CN101299772B - System and method for processing network address conversion preferable regulation - Google Patents

Abstract

The present invention provides a system and method for converting and processing network address translation optimization rules. The system includes a NAT matching outgoing interface configuration module, which is used to configure NAT, that is, network address translation matching outgoing interface rules, and to NAT outgoing interface rules. The table module performs information synchronization and transmission; the NAT outbound interface rule table module is used to record the NAT outbound interface rule table and organize table items to provide information for the NAT matching outbound interface rule operation module as a comparison basis; NAT outbound interface rule operation The module is used to match the received data packets and search for NAT conversion entries. When matching and searching, the information in the NAT outbound interface rule table is used as a reference standard. If there is a matching NAT outbound interface rule, it is generated according to the data packet and rule information New NAT translation entry, and forward according to the new NAT translation entry. The invention simultaneously configures the NAT conversion rule matching the outgoing interface and the NAT conversion rule not matching the outgoing interface, thereby improving the utilization efficiency of the public network address.

Description

System and method for network address translation preference rule translation processing

technical field

The invention relates to the technical field of network communication, in particular to a system mechanism for network address translation (NAT) to perform translation processing according to optimal rules when communicating between a private network and a public network in a network.

Background technique

With the rapid development of the Internet, the Internet has gradually become a part of people's daily life. The continuous development of network technology and the continuous increase of people's demand for the network have resulted in the continuous expansion of the network scale and the increasingly tight network IP address resources. And NAT (Network Address Translation) technology solves this problem very well. Its main method is to convert illegal private network addresses into legal public network IP addresses, and establish a distinction between public and private networks, so that network resources are fully utilized. When users access the public network from the private network, they can apply for the public network address and port number to connect, and then communicate in the Internet. This method greatly improves the utilization rate of public network IP address resources, and thus is widely used.

In network use, depending on the environment, the network administrator sometimes configures NAT translation rules on the router to perform network address translation on different outgoing interfaces corresponding to a data source, and the translated public network address pools are different. Therefore, if another address pool with the same data source that does not specify an outgoing interface is configured on the router at this time, at this time, when a data packet arrives, the search for the NAT translation rules of different outgoing interfaces and the NAT translation entry Generates a situation where the match is not the best match. Although it will not affect the use, it will happen that there is a public network address allocated for the outgoing interface, but it is not used, and the resources in the NAT public network address pool that are not specially configured for the outgoing interface will be occupied, and the NAT for the specified outgoing interface will be used. Due to the configuration of the specified outgoing interface, the conversion rule cannot be used when the data packet needs to be forwarded from another outgoing interface for NAT conversion. When the network usage peaks, some public network address pools may be exhausted, and users still cannot obtain them. Public network addresses are converted by NAT. On the other hand, some address pools still have many public network addresses that are not used. As a result, public network address resources are not allocated and used reasonably and effectively as expected.

Contents of the invention

The purpose of the present invention is to provide a system and method for network address translation optimization rule conversion, to solve the problem that the public network address cannot be effectively used in the prior art, and to realize the public network address when communicating between the private network and the public network. It can be used completely according to the configuration of the network administrator.

The present invention adopts following technical scheme:

The present invention provides a system for converting and processing network address translation optimization rules, including:

NAT matching outbound interface configuration module: used to configure NAT, that is, network address translation matching outbound interface rules, and to synchronize and transmit information to the NAT outbound interface rule table module; when configuring NAT conversion rules, if it is NAT with an outbound interface rule configuration, then the NAT matching outgoing interface configuration module will extract the outgoing interface and the ACL number of the source port of the data packet, and store it in the NAT outgoing interface rule table;

NAT outbound interface rule table module: used to record the NAT outbound interface rule table, organize table items, and provide information for the NAT matching outbound interface rule operation module as a comparison basis;

NAT matching outgoing interface rule operation module: used to match the received data packets to search for NAT conversion entries. When searching, the information in the NAT outgoing interface rule table is used as a reference standard for matching and comparison. If there is a matching NAT outgoing interface rule , generate a new NAT translation entry according to the data packet and rule information, and forward it according to the new NAT translation entry.

