WO2005083959A1

WO2005083959A1 - Network access router, network access method, program, and recording medium

Info

Publication number: WO2005083959A1
Application number: PCT/JP2005/003215
Authority: WO
Inventors: Norihito Fujita; Yuichi Ishikawa; Akio Iijima
Original assignee: Nec Corporation
Priority date: 2004-03-01
Filing date: 2005-02-25
Publication date: 2005-09-09
Also published as: JP4600394B2; TW200601752A; JPWO2005083959A1

Abstract

There are provided a network access router, a network access method, a program, and a recording medium enabling an in-LAN node to select a source IP address according to a target network to be used and communicate with an in-target network node without NAT-ing in midstream a packet between the in-LAN node and the in-target network node. A network access router B1 includes a target network connection setting unit for performing setting in the network access router B1 and in the nodes so as to transmit a packet for communication between a terminal under the network access router B1 and the target networks D1 and D2 in a communication tunnel established between a terminal A11 and the network access router B1 at a section between the nodes and the network access router B1. Accordingly, in response to a target network connection request from the terminal A11, the network access router B1 performs setting in its node, generates setting script to be executed in the terminal A11, and responds the setting script to the terminal A11 so as to cause the terminal A11 to execute it.

Description

Specification

Network access router, network access method, program, and recording medium

Technical field

The present invention relates to a network access router, a network access method, a program for a network access router (hereinafter, referred to as a “program”), and a recording medium, and particularly to a home or office, and a hot spot (IEEE802.11b). Internet access from nodes that exist in a LAN (Local Area Network), such as shops and public facilities that provide a wireless LAN and provide Internet connection services, condominiums, and office buildings. Network access routers, network access methods, programs, and records used for remote access to networks (connecting to external LAN via public line such as modem and using resources on LAN) Regarding the medium.

Background art

[0002] Conventional network access routers provide Internet access and VPN (Virtual Private Network) remote access to nodes existing in a LAN, such as a home, office, hotspot, concierge, or office building. It is used as an access router to perform

[0003] This type of network access router includes Internet or VPN (hereinafter referred to as target network) and PPP (Point-to-Point Protocol: a protocol for directly connecting two points to configure a WAN), L2TP (Layer 2 Tunneling Protocol: When constructing a VPN via the Internet MTS's L2F and IPsec (adding authentication and encryption functions to TCPZlP communication to alter or spoof packets) Connect to the target network using a protocol such as IEEE802.lx. In some cases, the target network is directly connected to a link such as Ethernet (registered trademark). The IP address used to connect to the target network, the DNS server address in the target network, etc. are determined by the power allocated in protocol procedures such as PPP or DHCP (Dynamic Host). Configuration Protocol: A mechanism for automating TCP / IP-related settings in network clients) and other protocols, and are set in the WAN interface of the network access router.

[0004] On the LAN side of the network access router, a private IP address is used. When a packet transmitted by a node in the LAN is transferred from the network access router to the WAN, the packet is sent to the WAN interface of the network access router. When the source IP address is set to NAT (Network Address Translation: When connecting the LAN to the Internet, the private IP address used on the LAN side is changed to the global IP address assigned on the Internet side. Conversion technology).

[0005] There are also network access routers that can simultaneously establish connections to a plurality of target networks by simultaneously establishing a plurality of PPP connections, IPsec connections, and the like. In this case, the IP address assigned for each connection is set on the WAN interface of the network access router, and the source that is NATed for packets within the LAN node according to the target network to which the packet is transferred IP addresses are used properly.

As described above, currently used network access routers generally pay from the target network and NAT the source IP address to the issued IP address. Communication may not be possible due to the Streaming ゃ A communication protocol used in IP phones and the like is a typical example, and various applications are provided on the application side or the NAT side so that communication can be performed via the NAT.

[0006] However, it is impractical to support all protocols via NAT so that communication with a target network can be performed without performing NAT on the way. As one mechanism for communicating between a node under the network access router and a node in the target network without being NATed on the way, the PD (Prefix Delegation) method has been proposed as an IPv6 address dispatching method. In the PD method, the target network issues an IP address prefix such as 2001: 260: 0: 1 :: / 64 to the network access router, and the network access router issues the assigned IP address. A separate IP address (for example,

2001: 260: 0: 1: 200: 4cff: fe23: 9ed2) to RA (Router Advertisement: a mechanism by which a router connects to itself and informs IPv6-compatible machines etc. of network setting information) and D HCPv6 Pay out to nodes in the LAN using such a method. As a result, a node in the LAN can communicate with a node in the target network without passing through NAT by using the address assigned from the target network as a source IP address (for example, see Patent Document 1). .

Patent Document 1: Patent No. 3153173 (Page 5, FIG. 1)

Disclosure of the invention

Problems to be solved by the invention

[0007] By the way, according to the above-described conventional technology, when the IP address of the target network is directly issued to the nodes in the LAN without performing NAT in the network access router, the nodes in the LAN are sent to a plurality of target networks. Cannot be connected at the same time. In the conventional method of accessing the target network using NAT, the nodes in the LAN are assigned private addresses that can be used only under the network access router. If the network access router connects to multiple target networks using this method, the network access router should forward the packet based on the destination IP address of the packet sent from the LAN node to the target network. By deciding the target network, paying from the corresponding target network, and sending the source IP address to the issued IP address by NAT, transmission of multiple target networks could be realized.

On the other hand, when directly issuing the IP address of the target network to the LAN nodes using the PD method, multiple IP addresses are issued to the LAN nodes because NAT is not performed on the way. The source IP address must be selected according to the target network used by the internal nodes and the packet must be transmitted.

[0008] However, with a conventional method such as RA or DHCPv6 used for issuing an IP address from a network router to a node in a LAN, a plurality of IP addresses cannot be issued to a node in a LAN. If a node in the LAN has multiple interfaces, it is possible to have an IP address for each interface. With conventional methods such as A and DHCPv6, the operation of selecting and issuing an IP address for each interface of a node in the LAN cannot be performed, and PCs and printers are the main nodes connected to the LAN under the network access router. And generally have one interface and no power. For this reason, the conventional method cannot use multiple target networks at the same time.

Thus, an object of the present invention is to provide a method in which a node in a LAN selects a source IP address according to a target network to be used without performing NAT on a packet between a node in the LAN and a node in a target network. An object of the present invention is to provide a network access router, a network access method, a network access router program, and a recording medium which enable communication with a node in a network.

