JP2015216593A - Relay device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve a terminal fallback problem in an IPv4/IPv6 dual stack environment to be accessible to a web server which can be accessed only by the IPv6, while reducing a waiting time to the possible extent.SOLUTION: It is discriminated whether or not a direct access to the Internet by the IPv6 with the prefix of an IPv6 address. When both an IPv4 address and an IPv6 address exist in a DNS response of a DNS query which is received from a terminal 12 and transferred to a DNS server 13, an IPv4 address and an IPv6 address corresponding to the DNS query are registered into a v6v4 combination table 25. Then, an IPv6 access from the terminal 12 to the server corresponding to the DNS query is relayed after v6v4 NAPT conversion is performed according to the record of the v6v4 combination table 25.

Description

  The present invention relates to a relay device that relays communication of a terminal that supports IPv4 / IPv6 dual stack.

  When IPv4 / IPv6 dual stack compatible devices communicate with each other, one of the transport protocols is preferentially used, and basically IPv6 is preferentially used. When IPv6 is preferentially connected, if IPv6 access is not possible, IPv6 / IPv4 fallback, which is a process of giving up IPv6 access and switching to IPv4 access, occurs. However, as long as it waits for a response in IPv6 and then switches to IPv4, a time lag occurs in this process, and the user experience quality deteriorates.

  When a general household or a small-scale business contracts with a communication service provider, there are contracts that can be directly connected to the Internet using IPv6 and contracts that cannot be performed in the IPv6 addresses that are allocated. When a terminal, which is a contract that cannot be directly connected to the Internet with IPv6, tries to connect to an Internet server by specifying an IPv6 address, the fallback occurs and the perceived speed decreases.

  Several methods have already been proposed to solve this problem. As a first method, a terminal that receives an A record (IPv4 address) and an AAAA record (IPv6 address) from a DNS server and cannot connect directly to the Internet via IPv6 (the home gateway that relays it) specifies an IPv6 address. It has been proposed that when a packet is transmitted, a TCP resetter in the closed network transmits a TCP-RST to the terminal, thereby shortening a waiting time until switching to IPv4.

  As a second method, it is proposed that the AAAA filter is applied to the cache DNS server provided to each user by the provider, and only the A record (IPv4 address) is notified to the terminal in response to the DNS query from the terminal. . As an application of this method, Patent Document 1 proposes a method of applying an AAAA filter at a home gateway used by a terminal and cutting an AAAA record returned from the DNS server at the home gateway.

  As a third method, a method has been proposed in which the RADIUS server to which the terminal or the home gateway relaying the terminal authenticates the connection selects the DNS server address to be notified according to the contract of each user. That is, for users who are contracts that can directly access the Internet using IPv6, the address of the DNS server that can notify both the A record and the AAAA record is notified, and for users that are contracts that cannot be directly accessed. The address of the DNS server that can notify only the A record is notified. While the former user can access with IPv6, the latter user performs access with IPv4 from the beginning, so no fallback occurs.

JP 2012-108887 A

  However, although the time is reduced in the first method, it is inevitable that unnecessary communication occurs. Further, in the case of an implementation in which the application does not fall back, communication becomes impossible when IPv6 communication fails.

  In the second method, AAAA filters are applied to all users, so that users who can connect to IPv6 cannot use the IPv6 service. In addition, when DNSSEC is introduced to improve security, there is a risk that it will not operate normally.

  The third method has a problem that it has a large influence and is difficult to implement because the RADIUS server must be changed.

  Therefore, in the present invention, in the case of a contract that allows IPv6 direct connection, an IPv6 / IPv4 fallback waiting time is not generated as much as possible while maintaining an environment that can access a server that can be accessed only by IPv6. The purpose is to do.

The present invention determines whether or not direct access to the Internet by IPv6 is possible based on the prefix of its own IPv6 address, and the IPv6 address is a condition that does not allow direct access to the Internet,
When both the IPv4 address and the IPv6 address exist as a DNS response in which the DNS query received from the terminal on the LAN side is transferred to the DNS server, the IPv4 address and the IPv6 address corresponding to the DNS query are registered in the v6v4 combination table. ,
The above problem is solved by a relay device that relays IPv6 access from the terminal to the server corresponding to the DNS query by performing v6v4 NAPT conversion according to the record of the v6v4 combination table.

