CN101515882B - Method, device and system for communication between local area network and public network - Google Patents

Abstract

The present invention is applicable to the field of network communication, and provides a method and equipment for communication between a local area network and a public network. The method includes the following steps: assigning multiple IP addresses to terminals in the local area network, and the multiple IP addresses include at least A public IP address; when receiving a message with the public IP address as the source address from the LAN side, send the message to the public network, and record the policy routing information of the message; When a message arrives, determine the policy routing information of the message according to the network information of the message, and send the message to a corresponding terminal in the local area network. The embodiment of the present invention can realize the address translation of the message flow without the cooperation of the ALG, maintain most of the existing NAT/ALG networking modes, and have little change in the user's usage habits.

Description

Method, device and system for communication between local area network and public network

technical field

The invention belongs to the field of network communication, and in particular relates to a method, device and system for communication between a local area network and a public network. the

Background technique

Network Address Translation (Network Address Translation, NAT) is an Internet Engineering Task Force (Internet Engineering Task Force, IETF) standard that allows an entire organization to appear on the Internet with a public IP (Internet Protocol) address. A technology that translates IP addresses into public IP addresses. The NAT function is usually integrated into routers, firewalls, Integrated Service Digital Network (Integrated Service Digital Network, ISDN) routers or separate NAT devices. As shown in Figure 1, the terminal uses the IP address in the LAN in the LAN. When it needs to communicate with the public network, the IP address in the LAN of the terminal is translated into a public IP address at the gateway, so that it can work normally on the public network (Internet). use. the

In order to effectively solve the problem of NAT conversion of packet flow, the cooperation of Application Layer Gateway (ApplicationLayer Gateway, ALG) is needed. ALG is a network technology that solves the problem of application interoperability under NAT networking conditions. Generally, it is integrated with the NAT function in the same device to help NAT complete the modification of the relevant address and port information in the application layer message. However, when using NAT/ALG networking, it is difficult to deal with the case that the message content contains useful address information, and it cannot handle the case of IP header encryption. At the same time, because the internal host address is hidden, network debugging will become complicated. In addition, It also affects the efficiency of message forwarding, especially for new applications, the ALG needs to be constantly updated to support new application networking. the

Contents of the invention

The purpose of the embodiments of the present invention is to provide a method for communication between a local area network and a public network, aiming at solving the problem that the cooperation of ALG is required in the prior art to effectively solve the problem of network address translation of message flow. the

The embodiment of the present invention is realized like this, a kind of method for local area network and public network communication, described method comprises the following steps:

Assign multiple IP addresses to terminals in the local area network, including at least one public IP address in the multiple IP addresses;

When a message with the public IP address as the source address is received from the LAN side, the message is sent to the public network, and the policy routing information of the message is recorded;

When a message is received from the public network side, the policy routing information of the message is determined according to the network information of the message, and the message is sent to a corresponding terminal in the local area network. the

Wherein, when the network information of the message received from the public network side does not match the network information of the recorded message at all, the policy routing information of the message is determined according to the network information of the message, and the The specific steps for sending the above message to the corresponding terminal in the LAN are as follows:

Forward the first message from the public network side to all ports on the LAN side that are allowed to receive public network access, and record the network information of the first message;

When the response message of the first message is transmitted to the public network through the gateway, record the port that responds to the first message;

After receiving the subsequent message sent from the public network to the local area network, the message is sent to the corresponding terminal in the local area network according to the match between the network information of the message and the recorded network information. the

In the embodiment of the present invention, by assigning multiple IP addresses including one public IP address to the terminal, a dynamic policy routing mechanism based on business flow identification is used to determine the forwarding rules of the message, and the message can be realized without the cooperation of the ALG. Stream address translation. the

Description of drawings

Fig. 1 is the schematic diagram of the working principle of NAT provided by the prior art;

Fig. 2 is the structural diagram of the applicable network communication system of the embodiment of the present invention;

Fig. 3 is the realization schematic diagram that terminal obtains double IP address in the PPPoE mode that the embodiment of the present invention provides;

Fig. 4 is the protocol processing schematic diagram that the message in the local area network provided by the embodiment of the present invention is delivered to the public network;

Fig. 5 is the protocol processing diagram that the message in the public network provided by the embodiment of the present invention is delivered to the local area network;

Fig. 6 is a structural diagram of a network terminal provided by an embodiment of the present invention;

Fig. 7 is a structural diagram of the IP address binding unit in the terminal provided by the first embodiment of the present invention;

