WO2014110912A1 - 访问局域网中隔离区主机的方法和装置 - Google Patents

访问局域网中隔离区主机的方法和装置 Download PDF

Info

Publication number
WO2014110912A1
WO2014110912A1 PCT/CN2013/083642 CN2013083642W WO2014110912A1 WO 2014110912 A1 WO2014110912 A1 WO 2014110912A1 CN 2013083642 W CN2013083642 W CN 2013083642W WO 2014110912 A1 WO2014110912 A1 WO 2014110912A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
host
wan side
public
quarantine
Prior art date
Application number
PCT/CN2013/083642
Other languages
English (en)
French (fr)
Inventor
毕明达
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US14/651,845 priority Critical patent/US10171418B2/en
Priority to EP13871858.0A priority patent/EP2922253A4/en
Publication of WO2014110912A1 publication Critical patent/WO2014110912A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2514—Translation of Internet protocol [IP] addresses between local and global IP addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2854—Wide area networks, e.g. public data networks
    • H04L12/2856—Access arrangements, e.g. Internet access
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2854—Wide area networks, e.g. public data networks
    • H04L12/2856—Access arrangements, e.g. Internet access
    • H04L12/2869—Operational details of access network equipments
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/668—Internet protocol [IP] address subnets
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones

Definitions

  • the present invention relates to the field of broadband network technologies, and in particular, to a method and system for accessing an isolated area host in a local area network.
  • the main object of the present invention is to provide a method and system for accessing an quarantine host in a local area network, which aims to improve the utilization efficiency of the IP address on the WAN side and provide greater convenience for access on the WAN side.
  • the present invention provides a method for accessing an quarantine host in a local area network, including:
  • the destination IP address in the access request is modified to be the private network IP address of the corresponding quarantine host on the LAN side, and the modified The access request is sent to the quarantine host;
  • Receiving a reply packet returned by the host in the quarantine area, and modifying the source IP address included in the quarantine area to The public network IP address of the client on the WAN side is sent, and the modified reply message is sent to the WAN side.
  • the method before performing the mapping between the public network IP address obtained by the configuration from the WAN side and the private network IP address of the quarantine host on the LAN side, the method further includes:
  • the slot information of the public network IP address obtained from the WAN side is configured, and the slot information corresponds to the public network IP address.
  • mapping relationship between the public network IP address obtained from the WAN side and the private network IP address of the quarantine host on the LAN side is as follows:
  • mapping relationship between the public network IP address and the private network IP address is configured, or the mapping between the public network IP address and its port and the private network IP address and its port is configured.
  • the method further includes:
  • an extension tag for indicating identity is sent to the server on the WAN side;
  • the public network IP address of the server is filled into the corresponding slot information by using multiple IP addresses sent by the extended label.
  • the receiving the replies returned by the quarantine host, and modifying the source IP address contained therein to the public network IP address includes:
  • the quarantine host And receiving, by the quarantine host, a reply packet that is returned according to the access request, where the reply packet includes a destination IP address and a source IP address, where the destination IP address is an IP address of the client on the WAN side, where The source IP address is the private network IP address of the host in the quarantine area;
  • the present invention also provides an apparatus for accessing an quarantine host in a local area network, including:
  • the first configuration module is configured to: configure a mapping relationship between a public network IP address obtained from the WAN side and a private network IP address of the quarantine host on the LAN side;
  • the first modification module is configured to: after receiving the access request sent by the client on the WAN side, modify the destination IP address in the access request to be the corresponding quarantine host on the LAN side according to the configured mapping relationship. a private network IP address, and the modified access request is sent to the isolation Zone host
  • the second modification module is configured to: receive a reply message returned by the host in the quarantine, modify the source IP address included in the IPS client to the public IP address of the client on the WAN side, and modify the reply ⁇ The text is sent to the WAN side.
  • the device for accessing the quarantine host in the local area network further includes:
  • the second configuration module is configured to: store the slot information of the public network IP address obtained from the WAN side, where the slot information corresponds to the public network IP address.
  • the first configuration module is configured to:
  • mapping relationship between the public network IP address and the private network IP address is configured, or the mapping between the public network IP address and its port and the private network IP address and its port is configured.
  • the device for accessing the quarantine host in the local area network further includes:
  • the sending module is configured to: when dialing through the WAN side, send an extended label for indicating identity to the server on the WAN side;
  • the filling module is configured to: receive a plurality of IP addresses issued by the server on the WAN side by using the extended label, and fill the public network IP address into the corresponding slot information.