  In other words, since the process is performed by determining whether or not the contract state where direct connection to the Internet by IPv6 is possible, even if the same relay device is used, the user who can connect directly does not decrease the response. Can be used. Further, the required table is not necessary for all communications, but may be of a scale necessary for converting only specific communication for a specific server notified of both IPv4 and IPv6, so that resource consumption is small. I'll do it. Further, since the fallback problem is solved by the NAPT conversion in the relay device used for the home gateway at the end portion close to the terminal instead of the server, unnecessary communication does not occur.

The specific configuration of the relay device according to the present invention can be realized by the following table and function unit. The table includes the v6v4 combination table that records the domain name specified by the DNS query and the corresponding IPv4 address and IPv6 address, and the address and port number for v6v4NAPT conversion when accessing from the LAN side to the WAN side. V6v4NAPT table to be recorded.
As a function unit by software or hardware, it additionally functions when relaying a DNS query and DNS response as a v6v4 function management unit that performs determination and execution of v6v4 NAPT conversion and a DNS proxy that includes registration in the v6v4 combination table. With an extended DNS proxy.
Of these, the extended DNS proxy is
A combination table registration means for registering the domain specified by the DNS query received from the LAN side in the v6v4 combination table;
A combination that registers a combination of the IPv4 address and the IPv6 address of the DNS response in the record for the domain of the DNS query in the v6v4 combination table when both DNS4 and IPv6 exist in the DNS response to the DNS query. Table addition means is provided.
The v6v4 function management unit
Based on the IPv6 address prefix assigned to the relay device itself, the relay device itself determines whether or not direct access to the Internet by IPv6 is possible. If not, the v6v4NAPT function is provided for IPv6 access from a terminal on the LAN side. A direct connection determination means for changing the setting to enable,
When the IPv6 packet is received from the LAN side, if the combination of the source MAC address and the destination IPv6 address of the IPv6 packet is registered in the v6v4 combination table, the record is registered in the v6v4NAPT table and the v6v4NAPT is registered. An extended NAPT means for performing the conversion and forwarding the packet to the corresponding IPv4 address on the WAN side;
When an IPv4 packet is received from the WAN side, if the address and port number of the IPv4 packet are registered in the v6v4NAPT table, the v6v4NAPT table is used to perform v4v6NAPT conversion, which is the reverse conversion of v6v4NAPT conversion. And an extended inverse NAPT means for enabling transfer of a packet to a terminal having an IPv6 address on the LAN side.

  In addition to the extended DNS proxy, as a normal DNS proxy executed as a part of a general router function, a query transfer means for transferring a DNS query to a DNS server, and a DNS response to a corresponding DNS query source Response transfer means for transferring.

  The present invention can also be implemented by installing a program for operating the v6v4 combination table, the v6v4NAPT table, the v6v4 function management unit, and the extended DNS proxy in an existing relay device.

  According to the relay device according to the present invention, the fallback problem can be solved by the relay device close to the end without requiring modification of the RADIUS server or newly installing a DNS server and without setting the terminal side.

Relationship diagram between the functional block of the relay device according to the present invention and surrounding terminals and servers The flowchart which shows the function selection at the time of starting in the embodiment of the relay apparatus concerning this invention (A) Flow diagram at the time of DNS query reception in the embodiment of the relay device according to the present invention, (b) Flow diagram at the time of response reception of (a) Example of v6v4 association table (A) Flow chart when IPv6 packet is received in embodiment of relay apparatus according to this invention, (b) Flow chart when receiving response of (a) Example of v6v4NAPT table Communication sequence diagram in the embodiment (A)-(d) Transition diagram of each table in the embodiment

Hereinafter, the present invention will be described with reference to examples of embodiments.
FIG. 1 shows a functional block diagram of the relay device 11 according to the present invention and a relationship diagram between the terminal 12 and the server using the relay device 11.

  The relay device 11 is a relay device having network interfaces on both the LAN 17 side and the WAN 18 side. Specifically, a device dedicated to network relay such as a home gateway having a general router function 21 or the like can be sufficiently used as the relay device 11 according to the present invention. It does not require processing power like a large-scale server. However, a switch is insufficient because it obtains the IP address of the DNS server and also has an IP address and performs address translation and port translation of the relayed packet.

  The LAN 17 is a network for general households and small businesses, and has a plurality of terminals 12 (12a, 12b, 12c...). The terminal 12 accesses the DNS server 13 and the web servers 14a, 14b, and 14c existing in the Internet 19 on the WAN 18 side through the relay device 11.

