JP2013141071A - Relay server - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a configuration to improve security of a relay server that connects to a WAN by use of a radio communication terminal.SOLUTION: A LAN interface 34 utilizes a private IP address which a global IP address was address converted into when it connects to the Internet 14. A USB interface 35 utilizes the global IP address when it connects to the Internet 14. An address filter unit 37 filters a packet on the basis of a set permitted address. A filter address storage unit 41 stores the permitted address to be set for the filtering at the address filter unit 37. A filter setting unit 42 sets the permitted address stored in the filter address storage unit 41 to the address filter unit 37 when the USB interface 35 is used to connect to the Internet.

Description

  The present invention mainly relates to a configuration of a relay server that enables communication between terminals connected to different LANs.

  A VPN (Virtual Private Network) that connects LANs (Local Area Networks) at remote locations via a WAN (Wide Area Network) such as the Internet has been developed. Such a technique is disclosed in Patent Document 1, for example. The technology described in Patent Document 1 enables a client server belonging to a different LAN to communicate with each other by installing a relay server in each LAN and performing relay communication between the relay servers via the WAN. To do.

  The relay server accesses the WAN via a LAN gateway to which the relay server is connected. In this case, a private IP address in the LAN can be assigned to the relay server. Therefore, since the access to the relay server is performed with the private IP address, unnecessary connection from the outside of the LAN to the relay server can be prevented and security can be improved.

  On the other hand, in recent years, there is an increasing need to participate in VPN even in an environment where it is difficult to connect to a WAN by wire. In order to respond to such needs, a wireless communication terminal (so-called data communication card) for connecting to a mobile phone line (mobile communication network) may be provided in the relay server. Since the relay server provided with this wireless communication terminal can be connected to the WAN via the mobile phone line, it can participate in the VPN even in an environment where it is difficult to connect to the WAN by wire. For example, Patent Document 2 discloses a configuration in which VPN is performed using a mobile phone communication network by connecting a mobile phone to a PC.

JP 2009-157825 A JP 2008-219643 A

  When a relay server connects to a WAN using a mobile phone line, a global IP address is assigned to the relay server, so access to the relay server is performed using the global IP address. Accessing with a global IP address means that anyone who has access to the IP address can access it, so there is room for improvement from the viewpoint of security.

  The present invention has been made in view of the above circumstances, and an object thereof is to provide a configuration in which the security of a relay server connected to a WAN using a wireless communication terminal is improved.

Means and effects for solving the problems

  The problems to be solved by the present invention are as described above. Next, means for solving the problems and the effects thereof will be described.

  According to an aspect of the present invention, the following relay server is provided. That is, the relay server relays communication between the client terminal in the first LAN and the client terminal in the second LAN via the WAN between the second relay server connected to the second LAN. , Connected to the first LAN. The relay server includes a first communication unit, a second communication unit, an address filter unit, a filter address storage unit, and a filter setting unit. When the first communication unit is connected to the WAN, the first communication unit uses an address converted by the gateway of the first LAN as its own IP address. The second communication unit uses a global IP address as its own IP address when connecting to the WAN. The address filter unit performs packet filtering based on a set IP address. The filter address storage unit stores the IP address set for the filtering in the address filter unit. The filter setting unit sets an IP address stored in the filter address storage unit in the address filter unit when connecting to the WAN by the second communication unit.

  As described above, security can be enhanced by setting so as to perform packet filtering when connecting to a WAN using a global IP address.

  The relay server is preferably configured as follows. That is, when connecting to the WAN, the first communication unit connects to the WAN via the gateway of the first LAN. When the second communication unit is connected to the WAN, the second communication unit wirelessly connects to the mobile communication network, and connects to the WAN via the mobile communication network.

  That is, when connecting to a WAN via a LAN gateway, an IP address (private IP address) whose address has been converted can be assigned to the relay server. However, when connecting to a WAN via a mobile communication network, a global IP address is assigned to the relay server. For this reason, there is a security concern when using a mobile communication network. Therefore, as described above, security can be enhanced by setting to perform packet filtering when using the mobile communication network (when connecting to the WAN by the second communication unit).