  • the second modification module includes:
  • the receiving unit is configured to: receive the reply packet returned by the quarantine host according to the access request, where the reply packet includes a destination IP address and a source IP address, where the destination IP address is the WAN side The IP address of the client, where the source IP address is the private network IP address of the host in the quarantine area;
  • the modifying unit is configured to: modify the source IP address to be a public network IP address of the client on the WAN side according to the configured mapping relationship.
  • the embodiment of the present invention configures a mapping relationship between the public network IP address obtained from the WAN side and the private network IP address of the host in the quarantine area on the LAN side; after receiving the access request sent by the client on the WAN side, Configure the mapping relationship, modify the destination IP address in the access request to the private IP address of the corresponding quarantine host on the LAN side, and send the modified access request to the quarantine host. Receive the reply packet returned by the quarantine host.
  • the source IP address included in the WAN side is modified to be the public IP address of the client on the WAN side, and the modified reply packet is sent to the WAN side for access by the client. Since the DMZ host is behind the CPE's NAT firewall, no configuration is required.
  • the public network address is configured to provide a private network address. This improves the security of the DMZ host and improves the utilization efficiency of the IP address on the WAN side, and provides greater convenience for access on the WAN side.
  • FIG. 1 is a schematic flowchart of a method for accessing an quarantine host in a local area network according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of another embodiment of a method for accessing a host in an quarantine area of a local area network according to the present invention
  • FIG. 4 is a schematic flowchart of a method for changing a source IP address included in a reply packet to a public network IP address in a method for accessing a host in an isolated area according to the present invention
  • FIG. 5 is a schematic structural diagram of an apparatus for accessing a host in an quarantine area of a local area network according to the present invention
  • FIG. 6 is a schematic structural diagram of another embodiment of an apparatus for accessing a host in an quarantine area of a local area network according to the present invention
  • FIG. 8 is a schematic structural diagram of a second modification module in an apparatus for accessing a host in an isolation area of a local area network according to an embodiment of the present invention
  • An embodiment of the present invention provides a method for accessing a host in an quarantine area of a local area network.
  • the client terminal device CPE obtains multiple public network IP addresses from the WAN side, and configures a public network IP address and a private network IP address of the DMZ host on the LAN side.
  • the public network IP address is mapped to the corresponding DMZ host to facilitate access by the client on the WAN side.
  • FIG. 1 is a schematic flowchart of a method for accessing an quarantine host in a local area network according to an embodiment of the present invention.
  • the method for accessing an quarantine host in a local area network includes: Step S10: The mapping relationship between the public network IP address obtained from the WAN side and the private network IP address of the quarantine host on the LAN side is configured.
  • the CPE In the SOHO office area, when the client on the WAN side accesses the DMZ host on the LAN side through the CPE, the CPE first dials through the WAN, that is, obtains an IP address from the WAN side, and the IP address includes the basic IP address and the public network IP address. . After the IP address of the public network is obtained, the mapping between the private network IP address of the DMZ host on the LAN side is configured. When the client on the WAN side accesses a DMZ host, the mapping relationship can be obtained from the WAN. The public IP address obtained by the side is mapped to the DMZ host. After the mapping is completed, the DMZ host can start working.
  • mapping between the public network IP address and the private network IP address is configured, and the mapping between the public network IP address and the private network IP address may be configured, or the public network IP address and its port may be configured.
  • the mapping between the private network ip address and its port is configured, and the mapping between the public network IP address and the private network IP address may be configured, or the public network IP address and its port may be configured.
  • Step S20 after receiving the access request sent by the client on the WAN side, according to the configured mapping relationship, modify the destination IP address in the access request to be the private network IP address of the corresponding quarantine host on the LAN side, and the modified The access request is sent to the quarantine host;
  • an access request is sent to the public network IP address of the WAN side of the CPE, and after receiving the access request, the CPE receives the public network IP address of the WAN side of the configured CPE.
  • the mapping between the destination IP address of the DMZ host and the private IP address of the DMZ host is modified, and then the access request modified with the destination IP address is sent to the DMZ host.
  • Step S30 Receive a reply message returned by the host in the quarantine, modify the source IP address included in the WAN side to the public network IP address of the client on the WAN side, and send the tampering reply message to the WAN side.
  • the DMZ host After receiving the access request with the destination IP address, the DMZ host returns a response packet to the CPE. In this case, the source IP address included in the response packet is changed to the public IP address of the client on the WAN side. Then, the reply message with the modified source IP address is sent to the WAN side for the client to access the DMZ host.
  • the mapping relationship between the public network IP address obtained from the WAN side and the private network IP address of the quarantine host on the LAN side is configured; after receiving the access request sent by the client on the WAN side, according to the embodiment, Configure the mapping relationship, modify the destination IP address in the access request to the private IP address of the corresponding quarantine host on the LAN side, and send the modified access request to the isolation.