  The WAN 18 is not directly connected to the Internet 19 but is connected to the Internet 19 via a closed network 20 based on IPv6. Depending on the IPv6 address to which the relay device 11 is issued, there are cases where the IPv6 address can be connected to the Internet 19 and access to the closed network 20 is limited. In the latter case, IPv4 that can be directly connected to the Internet 19 is often used as another means.

  As described above, the relay device 11 has a general router function 21. The IPv4 address and the IPv6 address are given from the server on the WAN 18 side, the IPv4 address and the IPv6 address are given to the subordinate terminal 12, and the access from the terminal 12 is subjected to NAPT conversion and relayed. Furthermore, the v6v4 function management unit 22, the extended DNS proxy 23, the v6v4 combination table 25, and the v6v4NAPT table 26 are provided.

Hereinafter, these functions will be described in order. The function selection from when the relay device 11 is powered on or restarted will be described with reference to the flowchart of FIG.
First, the relay device 11 acquires an IPv6 address from the server on the WAN 18 side by the router function 21 (S101). The v6v4 function management unit 22 executes the direct connection determination unit 111 that determines whether or not the acquired IPv6 address is an address that allows direct connection to the Internet 19 (S102). This determination can be made by previously registering a condition for the IPv6 address prefix in the storage unit 24 of the relay apparatus 11 and comparing the acquired IPv6 address prefix with the condition. If the contract allows direct connection to the Internet 19 (S102-Yes), it is not necessary to execute the function as the relay apparatus 11 according to the present invention, and therefore all the later-described v6v4NAPT functions performed in the present invention are turned off. The function stop means 113 is executed (S105). If the contract cannot be directly connected (S102-No), the v6v4NAPT function executed by the present invention is significant.

  However, since the v6v4 conversion function is accompanied by a change in the connection form, if applied unconditionally, it may be contrary to the will of the user who uses the terminal 12. For this reason, it is desirable that the v6v4 function management unit 22 executes the setting determination unit 112 that determines whether or not the setting allows the execution of the v6v4NAPT function (S103). In addition, although it demonstrates on the assumption that the same judgment is performed also in the flow to be described later, this judgment is not essential, and it may be set to be automatically executed after obtaining permission upon installation and execution of the relay device 11. Although not shown, the web server function for the terminal 12 of the relay device 11 realized by the router function 21 can execute the execution right registration unit 110 that changes those settings by access from the terminal 12 side. If the setting is not permitted (S103-No), the function stopping unit 113 for turning off all the later-described v6v4NAPT functions performed in the present invention is executed (S105). If the setting is permitted (S103-Yes), the function operating unit 114 for turning on the v6v4NAPT function executed according to the present invention is executed (S104).

  When the v6v4 NAPT function is turned ON by the above determination, the process performed by the extended DNS proxy 23 before the next process performed by the v6v4 function management unit 22 will be described with reference to FIGS.

  First, the operation when a DNS query is received from the terminal 12 (S111) as a normal DNS proxy operation will be described with reference to the flow of FIG. Upon reception, the extended DNS proxy 23 executes setting determination means 121 for determining whether or not it is a setting that permits execution of the v6v4NAPT function as necessary. If it is not the setting which permits execution of the above-mentioned v6v4NAPT function (S112-No), it proceeds to the normal DNS proxy execution as it is (S114). If the setting is permitted (S112-Yes), a record composed of the MAC address of the terminal 12 that is the source MAC address of the DNS query and the domain name specified by the DNS query is registered in the v6v4 combination table 25. At the same time, the combination table registration unit 122 for setting a timer for deleting the record from the table is executed (S113).

  An example of this v6v4 combination table 25 is shown in FIG. “MAC” is a MAC address, “DNS query” is a domain name to be resolved by the query, “IPv6” is an IPv6 address that is a response of the DNS server 13 to the query, and “IPv4” is the DNS server 13 for the query. The IPv4 address, “timer”, which is a response to the above, is a time limit for deleting a record after a lapse of a certain time in order to avoid the enlargement of the table. Of these, the MAC address is not essential because it uniquely identifies each terminal 12 (12a, 12b, 12c...). Instead, the IP of the terminal 12 (12a, 12b, 12c...) An address may be registered. Further, the record is not shared between the terminals 12a, 12b, 12c, etc. without including the MAC address or IP address of the terminal 12 in the record, that is, without individually identifying the terminal 12. Implementation is also possible. However, the DNS server 13 may change the address indicated by the DNS response for each request for load distribution. In order to follow this load distribution, the terminals 12 (12a, 12b, 12c...) Must be individually identified, and the MAC address and IP address are recorded and the terminals 12 (12a, 12b,. 12c...)) This can be dealt with by dividing the record every time.