  The relay server is preferably configured as follows. That is, when the second communication unit is connectable to the WAN, the relay server connects to the WAN by the second communication unit and prohibits connection to the WAN by the first communication unit. A part.

  That is, the fact that the second communication unit connected to the WAN via the mobile communication network is bothered to be effective is considered to be intended to connect to the WAN by the second communication unit. Therefore, when the second communication unit can connect to the WAN, priority is given to the connection by the second communication unit over the first communication unit.

  The relay server is preferably configured as follows. That is, when the filter setting unit is connected to the WAN by the first communication unit, the IP address stored in the filter address storage unit is not set in the address filter unit.

  In other words, when connecting to the WAN by the IP address (private IP address) whose address has been converted, the relay server cannot be freely accessed from the WAN side, so the address filter conditions can be relaxed. Therefore, when the first connection unit is connected to the WAN, the IP address is not set in the address filter unit, thereby preventing the convenience from being lost due to unnecessary access restrictions.

  The relay server can also be configured as follows. That is, the filter setting unit sets the IP address stored in the filter address storage unit in the address filter unit even when connecting to the WAN by the first communication unit.

  In this way, when connecting to the WAN with the IP address whose address has been converted, filtering similar to that when connecting to the WAN with the global IP address may be performed.

The schematic diagram of VPN constructed | assembled by the relay server which concerns on one Embodiment of this invention. The block diagram of a relay server. An example of a permission address stored in a filter address storage unit. An example of a screen for registering permitted addresses.

  Next, embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows a schematic configuration of a VPN (virtual private network) 10 constructed using a relay server according to the present embodiment. The VPN 10 is, for example, for connecting a first LAN 11 and a second LAN 12 installed at a remote place via the Internet (WAN) 14.

  The configurations of the first LAN 11 and the second LAN 12 are not particularly limited, but each LAN usually includes one or more client terminals. For example, in the case of FIG. 1, client terminals 17, 18, 19, and 20 are connected to the first LAN 11, and client terminals 21 and 22 are connected to the second LAN. Each LAN may have a configuration in which a plurality of relatively small LANs are connected. For example, in the case of FIG. 1, the first LAN 11 has a configuration in which LANs 23, 24, and 25 are connected by routers 26 and 27.

  As shown in FIG. 1, a first relay server 15 is connected to the first LAN 11, and a second relay server 16 is connected to the second LAN 12. The first relay server 15 and the second relay server 16 are each configured to be connectable to the Internet 14.

  The first LAN 11 in FIG. 1 is assumed to be a LAN constructed in an environment where it is difficult to connect to the Internet 14 by wire. In order to be able to connect to the VPN 10 even in such a LAN, the first relay server 15 of this embodiment includes a wireless communication terminal 29 that can be connected to a mobile phone line (mobile communication network) 30. Specifically, the wireless communication terminal 29 can perform wireless communication with an access point 31 of a mobile phone. The access point 31 is connected to the mobile phone line 30. The mobile phone line 30 is provided with a gateway 33 provided by a provider. Protocol conversion or the like is performed in the gateway 33 so that the mobile phone line 30 and the Internet 14 can communicate with each other.

  With the above configuration, the first relay server 15 can wirelessly connect to the Internet 14 via the mobile phone line 30. Accordingly, even the first LAN 11 that is difficult to connect to the Internet 14 by wire can participate in the VPN 10. In the provider gateway 33, a global IPv4 address is assigned to the first relay server 15. Accordingly, the first relay server 15 is connected to the Internet 14 by the global IPv4 address assigned to itself.

  The second LAN 12 in FIG. 1 is assumed to be a LAN that can be connected to the Internet 14 by wire. Therefore, in the case of the second relay server 16 connected to the second LAN 12, the wireless communication terminal 29 like the first relay server 15 is unnecessary. That is, the second relay server 16 can be connected to the Internet 14 via the gateway 28 of the second LAN 12.