Fig. 8 is a structural diagram of the IP address binding unit in the terminal provided by the second embodiment of the present invention;

Fig. 9 is a structural diagram of a gateway device provided by an embodiment of the present invention. the

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention. the

In the embodiment of the present invention, multiple IP addresses are assigned to the terminal, one of which is a public IP address, and the gateway dynamically determines the message forwarding rules in the routing and forwarding process based on the dynamic policy routing mechanism of service flow identification. In this case, the address translation of the packet flow can be realized. the

Fig. 2 has shown the structure of the applicable network communication system of the embodiment of the present invention, and this system comprises at least one terminal and gateway, and terminal and gateway form a local area network, and each terminal is allocated with a plurality of IP addresses, and one of them is gateway in wide area network ( Wide Area Network, WAN) interface side public IP address, can also include a LAN IP address. The IP address in the LAN is used for intercommunication between terminals in the LAN, and the public IP address is used for terminals to access the public network. In specific implementation, the terminal obtains an IP address in the LAN from the gateway, such as 10.1.1.1, and at the same time, the gateway assigns the public IP address obtained from the WAN port side, such as 195.1.1.1, to the terminal. the

In the embodiment of the present invention, the way for the terminal to obtain multiple IP addresses from the gateway can be based on Dynamic Host Configuration Protocol (Dynamic Host Configuration Protocol, DHCP), point-to-point protocol on Ethernet (Point to Point Protocol over Ethernet, PPPoE) or other address assignment protocols. Different address allocation protocols produce different interface modes on the terminal side. the

Take obtaining two IP addresses as an example. In the DHCP mode, the terminal binds two IP addresses on one network interface, one of which is a public IP address. In PPPoE mode, the terminal generates two network interfaces, one is PPPoE interface, bound with public IP address, and the other is Ethernet (ETH) interface, bound with IP address in LAN. The interface bound to the public IP address is generally set as the default route of the terminal. the

For ordinary computer users, because not all desktop operating systems support multi-IP address binding, and PPPoE dial-up terminals have been widely used, and users are relatively easy to accept, so you can choose to use PPPoE to generate a new network interface on the terminal , used to bind the public IP address. The DHCP method can be used for embedded terminals similar to the Integrated Access Device (IAD) type, and can realize the same application mode as the PPPoE method, which will not be repeated here. the

Taking the PPPoE method as an example, as shown in Figure 3, after any terminal in the LAN starts up, it obtains an IP address in the LAN from the gateway through DHCP. After the terminal obtains the IP address in the LAN, the user initiates the PPPoE authentication process from the terminal, the gateway terminates the PPPoE connection (PPPoE session) initiated by the terminal, and assigns the obtained public IP address to the terminal, and at the same time issues the default gateway and Domain Name System (Domain Name System, DNS) server and other related network information to establish a PPP channel. The terminal generates two network interfaces, one is the Ethernet (ETH) interface, which is bound to the acquired IP address in the LAN; the other is the PPPoE interface, which is bound to the public IP address assigned by the gateway. the

As an embodiment of the present invention, the gateway can decide whether to forward the connectionless external message to the terminal through the PPPoE account or password information used by the terminal dial-up, for example, account A allows external direct access, and account B does not allow external direct access. After terminal 1 establishes a PPPoE channel using account A, the gateway forwards all packets forwarded to the public IP address of the LAN to terminal 1. After terminal 2 uses account B to establish a PPPoE channel, when terminal 2 actively initiates a request, the gateway only forwards the response message of the request message to terminal 2. the

In the LAN, since each terminal uses the same IP address, in order to enable the terminal to send and receive messages with the public network, the gateway needs to calibrate the terminal. As an embodiment of the present invention, messages from different terminals can be marked by Media Access Control (MAC) addresses. In PPPoE mode, you can also use the connection identifier (SESSION ID) to calibrate different terminals. At this time, the IP protocol stack inside the gateway needs to support policy routing based on MAC/SESSION ID, and add terminal labeling information such as the terminal's MAC address or PPP SESSION ID to the policy routing information. the

In the embodiment of the present invention, the terminal can also upload information such as service and device type to the gateway through PPPoE extension, DHCP option (DHCP option), etc. After the gateway records these attribute information of the terminal, it can more accurately allocate and forward message flow records , so as to better define packet (flow) forwarding rules. the

In the embodiment of the present invention, when the gateway receives the message with the above-mentioned public IP address as the source address from the local area network side, the message is sent to the public network, and the policy routing information of the message is recorded at the same time; When receiving the message with the above public IP address as the destination address, determine the policy routing information of the message according to the network information of the message, and send the message to the corresponding terminal in the local area network. the