Means for solving the problem

[0009] In order to solve the above-described problem, the invention according to claim 1 relates to a method in which a node connected to a subordinate LAN is connected to one or more target networks which are networks to be accessed by the node. A network access router that enables communication, comprising: transmitting a packet corresponding to communication between the node and one or more of the target networks in a section between the node and the network access router itself. And transmitting over a communication tunnel established between the node and the network access router itself.

[0010] In the invention according to claim 2, in the invention according to claim 1, the communication tunnel is established by causing the node to execute a setting script provided to the node by the network access router itself. It is characterized by the following.

[0011] The invention according to claim 3 is a network that enables communication between a node connected to a subordinate LAN and at least one target network that is a network to be accessed by the node. An access router, which transmits a packet corresponding to communication between the node and one or more of the target networks in a section between the node and the network access router itself. A target network connection setting unit configured to perform settings in the network access router itself and settings in the node in order to transfer the data over a communication tunnel established with the network access router itself. It is characterized by

[0012] The invention according to claim 4 is the invention according to claim 3, wherein the communication tunnel is provided between the node and the network access router itself for the target network with which the node communicates. It is characterized in that it is set individually in a section.

[0013] The invention according to claim 5 is the invention according to claim 3 or 4, wherein the target network connection setting unit corresponds to communication between the node and at least one of the target networks. The network access router itself, for transferring packets over a communication tunnel established between the node and the network access router itself in a space between the node and the network access router itself. A router-get network connection policy management unit that holds parameters necessary for setting in the node; an interface setting unit that sets a tunneling interface for a LAN-side interface in the network access router itself; Routing table in the access router itself And routing setting unit for setting the entry for, characterized in that it comprises a configuration script creation unit that creates a configuration script to be executed to Te per cent ヽ to establish the communication tunnel to the node.

[0014] In the invention according to claim 6, in the invention according to claim 5, the configuration script executed to establish the communication tunnel in the node includes a tunneling agent that terminates the communication tunnel in the node. Creation of an interface, assignment of an IP address corresponding to the target network connected via the communication tunnel on the tunneling interface, and communication tunnel corresponding to a packet to the target network. It is characterized by including a command corresponding to the setting of a routing table for passing through the server.

[0015] The invention according to claim 7 is the invention according to claim 6, wherein an IP address assigned to the created tunneling interface and corresponding to the target network connected via the communication tunnel. Is an IPv6 address, and is lower than the IPv6 address.

64 bits are automatically generated from the MAC address of the physical interface of the node.

[0016] The invention according to claim 8 is the invention according to claim 6 or 7, wherein the target network In the setting of the routing table for passing the packet to the corresponding communication tunnel, the default route automatically set in advance by DHCP or RA at the node is set to the metric of the automatically set default route. It is characterized by overwriting by specifying a metric with a smaller value and passing through the above-mentioned communication tunnel as the default route.

[0017] The invention according to claim 9 is the invention according to any one of claims 3 to 8, wherein the communication tunnel uses the IP address in an outer header, such as an IPv6 over IPv4 tunneling protocol, to establish the communication tunnel. This is a protocol in which identification is performed.In order to use the plurality of communication tunnels between the node and the network access router itself, an alias address is assigned to the LAN-side interface of the network access router itself. And using the IP address of the network access router itself in a header of the communication tunnel according to the communication tunnel.

[0018] The invention according to claim 10 is a network that enables communication between a node connected to a subordinate LAN and at least one target network that is a network to be accessed by the node. An access router, which provides a Web screen for receiving a communication request from the node between the node and one or more of the target networks, wherein the node responds to the Web screen with the Web screen. By making a communication request between a node and one or more of the target networks, communication between the node and one or more of the target networks is enabled. I do.

[0019] The invention according to claim 11 is a network that enables communication between a node connected to a subordinate LAN and at least one target network that is a network to be accessed by the node. An access router, wherein the node communicates a packet corresponding to communication between the node and the target network in a section between the node and the network access router itself. It is characterized in that transfer is performed using different communication tunnels depending on the target network.

[0020] The invention according to claim 12 enables communication between a node connected to a subordinate LAN and one or more target networks, which are networks to be accessed by the node. An access method for a network access router, comprising: establishing a communication tunnel between the node and the network access router itself in a section between the node and the network access router itself; Any of the nets

A packet corresponding to communication with one or more packets is transferred on the communication tunnel.

[0021] The invention according to claim 13 is a network that enables communication between a node connected to a subordinate LAN and at least one target network that is a network accessed by the node. An access method of an access router, wherein in a section between the node and the network access router itself, a packet corresponding to communication between the node and the target network is transmitted by the node. It is characterized in that transfer is performed using different communication tunnels according to the target network.

[0022] The invention according to claim 14 is a network that enables communication between a node connected to a subordinate LAN and at least one target network that is a network to be accessed by the node. A program for an access router, comprising: establishing, in a target network connection setting unit, a communication tunnel between the node and the network access router itself in a section between the node and the network access router itself. A, and a procedure B of transferring a packet corresponding to communication between the node and at least one of the target networks over the communication tunnel.

[0023] The invention according to claim 15 is a network that enables communication between a node connected to a subordinate LAN and at least one target network that is a network to be accessed by the node. An access router program, wherein a target network connection setting unit establishes, in a section between the node and the network access router itself, a different communication tunnel according to the target network with which the node is communicating. A step of transferring a packet corresponding to the communication between the node and the target network by using the different communication tunnel.

[0024] The invention according to claim 16 is a network that enables communication between a node connected to a subordinate LAN and one or more target networks that are networks to which the node accesses. A storage medium on which an access router program is recorded. The connection setting unit includes a procedure A for establishing a communication tunnel between the node and the network access router itself in a section between the node and the network access router itself; A program for executing a procedure B of transferring a packet corresponding to communication with one or more of the powers over the communication tunnel is recorded.

[0025] The invention according to claim 17 is a network that enables communication between a node connected to a subordinate LAN and at least one target network that is a network accessed by the node. A storage medium storing a program of an access router, wherein a target network connection setting unit communicates with the target network in a section between the node and the network access router itself. A program for executing a procedure α for establishing a different communication tunnel according to the above and a procedure β for transferring a packet corresponding to communication between the node and the target network using the different communication tunnel. It is characterized.

[0026] The network access router of the present invention, by performing the above-described configuration and operation, communicates between a node, which is a node in the LAN, and the target network by using the node and the network access router itself (hereinafter, "own router") t ヽぅ)) through a communication tunnel established between This communication tunnel can be established by the number corresponding to the target network with which the node communicates, and the target network power can be directly assigned to the tunneling interface that terminates the communication tunnel at the node. . Therefore, even in an environment where a node communicates with a plurality of target networks, communication between the node and the target network can be performed without performing NAT on the way, thus achieving the object of the present invention. it can.