  Note that the gateway 28 of the second LAN 12 is configured to map a private IPv4 address to a device in the second LAN 12 by performing network address translation (NAT). Therefore, the second relay server 16 of this embodiment is connected to the Internet 14 by the private IP address assigned to itself.

  Next, the configuration of the relay servers 15 and 16 will be described. The first relay server 15 and the second relay server 16 are composed of the same hardware except for the presence or absence of the wireless communication terminal 29. As illustrated in FIG. 2, the relay servers 15 and 16 include a LAN interface (first communication unit) 34, a USB interface (second communication unit) 35, a control unit 36, and a filter address storage unit 41. I have.

  The LAN interface 34 can be connected to a LAN cable and can transmit and receive data via the LAN cable. The first relay server 15 is connected to the first LAN 11 (more specifically, to the LAN 23) by the LAN interface 34. The second relay server 16 is connected to the second LAN 12 by a LAN interface 34.

  As described above, since the second LAN 12 is connected to the Internet 14 via the gateway 28, the second relay server 16 connected to the second LAN 12 can be connected to the Internet 14 via the LAN interface 34. The second relay server 16 is assigned a private IP address, and is connected to the Internet 14 using the private IP address.

  Although the first relay server 15 also includes the LAN interface 34, connection to the Internet 14 by the LAN interface 34 is prohibited by the WAN connection selection unit 39 described later. Therefore, in the present embodiment, the first relay server 15 is not connected to the Internet 14 via the LAN interface 34.

  Therefore, it can be said that the LAN interface 34 included in the relay servers 15 and 16 is connected to the Internet 14 using a private IP address when connecting to the Internet 14.

  The USB interface 35 can be connected to a USB (Universal Serial Bus) standard device and can exchange data with the device. In the present embodiment, the wireless communication terminal 29 is a so-called USB data communication card, and is configured to be connectable to the USB interface 35. The wireless communication terminal 29 is connected to the USB interface 35 of the first relay server 15. As a result, the USB interface 35 of the first relay server 15 can be connected to the Internet 14 via the wireless communication terminal 29. As described above, the first relay server 16 is assigned a global IP address, and is connected to the Internet using the global IP address.

  Note that the wireless communication terminal 29 is not connected to the USB interface 35 of the second relay server 16. Therefore, the second relay server 16 is not connected to the Internet 14 via the USB interface 35.

  Therefore, it can be said that the USB interface 35 included in the relay servers 15 and 16 is connected to the Internet 14 using the global IP address when connecting to the Internet 14.

  The control unit 36 is configured as a computer including hardware such as a CPU, a ROM, and a RAM (not shown). The RAM stores software such as a server application. By executing the server application in the control unit 36, the control unit 36 can function as an address filter unit 37, a packet transfer unit 38, a WAN connection selection unit 39, a filter setting unit 42, and the like.

  The packet transfer unit 38 functions to transfer a packet received by the LAN interface 34 or the USB interface 35 to an appropriate transfer destination.

  However, it may not be preferable in terms of security if packets received from the Internet 14 are transferred indefinitely. Therefore, the address filter unit 37 is configured to perform address filtering of packets transferred by the packet transfer unit 38 as necessary.

  The address filter unit 37 can be set with an IP address that permits transfer of a packet received from the Internet 14. The IP address set in the address filter unit 37 in this way is called “permitted address”. If the transmission destination of the packet received from the Internet 14 matches any IP address set as the permitted address, the address filter unit 37 permits the packet to be transferred to the transmission destination. On the other hand, when the destination of the packet received from the Internet 14 does not match any of the IP addresses set as the permitted address, the address filter unit 37 blocks the packet. If no permitted address is set, filtering by the address filter unit 37 is not performed.