As an embodiment of the present invention, the policy routing information of the message includes the network information of the message and the identification information of the terminal corresponding to the message. The network information of the message is mainly IP quintuple information such as the source IP address, destination IP address, protocol type, source port, and destination port of the message. The terminal's calibration information can be the terminal's MAC address or PPP SESSION ID. the

Figure 4 shows the protocol processing of packets from the LAN to the public network. Since the output port of the gateway has only one WAN PPPoE, there will be no problem for the terminal to send packets to the public network. In order to ensure the normal forwarding of the return message from the public network to the terminal, the gateway needs to record the source IP address, destination IP address, protocol type, source port, IP quintuple information such as the destination port, as well as the source MAC address or SESSION ID information and terminal type information of the message (flow), so as to establish the policy routing information of the returned message, and provide an aging mechanism based on the bidirectional message. For example, if the gateway does not receive a return message from the public network for a long period of time, the gateway will delete the MAC address corresponding to the terminal that sent the message to the public network, and record it again when the next message is sent . the

If the source MAC address or SESSION ID of the message (flow) is different from that recorded by the gateway, and the IP quintuple information of the message (flow) is exactly the same as that recorded by the gateway, that is, two terminals in the LAN use the same source port and access the same public network server, the gateway performs Port Address Translation (PAT) processing on the message, maps the source port of the message to other unused ports, and performs corresponding ALG processing. The gateway may also directly forward the message without processing this type of conflict. In the return direction of the message, the corresponding return message is broadcast on all PPP ports with outgoing records, and the application layer of the terminal judges whether to receive the return message. the

The protocol processing of the public network message to the local area network is shown in Figure 5. The gateway has multiple PPP interfaces in the direction of the local area network, and the gateway needs to determine which PPP port to forward the message (flow). the

If the terminal has sent a message to the public network, the gateway records the IP quintuple information, source MAC address or SESSION ID of the message. According to the exact match rule, the gateway can find the correct The LAN side returns the PPP port. This situation can satisfy all network applications based on the client/server (C/S) network service model. the

If the IP quintuple information of the packet from the public network partly matches the IP quintuple information recorded by the gateway, for example, the destination IP address, source IP address, and protocol type can match, but the port number cannot match, the gateway sends all The PPP port return that can complete partial matching can be applied to the situation where the server in the public network modifies the working port number in the message under the C/S model. the

If the IP quintuple information of the packet from the public network side does not match the IP quintuple information recorded by the gateway, there may be two application scenarios where this situation occurs. One is that there are servers in the LAN that provide external services, and the other is that It is a type of voice service, such as a Real Time Transport Protocol (RTP) stream followed by a SIP stream. At this time, the gateway can dynamically learn and record the policy routing information of the message by broadcasting the message. the

As an embodiment of the present invention, when there is a server in the local area network to provide external services, the gateway can perform a broadcast forwarding strategy on the first message from the public network side, and forward it to all PPP ports that are allowed to receive external access on the LAN side. And record the IP quintuple information of the first message. After the server inside the LAN responds to the first message, when the response message is transmitted to the public network through the gateway, the gateway records which port responded to the first message, and adds the port information to the first message In the IP quintuple information, to ensure that subsequent messages from the public network to the LAN do not need to be broadcast. After receiving the follow-up message sent from the public network to the LAN, the LAN gateway compares the network information of the follow-up message with the recorded network information, and sends the message to the corresponding terminal in the LAN according to the matching between the network information. In actual operation, it can also be solved by using the gateway to obtain the information of the server on the LAN side. For example, the server on the LAN side reports the service type (open port information) through DHCP option (DHCP option) and PPPoE extension, or manual configuration, or remote automatic configuration Deliver, bind the relationship between the LAN side server and the PPP port. the

As another embodiment of the present invention, in the voice-like service, two SIP user agents (User Agent, UA) adopt the strategy of inconsistent RTP sending and receiving ports, and the network information of the message from the local area network to the public network and from the public network to the local area network The complete match cannot be described as an example. Other situations are simpler and easier to handle than this one. For the first message from the public network side, the gateway can implement a broadcast forwarding strategy to forward it to all PPP ports that are allowed to accept external access on the LAN side, and the gateway records the IP quintuple information of the first message. the

After the SIP UA on the LAN side sends the first RTP packet to the SIP UA on the public network, the gateway can establish a partial matching rule, that is, the source IP address, destination IP address, and protocol type match, and the port number does not match. The message to the local area network can be processed according to the situation that the above-mentioned IP quintuple information partly matches. Of course, if the sending and receiving ports are the same, the rule of complete matching of IP quintuple information can be used for processing. the

