on the routing information of the Layer 3 session, and then forwards it to the egress router. After receiving the data packet, the outgoing router found that the destination MAC address of the packet was its own interface MAC address, and forwarded it to the operator's network normally, and the service communication returned to normal.

[0051] Working principle: This embodiment automatically intercepts and modifies ARP packets through an ARP hijacking module, eliminating the need for manual configuration of network segment locking rules on the NG firewall. Regardless of the number of PC network segments or whether new segments are added, the firewall can process ARP requests / responses in real time and automatically guide the egress router to establish ARP mappings with the firewall. For example, when an enterprise adds 10 PC network segments, existing technologies require adding 10 locking rules, while this embodiment requires no operation, significantly reducing configuration and maintenance costs.

[0052] In this embodiment, in scenarios where DHCP dynamically allocates network segments or network segment ranges change, the PC's IP address or network segment may change dynamically. Existing static locking rules would become ineffective. However, in this embodiment, every time the egress router sends an ARP request, the firewall modifies the packet based on the PC's current IP address, ensuring that the ARP mapping always matches the PC's actual network segment. Even if the PC's network segment changes from 192.168.1.0 / 24 to 192.168.2.0 / 24, the firewall can automatically adapt without manual adjustment, demonstrating significantly better compatibility than existing technologies.

[0053] Existing technologies rely on "the first positive packet triggering the rule," which results in a delay in the effectiveness of session reconstruction. In contrast, this embodiment uses ARP hijacking to guide the egress router to establish the correct ARP mapping in advance. When the return packet arrives at the firewall, the destination MAC address is already the firewall itself, eliminating the need to trigger the slow transfer process and directly matching the Layer 3 session. Furthermore, the session protection linkage module will prevent session type refresh in real time. Even if the firewall restarts or the session times out, the newly created session will still maintain the Layer 3 type due to the correct ARP mapping, without any delay in effectiveness, thus fully guaranteeing business continuity.

[0054] This embodiment only modifies ARP packets for "PC-to-external network communication" and does not interfere with ARP communication between other devices in the same VLAN (such as between PCs or between PCs and internal servers), thus avoiding impact on internal services. At the same time, ARP hijacking is only used to force data frames to be forwarded through the firewall's Layer 3, without tampering with core communication information such as IP addresses and ports, or forging false ARP mappings. There is no risk of data leakage or network deception, and its security is higher than that of existing technologies.

[0055] The other parts of this embodiment are the same as those in Embodiment 1 above, so they will not be described again.

[0056] Example 3: This embodiment is based on any one of the above embodiments 1-2, and is described in detail with a specific embodiment.

[0057] Taking an enterprise office network scenario as an example, assume the network parameters are as follows: PC: IP=192.168.1.10, MAC=00:11:22:33:44:55 NG Firewall: Uplink and downlink interfaces are in switched mode (VLAN=10), VLANIF interface IP=192.168.1.1 (PC gateway), MAC=AA:BB:CC:DD:EE:FF Outgoing router: Downlink IP=192.168.1.2, MAC=11:22:33:44:55:66 (1) ARP hijacking process 1. After the return packet arrives at the egress router, the router sends an ARP request: target IP=192.168.1.10 (PC), destination MAC=FF:FF:FF:FF:FF:FF, sender IP=192.168.1.2, sender MAC=11:22:33:44:55:66; 2. The NG firewall intercepts the request, then checks if it has an ARP entry for PC 192.168.1.10. If not, it modifies the ARP request packet: sender IP=192.168.1.1 (VLANIF interface), sender MAC=AA:BB:CC:DD:EE:FF, target IP / target MAC remain unchanged, and floods the packet within the VLAN domain; 3. After receiving the ARP request, the PC responds normally. Upon receiving the PC's ARP reply packet, the firewall learns the PC's ARP entry: 192.168.1.10 corresponds to 00:11:22:33:44:55. 4. After the router's first request fails, it sends an ARP request again. When the second request reaches the firewall, it checks its own ARP table again and finds an ARP entry for the PC. At this time, the firewall simulates the PC's response and sends an ARP response: targetIP=192.168.1.10, target MAC=AA:BB:CC:DD:EE:FF, sender IP=192.168.1.2, sender MAC=11:22:33:44:55:66; 5. The outgoing router receives the response and records the ARP mapping: 192.168.1.10→AA:BB:CC:DD:EE:FF.