  Of the items in the v6v4 combination table 25 described above, the timer is not essential and is not required to be in this form. For example, the enlargement can be suppressed by deleting the oldest records every time the number of records exceeds a threshold. In addition, the timer in FIG. 4 is a method of decrementing every second, but a method of recording a time to be deleted after a timeout according to the start time may be used. If there is the same record in S113, the timer setting is overwritten, the count of the timer to be decremented is set to the initial value, or the time to be deleted due to timeout is changed to the time from the new time. As a case where the same record exists and is overwritten, a DNS query may be transmitted in succession from the same terminal 12 due to repeated clicks on the terminal 12 whose DNS local cache is set to OFF. It is done. Further, when the MAC address for each terminal 12 is not distinguished, the above-described case can be satisfied when queries to the same domain are continued by a plurality of terminals 12a, 12b, 12c.

  However, in the v6v4 combination table 25 described above, the IPv4 and IPv6 fields are blank at the stage of S113. After that, the extended DNS proxy 23 shifts to execution of the DNS proxy that is the normal router function 21 (S114).

  The DNS proxy operation here is performed by the query transfer means 101 that transfers the DNS query received from the terminal 12 to the DNS server 13 designated by the RADIUS server 15 or the like. Thereafter, the response transfer means 102 for relaying the DNS response returned from the DNS server 13 to the terminal 12 is executed. Before the execution, the processing performed by the extended DNS proxy 23 is shown in FIG. This will be described together with the flow of.

  When the router function 21 receives the DNS response (S121), the extended DNS proxy 23 executes setting determination means 121 for determining whether or not it is a setting permitting the execution of the above-described v6v4NAPT function as necessary (S121). S122). This is the same as the processing of S111 for the DNS query. If it is not the setting which permits execution of the above-mentioned v6v4NAPT function (S122-No), it proceeds to the normal DNS proxy execution as it is (S126). If the setting is to permit execution (S122-Yes), the response analysis unit 123 that analyzes the contents of the received DNS response is executed (S123). At this time, if the DNS response includes only the A record (IPv4) or only the AAAA record (IPv6) (S123-No), the v6v4 combination table 25 is relayed in S113 in which the DNS query corresponding to the DNS response is relayed. The union table deleting means 124 for deleting the corresponding record registered in (1) is executed (S125). This is because when only IPv4 or only IPv6 is notified, v4v6 NAPT conversion, which is reverse conversion described later, cannot be performed in the first place. When only the A record (IPv4 address) is notified, the normal DNS proxy is executed as it is (S126), and the IPv4 address is passed to the terminal 12, so that the terminal 12 accesses the corresponding web server 14 by IPv4. it can. Even when only the AAAA record (IPv6 address) is notified, a normal DNS proxy is executed in the same manner (S126). However, since the IPv6 address possessed by the relay device 11 cannot be directly connected to the Internet 19, the terminal 12 It is necessary to set another means to enable access.

  On the other hand, if the DNS response includes both the A record and the AAAA record (S123-Yes), it is meaningful to perform the v6v4NAPT conversion in the subsequent response. Therefore, the union table appending means for overwriting and registering information contained in the DNS response to the blank IPv4 address and IPv6 address for the record registered by the DNS query corresponding to the DNS response in the v6v4 union table 25. 125 is executed (S124). Then, the response transfer means 102 is executed to transfer the DNS response including both the A record and the AAAA record to the terminal 12 as a normal DNS proxy (S126).

  The terminal 12 whose DNS name has been resolved by the above DNS response subsequently transmits a request to the IP address. If this packet is based on IPv4, the router function 21 of the relay device 11 relays it by a normal operation that may include general NAPT conversion (not shown).