  The permitted address to be set in the address filter unit 37 is stored in the filter address storage unit 41. An example of the permitted address stored in the filter address storage unit 41 of the first relay server 15 is shown in FIG. In the example of FIG. 3, the IP address (192.168.1.1) of the client terminal 17 is on the first line, and the address of the LAN 25 to which the client terminals 19 and 20 are connected (192.168.2.0/24). Is described on the second line. In this way, a plurality of permitted addresses can be set. In addition, as shown in the second line of FIG. 3, it is possible to set a permitted address indicating the entire network (in the case of FIG. 3, the entire LAN 25).

  Registration of the permission address to the filter address storage unit 41 can be performed by the user performing an appropriate operation. For example, the user accesses the first relay server 15 from any of the client terminals and appropriately operates to display the permitted address registration screen as shown in FIG. In this permission address registration screen, a permission address to be stored in the filter address storage unit 41 can be added by appropriate operation by the user. Also, the permitted address stored in the filter address storage unit 41 can be deleted.

  The filter setting unit 42 is configured to set the permitted address stored in the filter address storage unit 41 in the address filter unit 37. Thereby, based on the permitted address registered by the user on the screen of FIG. 4, packet filtering by the address filter unit 37 can be performed. Conversely, even if the user registers the permitted address in the filter address storage unit 41 on the screen of FIG. 4, the address filter unit 37 does not set the permitted address in the address filter unit 37 by the filter setting unit 42. Address filtering is not performed.

  More specifically, the filter setting unit 42 sets the permitted address stored in the filter address storage unit 41 in the address filter unit 37 when the relay server is connected to the Internet 14 via the USB interface 35. It is configured as follows. That is, when the relay server is connected to the Internet 14 using the USB interface 35, the relay server is connected to the Internet 14 by the global IP address, so there is a risk of receiving unauthorized access from the Internet 14. is there. Therefore, when the relay server is connected to the Internet 14 using the USB interface 35 as described above, a permitted address is set in the address filter unit 37. Thereby, the address filter of the packet by the address filter unit 37 can be performed based on the permitted address registered by the user on the screen of FIG. Accordingly, unnecessary connection from the Internet 14 can be blocked, and security can be improved.

  The filter setting unit 42 is configured not to set a permitted address for the address filter unit 37 when the relay server is connected to the Internet 14 via the LAN interface 34. That is, when the relay server is connected to the Internet 14 using the LAN interface 34, the relay server is connected to the Internet 14 by the private IP address assigned by the gateway 28. The risk of receiving a connection is low. Therefore, as described above, when the relay server is connected to the Internet 14 via the LAN interface 34, the address filter unit 37 performs address filtering of the packet by not setting the permitted address to the address filter unit 37. Absent. Thereby, it is possible to prevent unnecessary filtering from being performed.

  By configuring the filter setting unit 42 as described above, the operation of the address filter unit 37 is automatically performed when connected to the Internet 14 with a global IP address and when connected to the Internet 14 with a private IP address. Can be changed. Thereby, security can be appropriately ensured according to the connection status of the relay servers 15 and 16 to the Internet 14.

  The WAN connection selection unit 39 functions to select which of the LAN interface 34 and the USB interface 35 is used to connect to the Internet 14. That is, when the wireless communication terminal 29 is connected to the USB interface 35, the relay server of this embodiment is in a state where it can be connected to the Internet 14 via both the USB interface 35 and the LAN interface 34. In such a case, the relay server cannot be properly connected to the Internet 14 unless it is selected which interface is used to connect to the Internet 14.

  By the way, in this embodiment, since the wireless communication terminal 29 is configured as a USB device, the wireless communication terminal 29 can be detached from the USB interface 35 if unnecessary. If the administrator of the VPN 10 intends to connect the relay server to the Internet 14 via the LAN interface 34 when installing the relay servers 15 and 16, the wireless communication terminal 29 is connected to the USB interface 35. It's hard to imagine connecting. That is, when the wireless communication terminal 29 is connected to the USB interface 35, it is considered that the connection to the Internet 14 is intended by the USB interface 35.