The invention's effect

[0027] As an effect of the present invention, a node in a LAN selects a source IP address according to a target network to be used without performing NAT on a packet between a node in the LAN and a node in the target network. It is possible to realize communication with a node in the network. The reason is that the network access router of the present invention receives a request from a subordinate LAN node for the subordinate LAN node to access the target network, and responds to the request. On the other hand, a tunneling interface is created on the local router's LAN interface, and packets destined for that node from the target network to the LAN node are sent to the corresponding communication tunnel between the local router and the LAN node. Configure the routing table to transfer to Further, the network access router according to the present invention includes a network access router in each of the target nodes in the LAN so that a packet between the node in the LAN and the target network is performed on a corresponding communication tunnel between the router and the node in the LAN. Responds to the nodes in the LAN to create a tunneling interface to be used for communication with the LAN interface, assign IP addresses issued from each target network to the tunneling interface, assign IP addresses issued, and configure routing. This is because it causes the nodes in the LAN to execute the script.

BEST MODE FOR CARRYING OUT THE INVENTION

Next, an embodiment in which the present invention is applied to a network access router will be described in detail with reference to the drawings.

Referring to FIG. 1, one embodiment of the present invention includes three types of networks: a LAN-A1, an access network C1, and target networks D1 and D2. LAN—A1 is connected to one or more LAN nodes including terminal All. LAN—A network access router B1 is located between A1 and the access network C1, and nodes in the LAN connect to the target networks Dl and D2 via the communication tunnels Btl and Bt2, respectively, where the network access router B1 is also established. To communicate. Access servers Dll and D21 are arranged between the access network C1 and the target networks Dl and D2, respectively, and terminate a communication tunnel established with the network access router B1. If the access network C1, which consists only of the target networks Dl and D2, is also an IP network, the nodes in the LAN can communicate with the access network C1 as one of the target networks.

[0029] In the following, it is assumed that access network C1 is also an IP network, and that a node in the LAN communicates with a node in access network C1. In addition, the description will be made assuming that the access network C1 and the target networks Dl and D2 are IPv6 networks, and RAN-A1 is an IPv4ZlPv6 dual network.

The access servers Dll and D21 are installed at the boundaries between the target networks Dl and D2 and the access network C1, respectively, and the communication tunnels Btl and Btl, which are established with the network access router B1, respectively. Terminate each of Bt2. These communication tunnels are used when the nodes in the LAN A1 under the network access router BUS and the nodes in the target networks Dl and D2 communicate. Examples of the communication tunnel include PPPoE (Point-to-Point Protocol over Ethernet (registered trademark)), L2TP, and IPsec.

Terminal All is a node in LAN-A1 that communicates with nodes in access network CI and target networks Dl and D2, examples of which include PCs (Personal Computers), mobile terminals, workstations, and IP telephones. Can be In addition, network devices such as routers and network switches are also given as examples. Hereinafter, the terminal All including such nodes will be described.

The terminal All has, as an IP address, an IPv6 address for communication with the access network C1 and the target networks Dl and D2, as well as an IPv4 address used in the LAN-A1. This IPv4 address may be set manually by the user of the terminal All, or may be obtained using the DHCP (Dynamic Host Configuration Protocol) function provided by the network access router B1 or another server. Terminal All must have its own IPv6 address to communicate with access network C1 and target networks Dl and D2. In this embodiment, three IPv6 addresses assigned from each network are assigned to one physical interface by the following method.

(1) IPv6 address of access network C1: Allocated on a physical interface. This IPv6 address is issued by RA or DHCPv6 from network access router B1. The IPv6 address assigned here is in the range of the IP address prefix assigned from the access network C1 to the network access router B1 by the PD method.

(2) IPv6 addresses of target networks Dl and D2: Allocated on the tunneling interface created on the physical interface of terminal All. The user of the terminal All connects to the Web server section Bl 1 of the network access router B1 and executes a script provided from the Web server section Bl 1 to execute a tunneling interface on the physical interface of the terminal All. Create a face, assign addresses to the tunneling interface, and set up the routing table. By creating tunneling interfaces for the number of IPv6 addresses that need to be assigned, Communication can be performed.

[0033] Examples of the tunneling interface set in the terminal Al 1 in the method (2) include an IPv6 over IPv4 tunneling interface, an IPsec tunneling interface, and a PPTP (Point-to-point). -Point Tunneling Protocol). In particular, the IPv6 over IPv4 tunneling interface can be generally used as a protocol for transferring IPv6 packets on an IPv4 network, and is widely used today. (Registered trademark) XP is also provided as a standard function.

[0034] The network access router B1 has a Web server section B11, a target network connection setting section B12, a routing table B13, an interface driver section B14, a WAN interface B15, and a LAN interface B16. In addition, LAN—DHCP server function for assigning IPv4 addresses to nodes in A1; RA function for assigning IPv6 addresses; tunnel setting for establishing a communication tunnel to access servers DLL and D21 Although functions and the like are provided, general functions of these network access routers are well-known and need not be described, and only the features characteristic of the present invention will be described in detail.

[0035] The Web server unit B11 transmits HTTP (Hyper Text Transfer Protocol: a name of a protocol used for exchanging HTML contents and other Web contents between the Web server and the Web browser) from the terminal A11. And displays setting information and a setting change screen for the network access router B1 on the browser of the terminal All. The web server unit B11 executes the terminal Al 1 in response to a connection request from the terminal All to the target networks Dl and D2 so that the terminal Al 1 can communicate with the target networks Dl and D2. Provide the configuration script to be done. The setting script is for creating a tunneling interface, assigning an address to the tunneling interface, and setting a routing table in the terminal All.

The terminal All executes these scripts by using the Web server unit B11 to specify the link tally on the browser screen of the terminal All or by directly specifying a URL (Universal Resource Locator). Web server B11 is the target network from terminal All. As long as it has a function of accepting a connection request for Dl and D2 and responding to the request with a setting script to the terminal All, it is possible to substitute a function other than the Web. The following description is based on the assumption that the Web is used as a protocol that can be used universally by the terminal All.