  The flow at this time will be described with reference to FIG. If the packet received from the LAN side by the relay device 11 designates the IPv6 address of the Internet 19 as the destination (S151), the setting determination means 112 is executed as necessary (S152), and the v6v4NAPT function is turned on. If so (S152-Yes), the combination record search means 131 for confirming whether or not the record corresponding to the IPv6 address of the packet exists in the v6v4 combination table 25 is executed. When the v6v4 combination table 25 includes a MAC address, a record having a matching IPv6 address is searched for among records having a MAC address corresponding to the transmission source address of the received packet. If there is no corresponding record, since the IPv6 packet does not know the IPv4 address to be converted, the packet transfer means 132 that transfers the packet directly to the WAN 18 side is executed (S155). However, as long as there is no other means that can reach the Internet 19, this IPv6 packet cannot reach the Internet 19, and instead of executing the packet transfer means 132, a packet discard means (not shown) for discarding the packet here. May be executed. When other means can be used, an appropriate setting may be performed to transfer the IPv6 packet to the Internet 19.

  When v6v4 NAPT conversion is performed for transmission to the WAN 18 side in S155, it is not necessary to perform NAPT conversion as a normal router of the router function 21.

  On the other hand, if the record corresponding to the IPv6 address exists in the v6v4 combination table 25 (S153-Yes), the extended NAPT means 133 that performs v6v4 NAPT conversion to IPv4 on the IPv6 packet is executed (S154). In this v6v4NAPT conversion and v4v6NAPT conversion which is an inverse conversion to the response, registration and reading in the v6v4NAPT table 26 which is a conversion correspondence table are performed appropriately. An example of this v6v4NAPT table 26 is shown in FIG. “SrcV6” is the IPv6 address of the terminal 12 that is the source of the original IPv6 packet, and “srcPort” is the source port of the original IPv6 packet. “DestV6” is the destination IPv6 address of the original IPv6 packet, and this is the address acquired by the previous DNS response. “DestPort” is the transmission destination port of the original IPv6 packet, and in the case of HTTP, number 80 is often used. “TransV4” is the IPv4 address on the WAN 18 side of the relay apparatus 11 itself, and is one type in the case of FIG. However, depending on the contract, a plurality of IPv4 addresses may be assigned to the WAN 18 side of one relay apparatus 11, and in this case, which address is a record used is identified by this item. “TransPort” is the transmission source port number in the IPv4 packet after the NAPT conversion, and may be srcPort as it is, or may be arbitrarily changed as necessary in order to avoid duplication with other terminals 12. As a NAPT conversion, the transmission source address is naturally the IP address on the WAN 18 side of the relay device 11. The timer is a time for discarding a record when a response packet is not returned, and decrements every second. Alternatively, a time-out time may be registered, and the record may be discarded when the time comes.

  After the v6v4 function management unit 22 performs the v6v4 NAPT conversion from the packet using the IPv6 address to the packet using the IPv4 address while registering the record in the v6v4NAPT table 26 by the extended NAPT unit 133, the router function 21 receives the IPv4 The packet sending means 103 for sending the packet to the web server 14 on the WAN 18 side is executed.

  Processing for receiving a response to this will be described with reference to FIG. When an IPv4 packet, which is a response of the packet, is returned from the web server 14 to the interface on the WAN 18 side (S161), the v6v4 function management unit executes the setting determination unit 112 as necessary (S162). If the v6v4NAPT function is ON (S162-Yes), the NAPT record search means 134 for searching the record corresponding to the packet from the v6v4NAPT table 26 is executed (S163). It is searched whether there is a record corresponding to “transV4” and “transPort” for the source IPv4 address and destination port number of the packet. If there is not (S163-No), the IPv4 packet is determined to be a response to the packet that has not been v6v4NAPT converted by the relay apparatus 11, so that the NAPT as a normal router function 21 instead of v4v6NAPT conversion is necessary. Inverse conversion is performed, and the packet is transferred to the terminal 12 that is the source of the original packet (S165).

  On the other hand, if there is a corresponding record (S163-Yes), the extended inverse NAPT means 135 that performs v4v6 NAPT conversion for inversely converting an IPv4 packet into an IPv6 packet is executed according to the record. That is, it is assumed that the IPv6 packet is obtained by changing the destination IPv6 address to the address of srcV6 of the corresponding record and the destination port to the port number of srcPort. Then, the router function 21 executes the packet return means 104 that sends the reversely converted IPv6 packet to the terminal 12 that is the destination address (S165).