  • the source IP address contained in the quarantine is changed to the public IP address of the client on the WAN side, and the tampered reply is sent to the WAN side. , for access by its clients.
  • the DMZ host is located behind the NAT firewall of the CPE.
  • FIG. 2 is a schematic flowchart diagram of another embodiment of a method for accessing an quarantine host in a local area network according to the present invention.
  • the method for accessing the quarantine host in the local area network of the present invention further includes:
  • Step S40 The slot information of the public network IP address obtained from the WAN side is configured, and the slot information corresponds to the public network IP address.
  • the number of slots is the same as that obtained from the WAN.
  • the IP address of the network is the same, and is the corresponding one, which is used to store the IP address of the public network.
  • the slot information can also be directly filled with the IP address of the public network.
  • FIG. 3 is a schematic flowchart of still another embodiment of a method for accessing an quarantine host in a local area network according to the present invention.
  • An embodiment of the method for accessing an quarantine host in a local area network according to the present invention after performing step S10, the method further includes:
  • Step S50 When dialing through the WAN side, send an extension label for indicating identity to the server on the WAN side;
  • Step S60 Receive the plurality of IP addresses sent by the server on the WAN side by using the extended label, and fill the public network IP address into the corresponding slot information.
  • the CPE After the WAN side client needs to access the DMZ host on the LAN side, the CPE first establishes a connection with the server on the WAN side through the access protocol, that is, dials through the WAN side.
  • the access protocol that is, dials through the WAN side.
  • the DHCP protocol can be adopted.
  • the PPP protocol establishes a connection with the server on the WAN side.
  • the DHCP protocol client of the CPE When the connection is established through the DHCP protocol, the DHCP protocol client of the CPE sends an extension label for indicating the identity to the server on the WAN side, and after the broadband access server resolves the extension label, it authenticates to the remote user dial-up authentication system, and then the DHCP server If the DHCP client is enabled to open the SOHO service, it is determined whether the IP address needs to be sent to the CPE. If the IP address is sent to the CPE, the IP address is sent to the CPE through the extended label. Address to CPE.
  • the connection When the connection is established through the PPP protocol, it has its own authentication function. It can directly authenticate to the remote user dial-up authentication system based on the user name, and determine whether the DHCP client is required to deliver the SOHO service. If the CPE is opened, the IP address is sent to the CPE through the extended label. If it is not enabled, only one IP address is sent to the CPE.
  • the CPE After the CPE receives the multiple IP addresses sent by the server on the WAN through the extended label, the CPE fills the public IP address into the corresponding slot information. Then, the CPE validates the mapping between the configured public IP address and the private IP address of the DMZ host on the LAN side, so that the client on the WAN side can access the DMZ host on the LAN side.
  • FIG. 4 is a schematic flowchart of modifying a source IP address included in a reply packet to a public network IP address in a method for accessing a host in an quarantine area of a local area network according to the present invention.
  • the step S30 includes: Step S31: Receive a reply message returned by the host in the quarantine area according to the access request, where the reply message includes a destination IP address and a source IP address.
  • the destination IP address is the IP address of the client on the WAN side
  • the source IP address is the private network IP address of the host in the quarantine area;
  • Step S32 Modify the source IP address to the public network IP address of the client on the WAN side according to the configured mapping relationship.
  • the DMZ master After the CPE sends the access request with the modified destination IP address to the DMZ host, the DMZ master The opportunity returns a reply to the CPE.
  • the response received by the CPE includes the destination IP address and the source IP address.
  • the destination IP address is the IP address of the client on the WAN side, and the source IP address is the quarantine area.
  • the CPE modifies the source IP address of the CPE to the public IP address of the client on the WAN side according to the configured mapping relationship. After the source IP address is modified, the modified reply packet is sent to the WAN side for access by its client.
  • the source IP address is modified to the public network of the client on the WAN side according to the configured mapping relationship.
  • the IP address further ensures that the utilization efficiency of the IP address on the WAN side can be improved, and further provides greater convenience for access on the WAN side.
  • the present invention also provides an apparatus for accessing an quarantine host in a local area network.
  • FIG. 5 is a schematic structural diagram of an apparatus for accessing an quarantine host in a local area network according to an embodiment of the present invention.
  • the first configuration module 10 is configured to configure a mapping relationship between a public network IP address obtained from the WAN side and a private network IP address of the quarantine host on the LAN side;
  • the first modification module 20 is configured to: after receiving the access request sent by the client on the WAN side, modify the destination IP address in the access request to be the private network IP address of the corresponding quarantine host on the LAN side according to the configured mapping relationship. , sending the modified access request to the quarantine host;
  • the second modification module 30 is configured to receive the reply packet returned by the host in the quarantine area, change the source IP address included in the IPS client to the public IP address of the client on the WAN side, and send the tampering reply to the ⁇ ⁇ WAN side.