  Therefore, the WAN connection selection unit 39 can connect to the Internet 14 via the USB interface 35 (when the wireless communication terminal 29 is connected to the USB interface 35, that is, when the USB interface 35 is activated). The connection to the Internet 14 by the LAN interface 34 is prohibited, and the USB interface 35 is used to connect to the Internet 14. Thus, when the wireless communication terminal 29 can be used, the relay servers 15 and 16 can be appropriately connected to the Internet 14 by using the USB interface 35 preferentially and connecting to the Internet 14. . On the other hand, when the USB interface 35 cannot connect to the Internet (when the wireless communication terminal 29 is not connected to the USB interface 35, that is, when the USB interface 35 is disabled), the WAN connection selection unit 39 uses the LAN interface. 34, the relay server is set to be connected to the Internet 14.

  Next, the operation of the VPN 10 of this embodiment will be briefly described. In the following, a case where the client terminal 17 in the first LAN 11 transmits a packet to the client terminal 21 in the second LAN 12 will be described as an example.

  Since the client terminal 17 and the client terminal 21 belong to different LANs, packet exchange cannot be performed directly. In such a case, packets can be exchanged between the client terminal 17 and the client terminal 21 by connecting the first LAN 11 and the second LAN 12 with the VPN 10 using the relay servers 15 and 16 of the present embodiment. Become.

  First, an operation for establishing a communication session via the Internet 14 is performed between the first relay server 15 and the second relay server 16 by a user of any client terminal or an administrator of the VPN 10.

  Next, the client terminal 17 performs an operation of transmitting a packet from the client terminal 17 toward the client terminal 21 via the VPN 10. This packet is first transmitted to the first relay server 15.

  The packet transfer unit 38 of the first relay server 15 that has received the packet transfers the packet to the second relay server 16 through the already established communication session.

  When the second relay server 16 receives the packet from the Internet 14, the address filter unit 37 of the second relay server 16 performs address filtering on the packet. However, in the present embodiment, the second relay server 16 is connected to the Internet 14 via the LAN interface 34. Therefore, the filter setting unit 42 of the second relay server 16 does not set the permitted address in the address filter unit 37. As described above, when the permitted address is not set in the address filter unit 37, the address filter unit 37 allows all packets to pass without filtering the packets received from the Internet 14.

  The packet transfer unit 38 transfers the packet that has passed through the address filter unit 37 to the client terminal 21 designated as the transmission destination of the packet.

  As described above, a communication session via the Internet is established between the first relay server 15 and the second relay server 16, and packets are transferred via the communication session, so that they belong to different LANs 11 and 12. Packets can be exchanged between the client terminals 17 and 21.

  Next, a case where a packet is transmitted from the client terminal 21 in the second LAN 12 to the client terminal 17 in the first LAN 11 will be described as an example.

  In this case, the client terminal 21 performs an operation of transmitting a packet from the client terminal 21 toward the client terminal 17 via the VPN 10. This packet is first transmitted to the second relay server 16.

  The packet transfer unit 38 of the second relay server 16 that has received the packet transfers the packet to the first relay server 15 through the communication session.

  The address filter unit 37 of the first relay server 15 that has received the packet from the Internet 14 performs address filtering of the packet. Since the first relay server 15 is connected to the Internet 14 via the USB interface 35, the permitted address is set in the address filter unit 37 by the filter setting unit 42. As described above, when the permitted address is set in the address filter unit 37, the address filter unit 37 matches the destination of the packet received from the Internet 14 with any of the set permitted addresses. Only when the packet is passed. For example, the permitted address shown in FIG. 4 includes the IP address (192.168.1.1) of the client terminal 17. Therefore, when the permitted address as shown in FIG. 4 is set in the address filter unit 37 of the first relay server 15, when the first relay server 15 receives a packet addressed to the client terminal 17 from the Internet 14, The address filter unit 37 passes the packet.