[0058] (2) Data forwarding and session protection process Return message (external network → PC): target IP=192.168.1.10, destination MAC=AA:BB:CC:DD:EE:FF, source IP=203.0.113.1 (external website), source MAC=11:22:33:44:55:66; After receiving the message, the NG firewall matches it with a Layer 3 session (source IP=203.0.113.1, target IP=192.168.1.10), and forwards it to the PC based on the route, maintaining the Layer 3 session type. PC sends a new message (accessing 203.0.113.1): target IP=203.0.113.1, destination MAC=AA:BB:CC:DD:EE:FF, source IP=192.168.1.10; The NG firewall matches Layer 3 sessions, modifies the destination MAC address to 11:22:33:44:55:66, and forwards it to the outgoing router. After receiving the data, the outgoing router identifies the destination MAC address as itself and forwards it to the operator normally, ensuring uninterrupted service.

[0059] In this embodiment, under the Layer 2 access scenario of NG firewall, the ARP packet interception module captures the ARP request packet sent by the egress router, modifies its target IP to the firewall VLANIF interface IP and destination MAC to the VLANIF interface MAC, and guides the firewall to simulate a PC to return an ARP response. For ARP response packets sent by the PC, the source IP is adjusted to the VLANIF interface IP and the source MAC is adjusted to the VLANIF interface MAC through the ARP packet modification module to ensure that the outgoing router records the ARP mapping between the PC network segment and the firewall; By linking the session protection module with the NG firewall session management module, the three-layer session attributes between the PC and the external network are monitored and maintained in real time, and the session type is prevented from being refreshed to the second layer due to return packets.

[0060] The other parts of this embodiment are the same as any one of the above embodiments 1-2, so they will not be described again.

[0061] Example 4: Based on any one of Embodiments 1-3 above, this embodiment proposes a session matching system for firewall Layer 2 access based on ARP hijacking, used to execute the session matching method for firewall Layer 2 access based on ARP hijacking as described above; including a data packet processing module, a data packet interception module, a data packet modification module, and a data packet forwarding module; The data packet processing module is used to capture ARP packets passing through the NG firewall in real time from the Layer 2 forwarding path of the NG firewall, parse the opcode, sender IP field, sender MAC field, target IP field, and target MAC field of the packet, and filter out ARP packets that are the same as the VLANIF network segment. The data packet interception module is used to receive parsed ARP packets; The data packet modification module is used to perform targeted modifications based on the parsed ARP packet type; if the ARP packet type is an ARP request packet and the local machine does not have an ARP table entry with a target IP field, the sender IP field and sender MAC field in the ARP request packet are modified; if the packet type is an ARP reply packet, it is directly intercepted. The data packet forwarding module is used to forward the modified ARP request packet to the PC gateway through the NG firewall and return the ARP response packet from the PC gateway. After the ARP response packet arrives at the NG firewall, the NG firewall recognizes the destination MAC as its own interface MAC and directly matches the created Layer 3 session without triggering the slow forwarding process. Based on the routing information in the Layer 3 session, the ARP response packet is forwarded to the PC gateway.

[0062] The core of this embodiment is deploying an "ARP hijacking module" on the NG firewall. This module intercepts and modifies ARP packets between the egress router and the PC, forcing the egress router to encapsulate the destination MAC address of the return packets with the firewall's VLANIF interface MAC address. This ensures that return packets always trigger the firewall's Layer 3 forwarding logic, preventing existing Layer 3 sessions from being refreshed to Layer 2 sessions. The overall architecture consists of two core sub-modules, and their functions and interaction relationships are as follows: Figure 2 As shown.