  • the CPE In the SOHO office area, when the client on the WAN side accesses the DMZ host on the LAN side through the CPE, the CPE first dials through the WAN, that is, obtains an IP address from the WAN side, and the IP address includes the basic IP address and the public network IP address. . After the IP address of the public network is obtained, the mapping between the private network IP address of the DMZ host on the LAN side is configured by the first configuration module 10. When the client on the WAN side accesses a DMZ host, the mapping is adopted. The relationship can be mapped to the public network IP address obtained from the WAN side to the DMZ host. After the mapping is completed, the DMZ host can start working.
  • mapping between the public network IP address and the private network IP address can be configured.
  • the mapping between the public network IP address and the private network IP address —the mapping between the public IP address and its port and the private network IP address and its port.
  • the access request is sent to the public network IP address of the WAN side of the CPE, and after the CPE receives the access request, the first modification module 20 is configured according to the WAN side of the configured CPE.
  • the mapping between the public IP address of the public network and the public IP address of the DMZ host, the destination IP address in the access request is modified to the private IP address of the corresponding DMZ host, and then the access request modified with the destination IP address is sent to DMZ host.
  • the DMZ host After receiving the access request with the destination IP address, the DMZ host returns a response packet to the CPE.
  • the second modification module 30 modifies the source IP address included in the response packet to the client on the WAN side.
  • the public network IP address, and then the reply packet with the modified source IP address is sent to the WAN side for the client to access the DMZ host.
  • the mapping relationship between the public network IP address obtained from the WAN side and the private network IP address of the quarantine host on the LAN side is configured; after receiving the access request sent by the client on the WAN side, according to the embodiment, The configured mapping relationship is modified to change the destination IP address in the access request to the private IP address of the corresponding quarantine host on the LAN side, and send the falsified access request to the quarantine host; After the message, the source IP address contained in the message is changed to the public IP address of the client on the WAN side, and the tampering reply message is sent to the WAN side for access by the client.
  • the DMZ host is located behind the NAT firewall of the CPE.
  • FIG. 6 is a schematic structural diagram of another embodiment of an apparatus for accessing an quarantine host in a local area network according to the present invention.
  • the device for accessing the quarantine host in the local area network further includes:
  • the second configuration module 40 is configured to store slot information of the public network IP address obtained from the WAN side, where the slot information corresponds to the public network IP address.
  • FIG. 7 is a schematic structural diagram of still another embodiment of an apparatus for accessing an quarantine host in a local area network according to the present invention.
  • the device for accessing the host of the quarantine area in the local area network further includes:
  • the sending module 50 is configured to send, when dialing through the WAN side, an extended label for indicating identity to the server on the WAN side;
  • the filling module 60 is configured to receive a plurality of IP addresses sent by the server on the WAN side by using the extended label, and fill the public network IP address into the corresponding slot information.
  • the CPE After the mapping between the public network IP address and the private network IP address of the DMZ host on the LAN side is configured, when the WAN side client needs to access the DMZ host on the LAN side, the CPE first establishes the WAN side through the access protocol.
  • the connection between the servers, that is, dialing through the WAN side, in this embodiment, the connection with the server on the WAN side can be established through the DHCP protocol or the PPP protocol.
  • the DHCP protocol client of the CPE When the connection is established through the DHCP protocol, the DHCP protocol client of the CPE sends an extension label for indicating the identity to the server on the WAN side through the sending module 50. After the broadband access server parses the extended label, it authenticates to the remote user dialing authentication system. Then, the DHCP server determines whether the DHCP protocol client is enabled to open the SOHO service, and determines whether it is necessary to deliver multiple IP addresses to the CPE. For example, if the DHCP server is enabled, multiple IP addresses are sent to the CPE through the extended label. Send an IP address to the CPE.
  • the CPE When the connection is established through the PPP protocol, the CPE sends an extension label for indicating the identity to the server on the WAN side through the sending module 50, and has an authentication function, which can directly authenticate to the remote user dialing authentication system based on the user name, and judges Whether the DHCP client is enabled to open the SOHO service, and determines whether it is necessary to deliver multiple IP addresses to the CPE. If the IP address is to be delivered, the IP address is sent to the CPE through the extended label. CPE.
  • the filling module 60 fills the public network IP address into the corresponding slot information. Then, CPE will match The mapping between the IP address of the public network and the private IP address of the DMZ host on the LAN is effective, so that the client on the WAN side can access the DMZ host on the LAN side.
  • FIG. 8 is a schematic structural diagram of a second modification module in an apparatus for accessing an quarantine host in a local area network according to the present invention.