The target network connection setting unit B12 has a setting function for allowing the terminal All to communicate with the target networks D1 and D2 via the network access router B1 without performing NAT. This setting function includes a setting function for the terminal All and a setting function for the network access router B1 itself. As described above, the setting for the terminal All is performed by causing the terminal Al 1 to execute the setting script via the Web server unit Bl 1. The target network connection setting unit B12 includes, as its components, a target network connection policy management unit B121, an interface setting unit B122, a routing setting unit B123, and a terminal setting script generation unit B124.

[0037] The target network connection policy management unit B121 manages parameters required for setting in the network access router B1 and the terminal Al1 for enabling communication between the terminal All and the target networks Dl and D2. Being done.

The interface setting unit B122 makes settings for the interface driver unit B14 so that it can communicate with the target networks Dl and D2 via the network access router B1 without performing NAT. Specifically, in order to allow communication between the terminal All and the target networks Dl and D2 to pass through a communication tunnel in a section between the terminal Al 1 and the network access router B1, the LAN of the network access router B1 is used. A request is made to interface B16 to create a tunneling interface that terminates this communication tunnel. The parameters required for the setting are obtained from the target network connection policy management unit B121.

[0038] However, when a client-server type communication tunnel such as PPP or IPsec is used between the terminal All and the network access router B1, each of the communication tunnels in the LAN interface B16 of the network access router B1. It is possible to accommodate multiple communication tunnels with one tunneling interface without the need to create a tunneling interface. The following is the IPv6 over IPv4 tunneling protocol In the case of using a peer-to-peer type communication tunnel (a network in which computers do not have a master-slave relationship and perform equal communication without a master-slave relationship), it is necessary to create a tunneling interface for each communication tunnel as in explain.

[0039] The routing setting unit B123 makes settings in the routing table B13 in order to communicate with the target networks D1 and D2 via the network access router B1 without performing NAT. Specifically, an entry is added to transfer the packet transferred from the target networks Dl and D2 to the terminal All on the corresponding communication tunnel set from the network access router B1 to the terminal Al1. The parameters required for this setting are acquired from the target network connection policy management unit B121.

The terminal setting script generation unit B124 should be executed in the terminal All in order to communicate with the target networks Dl and D2 via the network access router B1 without performing NAT. Generate a script and pass it to the Web server. Specifically, the creation of a tunneling interface in the terminal A11, the assignment of an address on the tunneling interface, and the setting of a routing table are mentioned. The parameters required for creating the setting script are acquired from the target network connection policy management unit B121.

[0040] The routing table B13 is a table storing IP routing setting information in the network access router B1. The routing table B13 can set an entry from the routing setting unit B123.

The interface driver section B14 manages an interface in the network access router B1. Upon receiving the request from the interface setting unit B 122, the interface driver unit B14 actually performs creation Z deletion of the tunneling interface and setting of parameters in the tunneling interface.

[0041] The WAN interface B15 is a physical interface on the WAN side in the network access router B1. The network access router B1 is connected to the access network C1 by a link provided by the WAN interface B15. The WAN interface B15 includes tunneling interfaces B151 and B152 as virtual interfaces for a communication tunnel established on a link to be provided. Here, the tunneling interfaces B151 and B152 are respectively the communication tunnels Btl and B152. This is a virtual interface for establishing t2, and is used for communication with target networks Dl and D2. The WAN interface B15 can have an arbitrary number of tunneling interfaces according to the number of target networks to which the network access router B1 connects.

[0042] The LAN interface B16 is a physical interface on the LAN-A1 side in the network access router B1. Network access router B1 is connected to LAN-A1 by a link provided by LAN interface B16. Here, the tunneling interfaces B161 and B162 are virtual interfaces for establishing a communication tunnel between the terminal Al and the network access router B1, and the terminal Al and the target network Dl and B1, respectively. Used to communicate with D2. The LAN interface B16 can have any number of tunneling interfaces according to the number of LAN nodes connected to the network access router B1 and the number of target networks connected to the LAN nodes. It is.

Next, referring to FIG. 2 to FIG. 10, in the present embodiment, in order to realize communication between terminal All and target networks D 1 and D 2 without performing NAT in network access router B 1. Next, the operation performed by the network access router B1 will be described in detail.

In an initial state, the network access router B1 is directly connected to the access network C1 by the WAN interface B15, and the communication tunnels Btl, B2 to the target networks Dl, D2 by the tunneling B151, B152, respectively. Connected via Bt2.

FIG. 2 is a diagram showing a target network connection operation in the network access router according to one embodiment of the present invention. FIG. 3 is a diagram showing an interface list in the network access router according to one embodiment of the present invention. FIG. 4 is a diagram showing a routing table in the network access router according to one embodiment of the present invention. FIG. 5 is a diagram showing an interface list in a terminal in a LAN according to an embodiment of the present invention. FIG. 6 is a diagram showing a routing table in a terminal in a LAN according to an embodiment of the present invention. FIG. 7 is a diagram showing a message sequence according to one embodiment of the present invention. FIG. 8 is a diagram showing a target in the network access router according to one embodiment of the present invention. FIG. 9 is a diagram showing a network connection policy table. FIG. 9 is a diagram showing a setting script created by the network access router according to one embodiment of the present invention. FIG. 10 is a diagram showing a packet format according to an embodiment of the present invention.

The interface list 101 and the routing table 102 shown in FIG. 3 and FIG. 4 respectively show the state of the network interface in the network access router B1 and an example of the routing table B13. In the initial state, only the 114th entry of the interface list 101 exists.

[0046] In the first entry, an IPv4 address, an IPv6 address, and an alias address in the LAN interface B16 are registered. Here, the alias address is not necessarily required depending on the type of the protocol of the communication tunnel used between the terminal A 11 and the network access router B1, but the IP address based on the identification of the communication tunnel such as an IPv6 over IPv4 tunnel is used. (In the case of IPv6 over IPv4 tunnel, the source IP address of the IPv4 header and the Z destination IP address) This may be necessary if a protocol is used.

[0047] In the second entry, the IPv6 address of WAN interface B15 is registered.

[0048] The third entry and the fourth entry indicate the settings of the tunneling interfaces B151 and B152 on the WAN interface B15, and both are communication tunnels based on the IPsec protocol. The base address (in this case, the IPv6 address in the outer header) is shown. For example, in the case of the third entry, 2001: c90: 0: 2: 200: 9alF: febc: deiD (network access It shows that an IPsec tunnel has been established between router B1's IPv6 address) and 2001: c90: 1: 0 :: 1 (IPv6 address of access server Dl 1). In the routing table 102, only the first to sixth entries exist in the initial state.

[0049] The first entry and the second entry are entries for forwarding an IPv4 packet and an IPv6 packet to LAN-A1 to the LAN interface B16 side, respectively.