The present invention also provides a method for utilizing the above-mentioned system to perform network address translation optimization rule conversion processing, and performs NAT matching outbound interface rule configuration in advance, and the method includes:

Step A. extract information from the data packet, including IP address, port number, outgoing interface information, and find out the ACL number information of the data packet;

Step B. According to the data packet information, including the outgoing interface information, match the NAT conversion entry, if there is a NAT conversion entry, forward according to the entry; if there is no NAT conversion entry, proceed to step C;

Step C. According to the data packet information, excluding the outgoing interface information, match the NAT translation entry, if there is a NAT translation entry, proceed to step D; if there is no NAT translation entry, find the NAT translation rule to generate a new entry, and forward the NAT entry according to this new entry data pack;

Step D. According to the ACL number information and the outgoing interface information of the data packet, search the NAT outgoing interface rule table, if a matching entry is found, generate a new entry according to the rule to which it belongs, and forward the data packet according to this new entry, otherwise, follow the steps C forwards the found NAT translation entries.

Further, the NAT matching outbound interface rule configuration of the method specifically includes:

Step a. configure the NAT translation rule with the outgoing interface;

Step b. Obtain the outgoing interface information and ACL number information in the NAT translation rule;

Step c. Open up a new memory space to establish a NAT outbound interface rule table, and store outbound interface information

And the ACL number information is written into the NAT outbound interface rule table for preservation.

Compared with the prior art, the present invention simultaneously configures the NAT conversion rule matching the outgoing interface and the NAT conversion rule not matching the outgoing interface, realizes the clear separation of the address pool, avoids the chaotic use of the address pool during NAT conversion, thereby improving the Utilization efficiency of public network addresses.

Description of drawings

Fig. 1 is a schematic structural diagram of the system described in the embodiment of the present invention;

Fig. 2 is the configuration flowchart of the NAT matching outbound interface rule of the method described in the embodiment of the present invention;

Fig. 3 is the processing flowchart of the method described in the embodiment of the present invention;

Detailed ways

Preferred embodiments of the present invention will be specifically described below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of the application and together with the embodiments of the present invention explain the principle of the present invention.

As shown in Figure 1, Figure 1 is a schematic structural diagram of the system described in the embodiment of the present invention, specifically including the following modules:

NAT matching outgoing interface configuration module: It is mainly a module for configuration. Through network administrator configuration, this module collects configuration information, organizes and stores it, provides basis for data packet processing, and can clearly reflect configuration intentions. When configuring the NAT conversion rule, if it is a NAT rule configuration with an outbound interface, the module will extract the ACL number of the outbound interface and the source port of the data packet, and store it in the NAT outbound interface rule table.

The NAT outgoing interface rule table module is mainly used to record the conversion rules of the corresponding ACL number corresponding to the outgoing interface, and the data is collected by the NAT matching outgoing interface configuration module. The table is mainly to open up a storage space in the memory, and carry out algorithmic organization, so as to realize the operations such as searching, adding, and deleting entries in the table.

NAT matching outbound interface rule operation module: it is the main operation module, which is responsible for extracting information from received data packets, matching and searching NAT conversion entries according to the information, using the information in the NAT outbound interface rule table as a reference standard when searching, Perform matching comparison, if there is a matching NAT outbound interface rule, generate a new NAT translation entry according to the data packet and rule information, and forward it according to the new NAT translation entry.

As shown in Figure 2, Figure 2 is a NAT matching outbound interface rule configuration flowchart of the method described in the embodiment of the present invention, and the specific process is as follows:

Step 200: configure the NAT translation rule of the outbound interface;

Step 201: Obtain the outbound interface information and ACL number information in the NAT translation rule;

Step 202: open up a new memory space to establish a NAT outbound interface rule table, and write outbound interface information and ACL number information into the NAT outbound interface rule table for storage.