  The above flow will be specifically described with reference to an embodiment including transition of address numbers and table records. FIG. 7 shows a communication sequence diagram, and FIGS. 8A to 8D show state change diagrams of the v6v4 combination table 25 and the v6v4NAPT table 26. The relay apparatus 11 has “200.200.200.200” as the IPv4 address, “200 :: 200” as the IPv6 address, and “MAC-H” as the MAC address on the WAN 18 side. Further, the LAN 17 side has “10.10.10.200” as the IPv4 address and “10 :: 200” as the IPv6 address. The terminal 12 a has 10.10.10.10 (IPv4) and 10 :: 10 (IPv6) as addresses in the LAN 17. The MAC address is “MAC-T”. The IPv4 address of the DNS server 13 is “100.100.100.100”, the IPv6 address is “100 :: 100”, the IPv4 address of the web server 14a having the domain name “x.com” is “1.1.1.1”, and the IPv6 address is “1 :: 1”.

  As an initial setting, the function activation unit 114 for turning on the v6v4 NAPT function is executed in the relay device (S201). The v6v4 combination table 25 and the v6v4NAPT table 26 at this time are empty initial values as shown in FIG.

  Then, the terminal 12a attempts to access “x.com” (S202). A DNS query for resolving the name of x.com for both IPv4 and IPv6 is transmitted to the relay apparatus 11 as a gateway (S203). In the relay apparatus 11 that has received this, the combination table registration means 122 is executed by the extended DNS proxy 23, and the information of this DNS query is written in the v6v4 combination table 25 as shown in FIG. 8B (S204). At this time, only the MAC address and the domain name are present, and the IPv6 address and the IPv4 address are not resolved, and are blank. The router function 21 of the relay apparatus 11 executes the query transfer means 101 that transfers this DNS query to the DNS server 13 (S205).

  The DNS server 13 returns a DNS response including both the IPv4 address and the IPv6 address that resolve the name of x.com to the relay apparatus 11 (S206). Receiving this, the extended DNS proxy 23 of the relay device 11 executes the combination table appending means 125 to append the IPv4 address and the IPv6 address to the corresponding record (S207). The status of the table at this point is shown in FIG. Then, the relay device 11 executes response transfer means 102 that returns a DNS response to the terminal 12a (S208).

  As a result, the terminal 12a whose name has been resolved transmits an HTTP request addressed to the IPv6 address of x.com using the IPv6 address that has been set in priority (S211). Upon receiving this, the v6v4 function management unit 22 of the relay apparatus 11 executes the combination record search unit 131, and since there is a record with the same source MAC address addressed to the corresponding IPv6 address, the extended NAPT unit 133 is executed. The packet is rewritten to IPv4 while registering the correspondence as a new record in the v6v4 NAPT table 26 (S212). The status of the table in this state is shown in FIG. A record corresponding to the v6v4NAPT table 26 is added.

  Then, the packet transfer means 132 for transmitting the packet rewritten to IPv4 to the web server 14a is executed (S213). When a response to this is returned from the web server 14a (S214), the v6v4 function management unit 22 of the relay apparatus 11 executes the NAPT record search unit 134 to search for a record corresponding to the packet. At this time, not only the v6v4NAPT table 26 but also the v6v4 combination table 25 is searched to search for a record corresponding to the web server 14a that is the transmission source. If there is a corresponding record, the extended reverse NAPT means 135 for reversely converting the IPv4 packet addressed to the relay apparatus 11 into the IPv6 packet addressed to the terminal 12a is executed according to this record (S215). Then, the inversely converted packet is returned to the terminal 12a (S216).

  After the packet passes, the records in these tables are deleted when the timer expires.

11 Relay device 12, 12a, 12b, 12c Terminal 13 DNS server 14, 14a, 14b, 14c web server 15 RADIUS server 17 LAN
18 WAN
19 Internet 20 Closed network 21 Router function 22 v6v4 function management unit 23 Extended DNS proxy 24 Storage unit 25 v6v4 combination table 26 v6v4NAPT table 101 Query transfer unit 102 Response transfer unit 103 Packet transmission unit 104 Packet return unit 110 Execution right registration unit 111 Direct Connection determination means 112 Setting determination means 113 Function stop means 114 Function operation means 121 Setting determination means 122 Association table registration means 123 Response analysis means 124 Association table deletion means 125 Association table appending means 131 Association record search means 132 Packet transfer means 133 Extended NAPT Means 134 NAPT record retrieval means 135 Extended inverse NAPT means

Claims (4)