[0050] The third entry and the fourth entry are entries for transferring an IPv6 packet to access network C1 to WAN interface B15. [0051] The fifth entry and the sixth entry are entries for transferring IPv6 packets to the target networks Dl and D2 via the communication tunnels Btl and Bt2 via the interfaces B151 and B152, respectively. is there. In the initial state, the terminal All is assigned from the network access router B1 an IPv4 address used in the LAN-A1 by DHCP or other means, and an IPv6 address issued from the access network C1. Assigned by RA, DHCPv6 or other means. Allocation of these IP addresses is performed when terminal Al 1 connects to LAN—A1. IPv4 communication with nodes in LAN—A1 using the assigned IPv4 address, and assigned IPv6 address It is possible to perform IPv6 communication with LAN-Al nodes and access network C1 using LAN.

FIG. 5 and FIG. 6 show examples of the interface list 201 and the routing table 202 in the terminal All, respectively. In the initial state, only the first entry exists in the interface list 201, and an IPv4 address and an IPv6 address are respectively assigned to ethO indicating the physical interface of the terminal Al1! /. Also, only the 113rd entry exists in the routing table 202, and the routes for the IPv4 packet and the IPv6 packet are registered respectively.

FIG. 7 shows an example of a message sequence between the terminal All and the network access router B1 after the terminal All has connected to the LAN-A1 under the network access router B1. In this case, the terminal A1 obtains an IPv4 address by DHCP (step S201 in FIG. 7) and obtains an IPv6 address by RA (step S202), thereby performing IPv4 communication with a node in the LAN—A1, and in the LAN—A1. IPv6 communication with nodes and access network C1 is now possible.

In the initial state, the IPv6 address allocated from the target networks Dl and D2 is not yet assigned to the terminal A11, so the terminal All uses the IPv6 address allocated and allocated from the target networks Dl and D2. It cannot communicate with the target networks Dl and D2. For this reason, the terminal All uses a browser to make an HTTP connection to the network access router B1 to open a target network connection setting Web screen so that it can communicate with the target networks Dl and D2. [0054] In the target network connection policy management unit Bl21, the network access router B1 and the network access router B1 for enabling communication between nodes in the LAN A1, including the terminal All, and the target networks Dl, D2. It is assumed that setting parameters are managed as parameters necessary for setting in the terminal All, as in the example shown in the target network connection policy table 201 shown in FIG. Referring to the target network connection policy table 201, the target network D1 is connected via the ipsecO tunneling interface of the network access router B1, and the supported IP address scope (a node in the LAN—A1 is connected to the target D1). It indicates that the destination IP address range of the IP packet to be forwarded is:: 0 (that is, the default route). The IP address prefix assigned from the target network D1 is 2001: 218: 0: 1 :: / 64, and IP addresses in this range can be assigned to nodes in LAN-A1.

[0055] It is shown that the IP packet transferred between the target network D1 and the node in the LAN is transferred by an IPv6 over IPv4 tunnel between the network access router B1 and the node in the LAN—A1. However, it is shown that the base address (in this case, the IPv4 address in the outer header) of the local side (the network access router B1 side) in the IPv6 over IPv4 tunnel is 192.168.0.254. The setting for the target network D2 is also shown. The setting in the target network connection policy table 201 may be performed by the administrator of the network access router B1, or may be performed when the communication tunnels Btl and Bt2 from the network access router B1 to the access servers Dll and D21 are set. It may be automatically obtained from Dll and D21. As a protocol for automatically obtaining such parameters from the access servers Dll and D21, IPsec [7, Internet Security Association and Key Management Protocol (ISAKMP) Configuration Method, IPCP ( IP Control Protocol).

[0056] The Web server unit Bl l of the network access router Bl uses the HTTP message (for example,

http: すると When an HTTP GET message to www.cpe.myhome / connect.html is received (step S101 in Fig. 2), the Web server B11 connects to the terminal All via the target network. Responds with an HTTP message for displaying the Web screen for setting (step S102). An example of the displayed Web screen is shown in Web screen 401 in FIG.

FIG. 11 is a diagram showing a Web screen displayed by the network access router according to one embodiment of the present invention.

A link for making a target network connection setting request is pasted on the target network connection setting Web screen, as in the “connection” button in the screen 401 in FIG. 11, and the user of the terminal A11 connects this link. When clicked, Web server B11 receives a target network connection setting request from terminal All as an HTTP message (step S103).

Upon receiving the target network connection setting request in step B103, the Web server unit issues various settings to the target network connection setting unit B12 so that the terminal All can communicate with the target networks Dl and D2. Ask to do. First, the target network connection setting unit B12 passes communication between the terminal All and the target networks Dl and D2 via the interface setting unit B122 in a section between the communication terminal All and the network access router B1. A tunneling interface is set on the LAN interface B16 for the communication tunnel (step S104).

[0058] This tunneling interface is created by the number of target networks with which the terminal All communicates. In this setting, the setting parameters managed in the target network connection policy management unit B121 are used. For example, when the target network connection policy 201 shown in FIG. 8 is managed, the tunneling interfaces (sitO and sitl) corresponding to the fifth and sixth entries are added to the interface list shown in FIG. Will be done. The tunneling interface sitO is used for communication between the target network D1 and the terminal All, and the tunneling interface sitl is used for communication between the target network D2 and the terminal All. In this example, IPv6 over IPv4 is used as a tunneling protocol, and the IPv4 addresses of the network access router B11 and the terminal All are registered as optional parameters as base addresses.

[0059] Here, when IPv6 over IPv4 is used, the base address of the same tunneling interface is used as the base address of the network access router B11 and the IPv4 address of the terminal All. Since the combination must not be the same (since each IPv6 over IPv4 tunnel is identified by a base address), an alias address of 192.168.0.0.253 is used as the base address of one network access router B11. Note that is used.

Next, the target network connection setting unit B12 sets a routing table via the routing setting unit B 123 (Step S105). For example, when the target network connection policy table 201 shown in FIG. 8 is managed, a seventh entry and an eighth entry are added to the routing table 102 shown in FIG. In a later step S107, a script responding to the terminal Al1 creates a tunneling interface on the LAN interface B16 of the terminal Al1, and creates target networks Dl and D2 on the tunneling interface. IPv6 Address Assignment These entries specify the route for packets destined for the assigned IPv6 address. For example, the seventh entry is for an IPv6 packet addressed to 2001: 218: 0: l: 200: 4cff: fe23: 9ed2, which is an IPv6 address assigned to terminal All to communicate with target network D1. The network access router B1 !! designates transmission from the tunneling interface sitO. As a result, the terminal All can receive the IPv6 packet transmitted from the target network to the terminal All with the tunneling interface power corresponding to the target network.