[0063] ARP packet interception module: Deployed on the Layer 2 forwarding path of the NG firewall, it captures all ARP packets passing through the firewall in real time (including ARP packets sent by the egress router and ARP packets sent by the PC), parses the opcode (request / response), sender IP, sender MAC, target IP, and target MAC fields of the packets, and filters out ARP request and response packets that are the same as those in the VLANIF network segment. ARP packet modification module: Receives packets parsed by the ARP packet interception module and performs targeted modifications based on the packet type: If the type is an ARP request packet and the local machine does not have an ARP entry for the target IP, it modifies the senderIP and senderMAC in the ARP packet and sends it; if the type is an ARP reply packet, it directly intercepts it.

[0064] The other parts of this embodiment are the same as any one of the embodiments 1-3 above, so they will not be described again.

[0065] The following two alternative solutions can achieve the goal of avoiding abnormal session type switching and ensuring normal business operations: Session merging: Associating Layer 2 and Layer 3 sessions. When a packet finds a Layer 2 session, if it also finds a Layer 3 session associated with the Layer 2 session, then the packet should be forwarded to Layer 3.

[0066] ARP Proxy + Port Isolation: Enable ARP proxy on the firewall and enable port isolation to force all ARP entries in the VLAN to be refreshed to the firewall.

[0067] Force slow forwarding: Add an identifier to the session. If a session that meets the criteria is detected, the session will be processed through slow forwarding and will not be processed through fast forwarding.

[0068] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications or equivalent changes made to the above embodiments based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A session matching method for Layer 2 access of a firewall based on ARP hijacking, characterized in that, First, deploy the ARP hijacking function on the NG firewall to intercept and modify the ARP packets between the egress router and the PC gateway, forcing the egress router to encapsulate the destination MAC of the return packets as the MAC of the NG firewall's VLANIF interface, ensuring that the return packets always trigger the firewall's Layer 3 forwarding logic, and preventing the original Layer 3 session from being refreshed into a Layer 2 session.

2. The session matching method for Layer 2 access of a firewall based on ARP hijacking according to claim 1, characterized in that, The session matching method for Layer 2 access of the firewall based on ARP hijacking specifically includes the following steps: Step S1: Capture ARP packets passing through the NG firewall in real time from the Layer 2 forwarding interface of the NG firewall, parse the opcode, sender IP field, sender MAC field, target IP field, and target MAC field of the packet, and filter out ARP packets that are the same as the VLANIF network segment; Step S2: Receive the parsed ARP packet and perform targeted modifications based on the parsed ARP packet type; if the ARP packet type is an ARP request packet and there is no ARP table entry with a target IP field, intercept the ARP request packet and replace the send IP and send MAC fields with the IP and MAC fields of the NG firewall, while keeping the destination address unchanged; if the packet type is an ARP reply packet, directly intercept it; if there is an ARP table entry with a target IP field, construct an ARP reply packet, where the sender IP and send MAC fields of the reply packet are the IP and MAC fields of the VLANIF interface; Step S3: The modified ARP request packet is forwarded to the PC gateway through the NG firewall, and an ARP response packet is returned from the PC gateway. After the ARP response packet arrives at the NG firewall, the NG firewall recognizes the destination MAC as its own interface MAC and creates a neighbor table entry.

3. The session matching method for Layer 2 access of a firewall based on ARP hijacking according to claim 2, characterized in that, Step S2 specifically includes the following steps: Step S21: Receive the parsed ARP packet and determine the ARP packet type; Step S22: If the ARP packet type is an ARP request packet, determine whether the destination IP of the request is in the same network segment as the vbn interface. If so, perform ARP hijacking and determine whether there is an entry for the requested address. Otherwise, modify the ARP request packet and send it. Step S23: If the ARP packet type is an ARP response packet, determine whether the destination IP of the response is the same as the VLAN interface. If so, learn the ARP entry.