As shown in Figure 3, Figure 3 is a processing flowchart of the method described in the embodiment of the present invention, and the specific process is as follows:

Step 300: the process starts;

Step 301: the system receives the data packet;

Step 302: Extract the information in the data packet, including IP address, port number, VPN, and outgoing interface information, obtain the ACL number information of the data packet, and carry out according to the data packet information, including IP address, port number, VPN, and outgoing interface information NAT translation entry matching lookup;

Step 303: judging whether the corresponding NAT translation entry is found, if found, execute step 304, otherwise execute step 305;

Step 304: Forward according to the found NAT translation entry, and the process ends.

Step 305: Reuse the data packet information including IP address, port number, and VPN information to perform NAT translation entry matching, but does not include outgoing interface information.

Step 306: judging whether the corresponding NAT translation entry is found, if not found, proceed to step 307, if found, proceed to step 308;

Step 307: Find the NAT conversion rule to generate a new entry, and perform NAT forwarding according to the new entry, and the process ends.

Step 308: Obtain the ACL number information and outgoing interface information of the data packet, and search the NAT outgoing interface rule table;

Step 309: Find whether there is a matching NAT translation entry in the NAT outbound interface rule table, if not, proceed to step 310, otherwise proceed to step 311;

Step 310: Perform NAT forwarding according to the NAT translation entry found in step 305, and the process ends.

Step 311: According to the found NAT outbound interface rule information, search for the corresponding NAT conversion rule, generate a new NAT conversion entry, and perform NAT forwarding;

Step 312: the process ends;

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention.

Claims (3)

1. A system for network address translation optimization rule conversion processing, characterized in that, comprising: NAT matching outbound interface configuration module: used to configure NAT, that is, network address translation matching outbound interface rules, and to synchronize and transmit information to the NAT outbound interface rule table module; when configuring NAT conversion rules, if it is NAT with an outbound interface Rule configuration, then the NAT matching outgoing interface configuration module will extract the ACL number of the outgoing interface and the source port of the data packet, and store it in the NAT outgoing interface rule table; NAT outbound interface rule table module: used to record the NAT outbound interface rule table, organize table items, and provide information for the NAT matching outbound interface rule operation module as a comparison basis; NAT matching outgoing interface rule operation module: used to match the received data packets to search for NAT conversion entries. When searching, the information in the NAT outgoing interface rule table is used as a reference standard for matching and comparison. If there is a matching NAT outgoing interface rule , generate a new NAT translation entry according to the data packet and rule information, and forward it according to the new NAT translation entry. 2. A method utilizing the above-mentioned system to carry out NAT preferred rule conversion processing, characterized in that, carrying out NAT matching outgoing interface rule configuration in advance, said method comprising: Step A. extract information from the data packet, including IP address, port number, outgoing interface information, and find out the ACL number information of the data packet; Step B. According to the data packet information, including the outgoing interface information, match the NAT conversion entry, if there is a NAT conversion entry, forward according to the entry; if there is no NAT conversion entry, proceed to step C; Step C. According to the data packet information, excluding the outgoing interface information, match the NAT translation entry, if there is a NAT translation entry, proceed to step D; if there is no NAT translation entry, find the NAT translation rule to generate a new entry, and forward the NAT entry according to this new entry data pack; Step D. According to the ACL number information and the outgoing interface information of the data packet, search the NAT outgoing interface rule table, if a matching entry is found, generate a new entry according to the rule to which it belongs, and forward the data packet according to this new entry, otherwise, follow the steps C forwards the found NAT translation entries. 3. The method according to claim 2, wherein the configuration of the NAT matching outgoing interface rule specifically includes: Step a. configure the NAT translation rule with the outgoing interface; Step b. Obtain the outgoing interface information and ACL number information in the NAT translation rule; Step c. Open up a new memory space to establish a NAT outbound interface rule table, and write outbound interface information and ACL number information into the NAT outbound interface rule table for preservation.

Images