When the settings of the tunneling interface and the routing table are performed in steps S104 and S105, the state becomes the state of step S203 in FIG. 7, and the target network connection setting unit B 12 next executes the terminal Al 1 A setting script to be performed is created by the terminal setting script generation unit B124 (step S106). Here, the setting parameters managed by the target network connection policy management unit B121 are used when creating the setting script, and the tunneling interface necessary for connecting to the target networks Dl and D2 at the terminal All. A script is created to create a network, assign addresses to the tunneling interface, and set up routing tables.

[0062] After step S106, the target network connection setting unit B12 passes the setting script created in step S106 to the web server unit B11, and the web server unit B11 sends the received setting script. A response to the terminal is sent to the terminal All (step S107). This setting script is responded as a response message to the target network connection setting request received in step S103. After step S107, the configuration script responded to at the terminal All is executed to create a tunneling interface at the terminal All, assign an address on the tunneling interface, and edit a routing table. The settings are made. However, from the viewpoint of security, general browsers do not allow the browser to automatically execute a script that sets the tunneling interface on the terminal All. Therefore, the following example will be described as a method that can be universally used to cause the terminal Al 1 to execute the setting script.

[0063] A link for performing a target network connection setting request placed on the Web screen displayed in step S102 is linked to the setting script (for example,

http: 〃 Link to www.cpe.myhome / connect.bat) (the setting script may not be generated at this time), and sends the target network connection setting request in step S103 to the HTTP for acquiring the setting script. Send it as a request. In a typical browser, when the response to the request for the script file is returned, the browser opens a dialog "Please select the file opening or file download method to your computer". 1S "Open" here By selecting, the setting script can be executed on the terminal All.

The setting script 301 shown in FIG. 9 is a setting created by the terminal setting sta- bile generation unit B124 when the target network connection policy table 201 shown in FIG. 8 is managed by the target network connection policy management unit B121. It is an example of a script. The first to third lines are commands for creating a tunneling interface corresponding to the target network D1, assigning an address on the tunneling interface, and setting a routing table. Lines 6 to 6 are commands for creating the tunneling interface corresponding to the target network D2, assigning addresses to the tunneling interface, and setting the routing table.

[0065] Here, in the second and fifth lines, the lower 64 bits of the IPv6 address to be allocated are determined using the MAC address of the physical interface in terminal Al1 according to the EUI-64 standard. It may be automatically generated according to the rules, or an arbitrary value may be assigned so as not to overlap with other LAN-A1 nodes. When the MAC address is automatically generated using the MAC address, there is an advantage that the network access router B1 does not need to perform address duplication management at! /. In the seventh line, the route to the access network C1 automatically set by the RA in the routing table of the terminal All (in the RA, :: / 0 (default route) is automatically set) is accessed. This is used to change the route to the IP address scope of network C1. In the command on the seventh line, since ::: 0 is specified as the route to the target network D1, the route to the access network C1 is overwritten by the setting of the routing table for the target network D1. This is not necessary if the route to the access network C1 is not overwritten by the setting of the routing table for the target networks Dl and D2, which is necessary for the operation of re-designating the route to the network C1.

The terminal Al 1 executes the setting script responded to the terminal Al 1 in step S 107, creates a tunneling interface on the terminal Al 1, and creates an IP on the tunneling interface. When the address assignment and the setting of the routing table are successful, the state of the network interface in the terminal All becomes a state in which the second entry and the third entry are added to the interface list 201 in FIG. . Tunneling interfaces sitO and sitl are used to communicate to the target networks Dl and D2, respectively. Further, the routing table B13 is in a state where the fourth-sixth entry is added to the routing table 202 of FIG.

The fourth entry is to overwrite the IPv6 default route issued by the RA to the target network D1 instead of the access network C1. Here, overwriting can be realized by making the metric of the newly registered default route smaller than the metric of the third entry, which is the default route automatically registered by the RA. The fifth entry registers the route of the IPv6 packet destined for access network C1 overwritten by the fourth entry, specifying the destination IPv6 address prefix. The sixth entry specifies the route of the IPv6 packet destined for the target network D2. [0068] The setting script responded in step S107 includes a script that returns to the Web server section Bl1 a notification of whether or not the setting has been successful at the terminal All (the setting script 301 in FIG. 9). (Lines 8 to 12) After executing the setting script, the terminal All notifies the Web server B11 of the success or failure of the power. This notification can be realized by making an HTTP request to a different URL depending on the success or failure of the setting stab. For example, if successful, an HTTP request to http: \ www.cpe.myhome / success.html is made; if unsuccessful, an HTTP request to http: \ www.cpe.myhome / failure.html is made. Then, when an HTTP request to http: www.cpe.myhome / success.html is received, the web server unit B11 responds to the terminal All with a web screen indicating that the connection to the target network has been successfully made. (Steps S108 and S109), http: 〃 If an HTTP request to www.cpe.myhome / failure.html is received, respond to the Web screen indicating that connection to the target network has failed. (Steps S108, S110). Further, when notified that the execution of the setting script has failed at the terminal All, the Web server unit B11 notifies the target network connection setting unit B12 of the information. Upon receiving this notification, the target network connection setting unit B12 deletes the setting of the tunneling interface and the setting of the routing table performed in steps S104 and S105 (step S111).

If connection to the target network succeeds after step S109, the state of step S204 in FIG. 7 is established, and the terminal All becomes communicable with the target networks Dl and D2. FIG. 10 shows an example of a packet format corresponding to each case when communicating with the terminal A11, the node C11 in the access network C1, the node D12 in the target network D1, and the node D22 in the target network D2. In this example, an IP sec tunnel is used between the network access router B1 and the access routers Dll and D12 to enable communication between the terminal All and the target networks Dl and D2. In this case, an IPv6 IPv4 tunnel is used between the network access router B1 and the network access router B1.

[0070] The operation performed by network access router B1 to enable terminal All to communicate with target networks Dl and D2 in the present embodiment has been described above. The above operation is a setting that enables communication between the terminal All and the target networks Dl and D2. However, there is an operation for restoring the setting and disconnecting the communication between the terminal All and the target networks Dl and D2. This operation needs to be performed when the terminal All leaves the LAN A1 or when communication with the target networks Dl and D2 becomes unnecessary. FIG. 11 shows the operation of the target network disconnection setting based on the request from the terminal All in the network access router B1. The terminal All uses a browser to make an HTTP connection to the network access router B1 to open the target network disconnection setting Web screen, and presses the “disconnect” button on the Web screen 401 in FIG. Disconnect communication with Dl and D2.