  • the second modifying module 30 includes:
  • the receiving unit 31 is configured to receive a reply packet returned by the quarantine host according to the access request, where the replies include the destination IP address and the source IP address, where the destination IP address is the IP address of the client on the WAN side, and the source IP address.
  • the modifying unit 32 is configured to modify the source IP address to the public network IP address of the client on the WAN side according to the configured mapping relationship.
  • the DMZ host After the CPE sends the access request with the modified destination IP address to the DMZ host, the DMZ host returns a reply packet to the CPE.
  • the CPE receives the reply received by the receiving unit 31 to include the destination IP address and source. IP address, where the destination IP address is the IP address of the client on the WAN side, and the source IP address is the private network IP address of the quarantine host.
  • the modifying unit 32 modifies the source IP address thereof to the public network IP address of the client on the WAN side according to the configured mapping relationship. After the source IP address is modified, the modified reply packet is sent to the WAN side for access by its client.
  • the source IP address is modified to be the client of the WAN side according to the configured mapping relationship.
  • the network IP address further ensures that the utilization efficiency of the IP address on the WAN side can be improved, and further provides greater convenience for access on the WAN side.
  • the DMZ host is located behind the NAT firewall of the CPE, and the private network address is not required to be configured, thereby improving the security of the DMZ host and improving the utilization efficiency of the IP address on the WAN side. Access on the WAN side provides greater convenience.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)

Abstract

一种访问局域网中隔离区主机的方法，包括：配置从WAN侧所获取的公网IP地址与LAN侧的隔离区主机的私网IP地址之间的映射关系；当接收到WAN侧的客户端发送的访问请求后，根据所配置的映射关系，修改访问请求中的目的IP地址为LAN侧相应的隔离区主机的私网IP地址，将修改后的访问请求发送至所述隔离区主机；接收隔离区主机返回的回复报文，将其中包含的源IP地址修改为WAN侧的客户端的公网IP地址，并将修改后的回复报文发送至WAN侧。本发明还公开了相应的装置。釆用本发明实施例所公开的方案，在使DMZ主机安全性得以提高的同时，提高了广域网侧的IP地址的利用效率，并且为广域网侧的访问提供了较大的方便。