4. The session matching method for Layer 2 access of a firewall based on ARP hijacking according to claim 3, characterized in that, Step S22 specifically includes the following steps: Step S221: After the return packet arrives at the egress router, the router queries the routing table to determine that the network segment where the PC is located is a directly connected network segment, sends an ARP request packet, transmits it to the NG firewall through the Layer 2 network, captures the ARP request packet and parses the key fields; Step S222: Receive the parsed ARP request packet, change the sender IP field of the ARP request packet from "outgoing router downstream port IP" to "NG firewall VLANIF interface IP address", change the sender MAC field from "outgoing router downstream port MAC" to "NG firewall VLANIF interface MAC address", and leave everything else unchanged; Step S223: Forward the modified ARP request message to the PC gateway through the NG firewall, and return an ARP response message from the PC gateway.

5. The session matching method for Layer 2 access of a firewall based on ARP hijacking according to claim 4, characterized in that, Step S23 specifically includes the following steps: Step S231: If the egress router does not receive a simulated response from the firewall, it will send a broadcast ARP request again. At this time, the PC gateway will receive the request and send an ARP response packet. After the ARP response packet arrives at the NG firewall, it will be captured and parsed. Step S232: Change the source IP of the ARP response packet from "PC's IP" to "NG Firewall VLANIF Interface IP", change the source MAC from "PC's MAC" to "NG Firewall VLANIF Interface MAC", and leave the destination IP and destination MAC unchanged.

6. The session matching method for Layer 2 access of a firewall based on ARP hijacking according to claim 5, characterized in that, Step S3 specifically includes the following steps: Step S31: The return packet from the external network is transmitted to the egress router via the operator. The router queries the ARP table and finds that the MAC address corresponding to the network segment where the PC is located is the MAC address of the NG firewall VLANIF interface. Therefore, the destination MAC address of the return packet is encapsulated as "NG firewall VLANIF interface MAC", the source MAC address is the MAC address of the egress router interface, and the destination IP address is the IP address of the PC. Step S32: After the return packet arrives at the NG firewall, the NG firewall recognizes the destination MAC as its own interface MAC, directly follows the Layer 3 forwarding session, and forwards the packet to the PC based on the routing information in the session.

7. The session matching method for Layer 2 access of a firewall based on ARP hijacking according to claim 6, characterized in that, Step S3 further includes: Step S33: The PC gateway sends a new forward packet with the destination MAC address being the VLANIF interface MAC address of the NG firewall. After the packet arrives at the NG firewall, it is matched with a Layer 3 session. Step S34: Based on the routing information of the Layer 3 session, the NG firewall modifies the destination MAC of the packet to the MAC of the downstream interface of the egress router and modifies the source MAC to the MAC of its own corresponding interface, and forwards it to the egress router. Step S35: After receiving the data packet, the outgoing router detects that the destination MAC address of the data packet is its own interface MAC address, forwards it normally to the operator's network, and the service communication returns to normal.

8. A session matching system for Layer 2 access of a firewall based on ARP hijacking, used to execute the session matching method for Layer 2 access of a firewall based on ARP hijacking as described in claim 1; characterized in that, It includes a data packet processing module, a data packet interception module, a data packet modification module, and a data packet forwarding module; The data packet processing module is used to capture ARP packets passing through the NG firewall in real time from the Layer 2 forwarding interface of the NG firewall, parse the opcode, sender IP field, sender MAC field, target IP field, and target MAC field of the packet, and filter out ARP packets that are the same as the VLANIF network segment. The data packet interception module is used to receive parsed ARP packets; The data packet modification module is used to perform targeted modifications based on the parsed ARP packet type. If the ARP packet type is an ARP request packet and the local machine does not have an ARP entry with a target IP field, the ARP request packet is hijacked, and the send IP field and sender MAC field are replaced with the IP field and MAC field of the NG firewall, while the destination address remains unchanged. If the message type is an ARP reply message, it is directly intercepted; if an ARP entry with a target IP field exists, an ARP response message is constructed, in which the sender IP field and send MAC field of the response message are the IP field and MAC field of the VLANIF interface. The data packet forwarding module is used to forward the modified ARP request packet to the PC gateway through the NG firewall, and return the ARP response packet from the PC gateway. After the ARP response packet arrives at the NG firewall, the NG firewall identifies the destination MAC as its own interface MAC, creates a neighbor table entry, and forwards the ARP response packet to the PC gateway based on the routing information in the Layer 3 session.

Images