FIG. 12 is a diagram showing a target network disconnection operation in the network access router according to one embodiment of the present invention.

The operations of steps S301—S310 shown in FIG. 12 correspond to steps S101—S110 shown in FIG. 2, respectively, and detailed descriptions are omitted, but the settings for connection performed in steps S101—S110 are The operation of deleting and returning to the original state is performed. Step S301—When the target network disconnection setting is completed by the operation of S3 10, the state of step S205 in FIG. 7 is set to the network access router B1, and the state of step S205 in FIG. State, and the terminal All cannot communicate with the target networks Dl and D1.

Hereinafter, other possible embodiments of the present embodiment will be described together.

In the above-described embodiment, media for carrying IP packets between the terminal All and the network access router B1 are used in accordance with the network to which the communication partner node of the terminal All belongs. That is, when the terminal All communicates with the access network C1, the IP packet is directly carried over a data link such as Ethernet (registered trademark), and when the terminal All communicates with the target networks Dl and D2, IP packets were carried over the corresponding communication tunnel. In addition, when the terminal All communicates with the target network D1, the IP packet is carried directly over a data link such as Ethernet (registered trademark), and the terminal All is connected to the access network Cl and the target network D2. When communicating with, a form that allows IP packets to be carried over the corresponding communication tunnel is also conceivable.

[0073] Also, the case where the access network Cl and the target networks Dl and D2 are IPv4 networks described as being IPv6 networks is applicable. In this case, the terminal All and the network access Examples of the communication tunnel used between the router S1 and the router B1 include PPPoE, IPsec, and IPv4 over IPv4 tunneling protocol.

Next, effects of the present embodiment will be described.

In the present embodiment, network access router B1 receives a request from terminal All, which is a node in LAN-A1, for terminal All to access target networks D1 and D2, and responds to this request by its own router. Creates a tunneling interface on the LAN interface B16, and forwards packets destined from the target networks Dl and D2 to the terminal All over the corresponding communication tunnel between the own router and the terminal All Set the routing table B 13 so that Further, the network access router B1 transmits the packet between the terminal All and the target networks Dl and D2 to the terminal Al 1 so that the packet is transmitted through the corresponding communication tunnel between the own router and the terminal All. A script that creates the tunneling interface used for communication with each target network, pays the target network to the tunneling interface from each target network, assigns the issued IP address, and sets the routing And the terminal All executes the script, thereby enabling communication between the terminal A11 and the target networks Dl and D2 without performing NAT on the way.

[0075] In the communication between a node in the LAN and a plurality of target networks, the LAN-A1 node realizes each target network using the assigned IP address and without performing NAT on the way. Has been impossible in the past, but by using the network access router B1 provided in the present embodiment, the packet between the LAN node and the target network node is not NATed on the way, However, it is possible to select the source IP address according to the target network to be used and communicate with nodes in the target network.

In the present embodiment, the power described in the case of the network access router is applicable to a network access method, a network access router program, and a recording medium that are not limited thereto.

That is, the present invention is a network access method that enables communication between a node connected to a subordinate LAN and one or more target networks, which are target networks to be accessed by the node. Establish a communication tunnel between the node and the router in the section between the node and the router, and establish a communication tunnel between the node and one or more of the target networks. May be transferred over the communication tunnel.

[0077] Further, the present invention provides a network access router that enables communication between a node connected to a subordinate LAN and one or more target networks that are the target networks to be accessed by the node. In a method, in a section between a node and the network access router itself, a packet corresponding to communication between the node and the target network is transmitted by the node to establish a different communication tunnel according to the target network. You can use and transfer.

[0078] The present invention also provides a network access router program that enables communication between a node connected to a subordinate LAN and one or more target networks that are nodes to be accessed by the node. In the target network connection setting section, a procedure A for establishing a communication tunnel between the node and the own router in a section between the node and the own norator, and one of the node and the target network. The procedure B in which a packet corresponding to the above communication is transferred to the communication tunnel may be executed.

[0079] Further, the present invention provides a program for a network access router that enables communication between a node connected to a subordinate LAN and one or more target networks that are networks to be accessed by the node. The target network connection setting unit establishes, in the section between the node and the network access router itself, a procedure α for establishing a different communication tunnel according to the target network with which the node is communicating, α, And the procedure j8 of transferring the packet corresponding to the communication between the different communication tunnels.

[0080] Further, the present invention provides a program for a network access router that enables communication between a node connected to a subordinate LAN and one or more target networks that are networks to be accessed by the node. The procedure A for establishing a communication tunnel between the node and the own router in the section between the node and the own router in the target network connection setting unit, Record a program that executes Step B to transfer a packet corresponding to communication with at least one of the target networks over a communication tunnel.

[0081] Further, the present invention provides a network that enables communication between a node connected to a subordinate LAN and one or more target networks that are nodes to be accessed by the node. A storage medium that stores the access router program, and establishes a different communication tunnel in the target network connection setting unit in the section between the node and the network access router itself according to the target network with which the node is communicating. A program for executing the procedure α and the procedure j8 of transferring a packet corresponding to communication between the node and the target network using a different communication tunnel may be recorded.

Here, examples of the recording medium include an HDD (hard disk driver), a CDROM, a flexible disk, and a semiconductor memory.

Brief Description of Drawings

FIG. 1 is a block diagram showing a configuration of an embodiment of the present invention.

FIG. 2 is a diagram showing a target network connection operation in a network access router according to one embodiment of the present invention.

FIG. 3 is a diagram showing an interface list in a network access router according to an embodiment of the present invention.

FIG. 4 is a diagram showing a routing table in the network access router according to one embodiment of the present invention.

FIG. 5 is a diagram showing an interface list in a terminal in a LAN according to an embodiment of the present invention.

FIG. 6 is a diagram showing a routing table in a terminal in a LAN according to an embodiment of the present invention.

FIG. 7 is a diagram showing a message sequence according to an embodiment of the present invention.

FIG. 8 is a diagram showing a target network connection policy table in the network access router according to one embodiment of the present invention.

FIG. 9 is a diagram showing a setting script created by the network access router according to one embodiment of the present invention.

FIG. 10 is a diagram showing a packet format according to an embodiment of the present invention.

[Figure 12] Network access router B1! /, Based on request from terminal Al 1! /, It is a figure which shows operation | movement of a get network disconnection setting.