Description

访问局域网中隔离区主机的方法和装置
技术领域
本发明涉及到宽带网络技术领域， 特别涉及到一种访问局域网中隔离区 主机的方法和系统。
背景技术
目前在一些 SOHO办公的宽带接入场景中， 除了需要基本的上网业务外， 还需要开放 SOHO办公区中的多台设备供 WAN ( wide area network, 广域网 ) 侧访问， 而目前针对于 IPv4协议栈的情况， 当通过 WAN侧拨号时， CPE ( Customer Premise Equipment客户终端设备 )通常只能获取到一个 WAN侧 的 DMZ ( demilitarized zone, 隔离区）主机时， CPE所获取的 IP地址只能映射 到一个 DMZ主机上； 并且， 由于 CPE WAN侧本身会提供一些对外的服务， 所以需要预留 CPE WAN侧的一些端口， 因此， 就无法将所有 CPE WAN侧的 端口均映射至 DMZ区域的主机， 从而无法提高 WAN侧的 IP地址的利用效率， 为 WAN侧访问 LAN侧 DMZ主机带来了不便。
发明内容
本发明的主要目的为提供一种访问局域网中隔离区主机的方法和系统， 旨在提高广域网侧的 IP地址的利用效率， 并且能够为广域网侧的访问提供较 大的方便。
本发明提供一种访问局域网中隔离区主机的方法， 包括：
配置从 WAN侧所获取的公网 IP地址与 LAN侧的隔离区主机的私网 IP 地址之间的映射关系；
当接收到 WAN侧的客户端发送的访问请求后， 根据所配置的所述映射 关系 , 修改所述访问请求中的目的 IP地址为 LAN侧相应的隔离区主机的私 网 IP地址， 将修改后的所述访问请求发送至所述隔离区主机；
接收所述隔离区主机返回的回复报文，将其中包含的源 IP地址修改为所 述 WAN侧的客户端的公网 IP地址 ,并将修改后的所述回复 ^艮文发送至 WAN 侧。
优选地， 在执行所述配置从 WAN侧所获取的公网 IP地址与 LAN侧的 隔离区主机的私网 IP地址之间的映射关系之前 , 还包括：
配置用于存放从 WAN侧所获取的公网 IP地址的槽位信息，所述槽位信 息与所述公网 IP地址——对应。
优选地， 所述配置从 WAN侧所获取的公网 IP地址与 LAN侧的隔离区 主机的私网 IP地址之间的映射关系包括：
配置所述公网 IP地址与所述私网 IP地址的——对应的映射关系， 或配 置所述公网 IP地址及其端口与所述私网 IP地址及其端口的映射关系。
优选地， 在执行所述配置从 WAN侧所获取的公网 IP地址与 LAN侧的 隔离区主机的私网 IP地址之间的映射关系之后， 还包括：
当通过 WAN侧拨号时， 向 WAN侧的服务器发送用于表明身份的扩展 标签；
接收所述 WAN侧的服务器通过所述扩展标签所下发的多个 IP地址，将 其中的公网 IP地址填充至相应的所述槽位信息中。
优选地， 所述接收隔离区主机返回的回复 4艮文，将其中包含的源 IP地址 修改为所述公网 IP地址包括：
接收所述隔离区主机根据所述访问请求返回的回复报文， 该回复报文中 包含目的 IP地址和源 IP地址， 其中， 所述目的 IP地址为所述 WAN侧的客 户端的 IP地址， 所述源 IP地址为所述隔离区主机的私网 IP地址；
根据所配置的所述映射关系，将所述源 IP地址修改为所述 WAN侧的客 户端的公网 IP地址。 本发明还提供一种访问局域网中隔离区主机的装置， 包括：
第一配置模块， 设置为： 配置从 WAN侧所获取的公网 IP地址与 LAN 侧的隔离区主机的私网 IP地址之间的映射关系；
第一修改模块，设置为：当接收到 WAN侧的客户端发送的访问请求后， 根据所配置的所述映射关系， 修改所述访问请求中的目的 IP地址为 LAN侧 相应的隔离区主机的私网 IP地址，将修改后的所述访问请求发送至所述隔离 区主机；
第二修改模块， 设置为： 接收所述隔离区主机返回的回复报文， 将其中 包含的源 IP地址修改为所述 WAN侧的客户端的公网 IP地址， 并将修改后 的所述回复 ^艮文发送至 WAN侧。
优选地， 访问局域网中隔离区主机的装置还包括：
第二配置模块， 设置为： 配置用于存放从 WAN侧所获取的公网 IP地址 的槽位信息， 所述槽位信息与所述公网 IP地址——对应。
优选地， 所述第一配置模块设置为：
配置所述公网 IP地址与所述私网 IP地址的——对应的映射关系， 或配 置所述公网 IP地址及其端口与所述私网 IP地址及其端口的映射关系。
优选地， 访问局域网中隔离区主机的装置还包括：
发送模块， 设置为： 当通过 WAN侧拨号时， 向 WAN侧的服务器发送 用于表明身份的扩展标签；
填充模块， 设置为： 接收所述 WAN侧的服务器通过所述扩展标签所下 发的多个 IP地址， 将其中的公网 IP地址填充至相应的所述槽位信息中。