Fig. 6 shows the structure of the gateway provided by the embodiment of the present invention, and for the convenience of description, only the parts related to the embodiment of the present invention are shown. the

The public IP address allocation unit 61 allocates the public IP address to the terminal, and the message transmission unit 62 sends the message to the public network when receiving the message with the public IP address as the source address, and records the policy routing information of the message . When a message with the public IP address as the destination address is received, the policy routing information of the message is determined according to the network information of the message, and the message is sent to the corresponding terminal in the local area network. the

As an embodiment of the present invention, the network information recording module 621 records the network information of the message. The network information of the message can be the IP quintuple information of the message. When the message is a message sent by the terminal to the public network, The network information of the message recorded by the network information recording module 621 may also include a MAC address or a SESSION ID of the message, so as to identify the terminal. the

The routing rule determining module 622 determines the policy routing information for message forwarding according to the network information of the message. The specific way of determining the policy routing information is as described above and will not be repeated here. the

The message forwarding module 623 forwards the message with the public IP address as the source address to the public network, or according to the policy routing information determined by the routing rule determination module 622, forwards the message with the public IP address as the destination address to the corresponding terminal. the

Fig. 7 shows the structure of the network terminal provided by the embodiment of the present invention, and for the convenience of description, only the parts related to the embodiment of the present invention are shown. the

The IP address binding unit 71 allocates multiple IP addresses on the terminal, and the multiple IP addresses include at least one public IP address for the terminal to access the public network, and may also include an IP address in a local area network. The network communication unit 72 communicates with the public network through the public IP address of the terminal, and sends the message to the public network through the gateway with the public IP address as the source address, or receives the message forwarded by the gateway with the public IP address as the destination address . the

In the embodiment of the present invention, the manner in which the terminal acquires multiple IP addresses from the gateway may be based on DHCP, PPPoE or other address allocation protocols. Obviously, which method the terminal uses to obtain multiple IP addresses depends on the configuration of the terminal. For example, when the terminal supports PPPoE, the PPPoE method can be used; when the terminal supports DHCP, the DHCP method can be used. the

When the terminal adopts the PPPoE mode, as shown in FIG. 8 , the PPPoE interface generation module 711 generates a PPPoE interface on the terminal, and the public IP address binding module 712 binds the public IP address allocated by the gateway on the PPPoE interface. the

When the DHCP method is adopted, as shown in FIG. 9 , the DHCP address binding module 713 binds multiple IP addresses including the public IP address allocated by the gateway on a network interface of the terminal through the DHCP method. the

Because the PPPoE dial-up terminal has been widely used, the user is also relatively easy to accept, so as a preferred embodiment of the present invention, the network communication unit 72 is a PPPoE client or a DHCP client. the

In the embodiment of the present invention, by assigning multiple IP addresses including one public IP address to the terminal, a dynamic policy routing mechanism based on business flow identification is used to determine the forwarding rules of the message, and the message can be realized without the cooperation of the ALG. The address translation of the flow can maintain most of the existing NAT/ALG networking modes unchanged, and the user's usage habits have not changed much. The gateway does not need to support ALG processing of various network applications, so that the terminal can share the public network connection. It reduces network faults caused by new applications, reduces the workload of the gateway ALG to support NAT traversal of a large number of application protocols, and improves message forwarding efficiency. the

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. within range. the

Claims (1)

1. A method for local area network and public network communication, is characterized in that, described method comprises the steps: Assigning multiple IP addresses to terminals in the local area network, where the multiple IP addresses include at least one public IP address; When receiving a message with the public IP address as the source address from the local area network side, sending the message to the public network, and recording the policy routing information of the message; When receiving a message from the public network side, determine the policy routing information of the message according to the network information of the message, and send the message to a corresponding terminal in the local area network; Wherein, when the network information of the message received from the public network side does not match the network information of the recorded message at all, the policy routing information of the message is determined according to the network information of the message, and the The specific steps for sending the above message to the corresponding terminal in the LAN are as follows: Forwarding the first message from the public network side to all ports on the LAN side that are allowed to receive public network access, and recording the network information of the first message; When the response message of the first message is transmitted to the public network through the gateway, record the port that responds to the first message; After receiving the subsequent message sent from the public network to the local area network, the message is sent to the corresponding terminal in the local area network according to the match between the network information of the message and the recorded network information.

Images