It is determined whether or not the source device of the packet can directly access the Internet by IPv6 based on the prefix of its own IPv6 packet,
When both the IPv4 address and the IPv6 address exist as a DNS response in which a DNS query from the above-mentioned source device that cannot be directly accessed is transferred to the DNS server, the IPv4 address and the IPv6 address corresponding to the DNS query are registered in the v6v4 combination table. And
A relay device that relays IPv6 access from a terminal on the LAN side to a server corresponding to the DNS query by performing v6v4 NAPT conversion according to the record of the v6v4 combination table. A v6v4 combination table that records the domain name specified in the DNS query and the corresponding IPv4 address and IPv6 address;
A v6v4NAPT table for recording addresses and port numbers for v6v4NAPT conversion when accessing from the LAN side to the WAN side;
a v6v4 function management unit for determining and executing v6v4 NAPT conversion;
An extended DNS proxy that performs registration in the v6v4 combination table when relaying a DNS query and DNS response as a DNS proxy;
Have
The extended DNS proxy is
A combination table registration means for registering the domain specified by the DNS query received from the LAN side in the v6v4 combination table;
A combination that registers a combination of the IPv4 address and the IPv6 address of the DNS response in the record for the domain of the DNS query in the v6v4 combination table when both DNS4 and IPv6 exist in the DNS response to the DNS query. Table appending means,
Have
The v6v4 function management unit
Based on the IPv6 address prefix assigned to the relay device itself, it is determined whether or not the relay device itself can directly access the Internet by IPv6. If not, v6v4NAPT conversion is valid for IPv6 access from a terminal on the LAN side. Direct connection judgment means for changing the setting to
When the IPv6 packet is received from the LAN side, if the combination of the source MAC address and the destination IPv6 address of the IPv6 packet is registered in the v6v4 combination table, the record is registered in the v6v4NAPT table and the v6v4NAPT is registered. An extended NAPT means for performing the conversion and forwarding the packet to the corresponding IPv4 address on the WAN side;
When an IPv4 packet is received from the WAN side, if the address and port number of the IPv4 packet are registered in the v6v4NAPT table, the v6v4NAPT table is used to perform v4v6NAPT conversion, which is the reverse conversion of v6v4NAPT conversion. And an extended inverse NAPT means for enabling transfer of a packet to a terminal having an IPv6 address on the LAN side. The v6v4 function management unit
There is an execution right registration means that can change the setting of whether to perform v6v4 NAPT conversion by the setting from the terminal,
The extended DNS proxy and the v6v4 function management unit determine whether to execute the function according to the setting by the execution right registration unit.
The relay device according to claim 2. For relay devices that have interfaces on the LAN side and WAN side,
A v6v4 combination table that records the domain name specified in the DNS query and the corresponding IPv4 address and IPv6 address;
A v6v4NAPT table for recording addresses and port numbers for v6v4NAPT conversion when accessing from the LAN side to the WAN side;
a v6v4 function management unit for determining and executing v6v4 NAPT conversion;
An extended DNS proxy that performs registration in the v6v4 combination table when relaying a DNS query and DNS response as a DNS proxy;
Provided,
The extended DNS proxy is
A combination table registration means for registering the domain specified by the DNS query received from the LAN side in the v6v4 combination table;
A combination that registers a combination of the IPv4 address and the IPv6 address of the DNS response in the record for the domain of the DNS query in the v6v4 combination table when both DNS4 and IPv6 exist in the DNS response to the DNS query. Table appending means,
Have
The v6v4 function management unit
Based on the IPv6 address prefix assigned to the relay device itself, it is determined whether or not the relay device itself can directly access the Internet by IPv6. If not, v6v4NAPT conversion is valid for IPv6 access from a terminal on the LAN side. Direct connection judgment means for changing the setting to
When the IPv6 packet is received from the LAN side, if the combination of the source MAC address and the destination IPv6 address of the IPv6 packet is registered in the v6v4 combination table, the record is registered in the v6v4NAPT table and the v6v4NAPT is registered. An extended NAPT means for performing the conversion and forwarding the packet to the corresponding IPv4 address on the WAN side;
When an IPv4 packet is received from the WAN side, if the address and port number of the IPv4 packet are registered in the v6v4NAPT table, the v6v4NAPT table is used to perform v4v6NAPT conversion, which is reverse conversion of v6v4NAPT conversion. For operating as a relay device having extended inverse NAPT means for enabling transfer of packets to a terminal having an IPv6 address on the LAN side.

Images