优选地， 所述第二修改模块包括：
接收单元， 设置为： 接收所述隔离区主机根据所述访问请求返回的回复 报文， 该回复报文中包含目的 IP地址和源 IP地址， 其中， 所述目的 IP地址 为所述 WAN侧的客户端的 IP地址， 所述源 IP地址为所述隔离区主机的私 网 IP地址；
修改单元， 设置为： 根据所配置的所述映射关系， 将所述源 IP地址修改 为所述 WAN侧的客户端的公网 IP地址。 本发明实施例通过配置从 WAN侧所获取的公网 IP地址与 LAN侧的隔 离区主机的私网 IP地址之间的映射关系； 当接收到 WAN侧的客户端发送的 访问请求后，根据所配置的映射关系，修改访问请求中的目的 IP地址为 LAN 侧相应的隔离区主机的私网 IP地址 ,将修改后的访问请求发送至隔离区主机; 在接收到隔离区主机返回的回复报文之后， 将其中包含的源 IP地址修改为 WAN侧的客户端的公网 IP地址 , 并将修改后的回复报文发送至 WAN侧 , 供其客户端访问。 由于 DMZ主机位于 CPE的 NAT防火墙后面， 无需配置 公网地址而是配置私网地址 , 在使 DMZ主机安全性得以提高的同时， 提高 了广域网侧的 IP地址的利用效率，并且为广域网侧的访问提供了较大的方便。 附图概述
图 1为本发明访问局域网中隔离区主机的方法一实施例的流程示意图； 图 2为本发明访问局域网中隔离区主机的方法另一实施例的流程示意图； 图 3为本发明访问局域网中隔离区主机的方法又一实施例的流程示意图； 图 4为本发明访问局域网中隔离区主机的方法中将回复报文中包含的源 IP地址^ ί 改为公网 IP地址的流程示意图；
图 5为本发明访问局域网中隔离区主机的装置一实施例的结构示意图； 图 6为本发明访问局域网中隔离区主机的装置另一实施例的结构示意图； 图 7为本发明访问局域网中隔离区主机的装置又一实施例的结构示意图； 图 8为本发明实施例访问局域网中隔离区主机的装置中第二修改模块的 结构示意图。 本发明目的的实现、 功能特点及优点将结合实施例， 参照附图做进一步 说明。 本发明的较佳实施方式
应当理解， 此处所描述的具体实施例仅仅用以解释本发明， 并不用于限 定本发明。
本发明实施例提供一种访问局域网中隔离区主机的方法， 通过客户终端 设备 CPE从 WAN侧获取多个公网 IP地址 ,并配置公网 IP地址与 LAN侧 DMZ主 机的私网 IP地址之间的映射关系， 当 WAN侧的客户端通过 CPE访问 LAN侧 DMZ主机时， 将公网 IP地址映射到相应的 DMZ主机上， 方便 WAN侧的客户 端的访问。
参照图 1 , 图 1为本发明访问局域网中隔离区主机的方法一实施例的流程 示意图。
本实施例所提供的访问局域网中隔离区主机的方法， 包括： 步骤 S10, 配置从 WAN侧所获取的公网 IP地址与 LAN侧的隔离区主 机的私网 IP地址之间的映射关系；
在 SOHO办公区域内，当 WAN侧的客户端通过 CPE访问 LAN侧的 DMZ 主机时， CPE首先通过 WAN进行拨号， 即从 WAN侧获取 IP地址， 该 IP 地址中包括基础 IP地址和公网 IP地址。 获取到公网 IP地址后， 配置其与 LAN侧的 DMZ主机的私网 IP地址之间的映射关系 , 当 WAN侧的客户端访 问某一台 DMZ主机时， 通过该映射关系即可将从 WAN侧获取的公网 IP地 址映射到该 DMZ主机上， 映射完成后， 该 DMZ主机便可开始工作。
本实施例中， 配置公网 IP地址与私网 IP地址的映射关系， 可以为配置 公网 IP地址与私网 IP地址——对应的映射关系， 也可以为配置公网 IP地址 及其端口与私网 ip地址及其端口的映射关系。
步骤 S20, 当接收到 WAN侧的客户端发送的访问请求后， 根据所配置 的映射关系 , 修改访问请求中的目的 IP地址为 LAN侧相应的隔离区主机的 私网 IP地址 , 将修改后的访问请求发送至隔离区主机；
当 WAN侧的客户端访问某一台 DMZ主机时， 向 CPE的 WAN侧的公 网 IP地址发送访问请求， 而 CPE接收到该访问请求后， 根据所配置的 CPE 的 WAN侧的公网 IP地址与 DMZ主机的公网 IP地址的映射关系 ,将访问请 求中的目的 IP地址修改为相应的 DMZ主机的私网 IP地址， 然后，将修改了 目的 IP地址的访问请求发送至 DMZ主机。
步骤 S30, 接收隔离区主机返回的回复报文， 将其中包含的源 IP地址修 改为 WAN侧的客户端的公网 IP地址， 并将爹改后的回复 4艮文发送至 WAN 侧。
当 DMZ主机接收到携带有目的 IP地址的访问请求后， 会返回回复报文至 CPE, 此时， 将该回复报文中所包含的源 IP地址修改为 WAN侧的客户端的公 网 IP地址， 然后， 将修改了源 IP地址的回复报文发送至 WAN侧， 供客户端访 问 DMZ主机。