  When the packet passes through the address filter unit 37, the packet transfer unit 38 transfers the packet to the client terminal 17 designated as the transmission destination.

  As described above, the first relay server 15 connected to the Internet 14 using the global IP address performs packet filtering when transferring a packet received from the Internet 14. Thereby, unauthorized connection from the Internet 14 can be prevented and security can be enhanced.

  As described above, the relay servers 15 and 16 of the present embodiment include the LAN interface 34, the USB interface 35, the address filter unit 37, the filter address storage unit 41, and the filter setting unit 42. ing. When connecting to the Internet 14, the LAN interface 34 uses a private IP address that has been address-converted by the gateway 28 as its own IP address. The USB interface 35 uses a global IP address as its own IP address when connecting to the Internet 14. The address filter unit 37 performs packet filtering based on the set permitted address. The filter address storage unit 41 stores a permitted address set for the filtering in the address filter unit 37. The filter setting unit 42 sets the permitted address stored in the filter address storage unit 41 in the address filter unit 37 when connecting to the Internet via the USB interface 35.

  As described above, security can be enhanced by setting to perform packet filtering when connecting to the Internet 14 using a global IP address.

  Moreover, the relay servers 15 and 16 of this embodiment are configured as follows. That is, the LAN interface 34 is connected to the Internet 14 via a LAN gateway when connecting to the Internet 14. When connecting to the Internet 14, the USB interface 35 is wirelessly connected to the mobile phone line 30 and connected to the Internet 14 via the mobile phone line 30.

  That is, when connecting to a WAN via a LAN gateway, an IP address (private IP address) whose address has been converted can be assigned to the relay server. However, when connecting to the WAN via the mobile phone line 30, a global IP address is assigned to the relay server. For this reason, there is a security concern when using the mobile phone line 30. Therefore, as described above, security can be enhanced by setting to perform packet filtering when connecting to the WAN via the USB interface 35.

  In addition, when the USB interface 35 can be connected to the Internet 14, the relay servers 15 and 16 of the present embodiment connect to the Internet 14 through the USB interface 35 and prohibit the connection to the Internet 14 through the LAN interface 34. A connection selection unit 39 is provided.

  That is, the fact that the wireless communication terminal 29 is purposely connected to the USB interface 35 is considered to be intended to connect to the Internet 14 via the USB interface 35. Therefore, when the USB interface 35 can be connected to the Internet 14 (the wireless communication terminal 29 is connected), the connection by the USB interface 35 is given priority over the LAN interface 34.

  Further, in the relay servers 15 and 16 of the present embodiment, the filter setting unit 42 connects the permitted address stored in the filter address storage unit 41 to the address filter unit 37 when connecting to the Internet 14 via the LAN interface 34. Not set.

  That is, when connecting to the Internet 14 by the IP address (private IP address) whose address has been converted, the relay server cannot be freely accessed from the WAN side, so the address filter conditions can be relaxed. Therefore, when connecting to the Internet 14 via the LAN interface 34, the permission address is not set in the address filter unit 37, thereby preventing the convenience from being lost due to unnecessary access restrictions.

  The preferred embodiment of the present invention has been described above, but the above configuration can be modified as follows, for example.

  The first LAN 11 of the above embodiment is laid in an environment where it is difficult to connect to the LAN by wire. However, when the environment changes and the first LAN 11 can be connected to the Internet 14 by wire (for example, when an optical cable is laid to the area where the first LAN 11 is installed), the USB interface 35 of the first relay server 15 is used. The wireless communication terminal 29 may be removed from the terminal. As a result, since it becomes impossible to connect to the Internet 14 via the USB interface 35, the WAN connection selection unit 39 changes the setting to connect to the Internet 14 via the LAN interface 34. When the filter setting unit 42 detects that the LAN interface 34 is set to connect to the Internet 14, the filter setting unit 42 does not set the permitted address in the address filter unit 37. That is, by removing the wireless communication terminal 29, the address filter in the address filter unit 37 can be prevented from being performed. As described above, when the wireless communication terminal 29 is no longer necessary, the interface selection for connecting to the Internet 14 and the packet filtering setting are automatically changed by simply removing the wireless communication terminal 29. The Therefore, it is possible to save the trouble of changing the setting.