Explanation of symbols

Al LAN

All terminal

B1 Network Access Router

Bl l Web server

B12 Target network connection setting section

B121 Target Network Connection Policy Management Unit

B122 Interface settings 咅 ^

B123 Routing setting section

B124 Terminal setting script generator

B13 routing table

B14 Interface Dryno 咅 ^

B15 WAN interface

B16 LAN interface

B151, B152, B161, B162

Btl, Bt2 communication tunnel

C1 access network

C11 Access Network Node

Dl, D2 target net

D11, D21 access server

D12, D22 Node in target network

101, 201 interface list

102, 202

103 Target network connection policy table

301 Configuration Script

401 Web screen

Claims

The scope of the claims

[1] A network access router that enables communication between a node connected to a subordinate LAN and one or more target networks that are networks to be accessed by the node,

In a section between the node and the network access router itself, a packet corresponding to communication between the node and one or more of the target networks is transmitted between the node and the network access router itself. A network access router that transfers data over a communication tunnel established between the routers.

[2] The network access router according to claim 1, wherein the communication tunnel is established by causing the node to execute a setting script provided to the node by the network access router itself.

[3] A network access router that enables communication between a node connected to a subordinate LAN and one or more target networks which are networks to be accessed by the node,

In a section between the node and the network access router itself, a packet corresponding to communication between the node and one or more of the target networks is transmitted between the node and the network access router itself. A network access router comprising: a target network connection setting unit configured to perform a setting in the network access router itself and a setting in the node in order to transfer the data on a communication tunnel established between the nodes.

[4] The communication tunnel according to claim 3, wherein the communication tunnel is individually set for the target network with which the node communicates in a section between the node and the network access router itself. Network access router.

[5] The target network connection setting unit transmits a packet corresponding to communication between the node and at least one of the target networks in a section between the node and the network access router itself. A router get network connection for holding parameters necessary for setting in the network access router itself and the node for transferring over a communication tunnel established between the node and the network access router itself. Policy management department,

An interface setting unit for setting a tunneling interface for a LAN-side interface in the network access router itself;

A routing setting unit for setting an entry for a routing table in the network access router itself;

The network access router according to claim 3, further comprising: a setting script creating unit that creates a setting script to be executed by the node to establish the communication tunnel.

[6] To the node! The configuration script that is executed to establish the communication tunnel includes: at the node, creating a tunneling interface that terminates the communication tunnel;

Assigning an IP address corresponding to the target network connected via the communication tunnel on the tunneling interface;

The network access router according to claim 5, further comprising a command corresponding to setting of a routing table for passing a packet to the target network through the corresponding communication tunnel.

[7] The IP address assigned to the created tunneling interface and corresponding to the target network connected via the communication tunnel is an IPv6 address, and the lower 64 bits of the IPv6 address are assigned. 7. The network access nolator according to claim 6, wherein the network access nolator is automatically generated from a MAC address of a physical interface of the node.

[8] In the setting of a routing table for passing a packet to the target network through the corresponding communication tunnel, the default route automatically set in advance by DHCP or RA at the node is set as 8. The network access router according to claim 6, wherein the network access router is overwritten by specifying a metric having a value smaller than the metric of the automatically set default route, and passes through the communication tunnel as a default route.

[9] The communication tunnel uses an outer header such as an IPv6 over IPv4 tunneling protocol. A protocol for identifying the communication tunnel by an IP address in the network access router, and in order to use a plurality of the communication tunnels between the node and the network access router itself, the LAN interface of the network access router itself is used. 9. The method according to claim 3, wherein an alias address is used, and an IP address of the network access router itself in an outer header of the communication tunnel is used and separated according to the communication tunnel. Network access router as described in section.

[10] A network access router that enables communication between a node connected to a subordinate LAN and one or more target networks that are networks to be accessed by the node,

Providing a web screen for accepting a communication request from the node between the node and at least one of the target networks;

The node makes a communication request between the node and one or more of the target networks with respect to the Web screen, thereby allowing the node to communicate with one or more of the target networks. A network access router characterized by enabling communication of a network.

[11] A network access router that enables communication between a node connected to a subordinate LAN and one or more target networks, which are networks to be accessed by the node,

In a section between the node and the network access router itself, packets corresponding to communication between the node and the target network are transmitted through different communication tunnels depending on the target network with which the node is communicating. A network access router characterized in that it is used for forwarding.

[12] An access method of a network access router that enables communication between a node connected to a subordinate LAN and one or more target networks which are networks to be accessed by the node. ,

In a section between the node and the network access router itself, a communication tunnel is established between the node and the network access router itself, and a communication tunnel is established between the node and one or more of the target networks. Packet corresponding to the communication of An access method of a network access router that transfers data over a communication tunnel.

[13] An access method of a network access router that enables communication between a node connected to a subordinate LAN and one or more target networks which are networks to be accessed by the node. ,

In a section between the node and the network access router itself, packets corresponding to communication between the node and the target network are transmitted through different communication tunnels depending on the target network with which the node is communicating. An access method of a network access router, characterized in that the access method is used for forwarding.

[14] A program for a network access router that enables communication between a node connected to a subordinate LAN and one or more target networks which are networks to be accessed by the node,

The target network connection setting unit, in a section between the node and the network access router itself, a procedure A for establishing a communication tunnel between the node and the network access router itself; A program for transmitting a packet corresponding to communication with at least one of the target networks over the communication tunnel.

[15] A network access router program that enables communication between a node connected to a subordinate LAN and one or more target networks that are networks to be accessed by the node,

A procedure α for establishing a different communication tunnel according to the target network with which the node is communicating in a section between the node and the network access router itself, A program for transferring a packet corresponding to communication between target networks using the different communication tunnel.

[16] A record that records a program of a network access router that enables communication between a node connected to a subordinate LAN and one or more target networks that are the target networks to be accessed by the node. A medium, The target network connection setting unit, in a section between the node and the network access router itself, a procedure A for establishing a communication tunnel between the node and the network access router itself; A recording medium recording a program for executing a step B of transferring a packet corresponding to communication with at least one of the target networks over the communication tunnel.

A storage medium storing a program of a network access router that enables communication between a node connected to a subordinate LAN and one or more target networks that are networks to be accessed by the node. hand,

A procedure α for establishing a different communication tunnel according to the target network with which the node is communicating in a section between the node and the network access router itself, A recording medium for recording a program for executing a procedure j8 of transferring a packet corresponding to communication between target networks using the different communication tunnel.