  The mode of filtering in the address filter unit 37, the mode in which the filter setting unit 42 sets an IP address in the address filter unit 37, and the like are not limited to the configuration of the above embodiment. In short, change the address filtering settings when the relay server connects to the WAN using the global IP address and when connecting to the WAN using the IP address (private IP address) whose address has been converted. I hope I can. As a result, appropriate filtering can be realized and good security can be realized depending on whether a private IP address or a global IP address is used.

  In the above embodiment, the wireless communication terminal 29 is a USB device and can be removed from the relay server. However, the present invention is not limited to this, and the wireless communication terminal may be built in the relay server and cannot be removed. In this case, it is preferable to provide means (for example, a switch) for invalidating communication by the wireless communication terminal.

  When the wireless communication terminal 29 is detachable from the relay server, the interface for connecting the wireless communication terminal 29 to the second communication unit of the relay server is not limited to the USB standard, but may be another standard such as a PC card. Also good. That is, the second communication unit is not limited to the USB interface, and may be another interface. Furthermore, the second communication unit does not necessarily have to be connected to the WAN wirelessly. The first communication unit does not necessarily have to be connected to the WAN by wire. If the second communication unit is connected to the WAN using the global IP address and the first communication unit is connected to the WAN using the IP address whose address is converted, the first communication unit and the first communication unit 2 The present invention can be applied regardless of the details of the communication unit.

  In the above embodiment, an IPv4 IP address is used. However, for example, an IPv6 IP address may be used.

  The relay servers 15 and 16 can be configured as follows. That is, the filter setting unit 42 sets the permitted address stored in the filter address storage unit 41 in the address filter unit 37 even when connecting to the Internet 14 through the LAN interface 34. Thus, when connecting to the Internet 14 with a private IP address, the same filtering as when connecting to the Internet 14 with a global IP address may be performed.

11 First LAN
12 Second LAN
14 Internet (WAN)
15 1st relay server 16 2nd relay server 29 Wireless communication terminal 34 LAN interface (1st communication part)
35 USB interface (second communication unit)
37 Address filter section 41 Filter address storage section 42 Filter setting section

Claims (5)

Connected to the first LAN to relay communication between the client terminal in the first LAN and the client terminal in the second LAN via the WAN to the second relay server connected to the second LAN. A relay server,
A first communication unit that uses an IP address converted by the gateway of the first LAN as its own IP address when connecting to the WAN;
A second communication unit that uses a global IP address as its own IP address when connecting to the WAN;
An address filter unit that filters packets based on the set IP address;
A filter address storage unit for storing the IP address set for the filtering in the address filter unit;
A filter setting unit that sets an IP address stored in the filter address storage unit in the address filter unit when connecting to the WAN by the second communication unit;
A relay server comprising: The relay server according to claim 1,
The first communication unit connects to the WAN via the gateway of the first LAN when connecting to the WAN,
The second communication unit, when connecting to the WAN, wirelessly connects to a mobile communication network and connects to the WAN via the mobile communication network. The relay server according to claim 2,
When the second communication unit is connectable to a WAN, the second communication unit includes a WAN connection selection unit that connects to the WAN by the second communication unit and prohibits connection to the WAN by the first communication unit. Relay server to be used. A relay server according to any one of claims 1 to 3,
When the filter setting unit is connected to the WAN by the first communication unit, the relay server is characterized in that the IP address stored in the filter address storage unit is not set in the address filter unit. A relay server according to any one of claims 1 to 3,
The said filter setting part sets the IP address memorize | stored in the said address storage part for a filter to the said address filter part also when connecting with WAN by the said 1st communication part, The relay server characterized by the above-mentioned.

Images