本发明实施例， 通过配置从 WAN侧所获取的公网 IP地址与 LAN侧的 隔离区主机的私网 IP地址之间的映射关系； 当接收到 WAN侧的客户端发送 的访问请求后， 根据所配置的映射关系， 修改访问请求中的目的 IP地址为 LAN侧相应的隔离区主机的私网 IP地址， 将修改后的访问请求发送至隔离 区主机； 在接收到隔离区主机返回的回复报文之后，将其中包含的源 IP地址 爹改为 WAN侧的客户端的公网 IP地址 ,并将爹改后的回复 ^艮文发送至 WAN 侧， 供其客户端访问。 由于 DMZ主机位于 CPE的 NAT防火墙后面， 无需 配置公网地址而是配置私网地址， 在使 DMZ主机安全性得以提高的同时， 提高了广域网侧的 IP地址的利用效率，并且为广域网侧的访问提供了较大的 方便。 参照图 2 , 图 2为本发明访问局域网中隔离区主机的方法另一实施例的流 程示意图。
基于上述实施例， 在执行步骤 S10之前， 本发明访问局域网中隔离区主 机的方法还包括：
步骤 S40, 配置用于存放从 WAN侧所获取的公网 IP地址的槽位信息， 槽位信息与公网 IP地址——对应。
在配置公网 IP地址与 LAN侧的隔离区主机的私网 IP地址之间的映射关 系之前， 首先配置多个槽位信息， 所配置的槽位信息的数量与从 WAN侧动 态所获取的公网 IP地址相同， 并且为——对应， 其用于存放公网 IP地址； 本实施例中， 槽位信息也可以直接填充为公网 IP地址。
在配置公网 IP地址与 LAN侧的隔离区主机的私网 IP地址之间的映射关 系之前， 配置用于存放从 WAN侧所获取的公网 IP地址， 且与公网 IP地址 ——对应的槽位信息， 为提高广域网侧的 IP地址的利用效率提供了基础。 参照图 3 , 图 3为本发明访问局域网中隔离区主机的方法又一实施例的 流程示意图。
基于本发明访问局域网中隔离区主机的方法一实施例， 在执行步骤 S10 之后， 该方法还包括：
步骤 S50, 当通过 WAN侧拨号时， 向 WAN侧的服务器发送用于表明 身份的扩展标签；
步骤 S60, 接收 WAN侧的服务器通过扩展标签所下发的多个 IP地址， 将其中的公网 IP地址填充至相应的槽位信息中。
在配置了公网 IP地址与 LAN侧的 DMZ主机的私网 IP地址之间的映射关 系之后， 当 WAN侧的客户端需要访问 LAN侧的 DMZ主机时， CPE首先通过访 问协议建立与 WAN侧的服务器之间的连接， 即通过 WAN侧进行拨号， 本实 施例中，可以通过 DHCP协议或 PPP协议建立与 WAN侧的服务器之间的连接。
在通过 DHCP协议建立连接时 , CPE的 DHCP协议客户端向 WAN侧的服 务器发送用于表明身份的扩展标签， 宽带接入服务器解析该扩展标签后， 到 远程用户拨号认证系统进行认证，而后 DHCP服务器通过判断该 DHCP协议客 户端是否开通 SOHO业务， 决定是否需要下发多个 IP地址给 CPE, 如开通， 则 通过扩展标签下发多个 IP地址给 CPE,如未开通，则仅下发一个 IP地址给 CPE。
当通过 PPP协议建立连接时， 其自身具备认证功能， 可以直接基于用户 名到远程用户拨号认证系统进行认证， 并通过判断该 DHCP协议客户端是否 开通 SOHO业务， 决定是否需要下发多个 IP地址给 CPE, 如开通， 则通过扩展 标签下发多个 IP地址给 CPE, 如未开通， 则仅下发一个 IP地址给 CPE。
当 CPE接收到 WAN侧的服务器通过扩展标签所下发的多个 IP地址后， 将 其中的公网 IP地址填充至相应的槽位信息中。 而后， CPE将所配置的公网 IP 地址与 LAN侧的 DMZ主机的私网 IP地址之间的映射关系生效， 以供 WAN侧 的客户端访问 LAN侧的 DMZ主机。
当通过 WAN侧拨号时， 向 WAN侧的服务器发送用于表明身份的扩展 标签；并在接收到 WAN侧的服务器通过扩展标签所下发的多个 IP地址之后， 将其中的公网 IP地址填充至相应的槽位信息中， 保证了公网 IP地址与私网 IP地址之间的映射关系， 从而进一步为域网侧的访问提供了方便。 参照图 4, 图 4为本发明访问局域网中隔离区主机的方法中将回复报文 中包含的源 IP地址修改为公网 IP地址的流程示意图。
在本发明访问局域网中隔离区主机的方法一实施例中， 步骤 S30包括： 步骤 S31 , 接收隔离区主机根据访问请求返回的回复报文， 该回复报文 中包含目的 IP地址和源 IP地址， 其中， 目的 IP地址为 WAN侧的客户端的 IP地址， 源 IP地址为隔离区主机的私网 IP地址；
步骤 S32, 根据所配置的映射关系， 将源 IP地址修改为 WAN侧的客户 端的公网 IP地址。
当 CPE将修改了目的 IP地址的访问请求发送至 DMZ主机后， DMZ主 机会返回回复^艮文至 CPE, 此时 , CPE所接收到的回复^艮文中包括目的 IP 地址和源 IP地址， 其中， 目的 IP地址为 WAN侧的客户端的 IP地址， 源 IP 地址为隔离区主机的私网 IP地址。 然后， CPE根据所配置的映射关系， 将其 中的源 IP地址修改为 WAN侧的客户端的公网 IP地址。修改了源 IP地址后 , 会将修改后的回复报文发送至 WAN侧， 供其客户端进行访问。
当 CPE将修改了目的 IP地址的访问请求发送至 DMZ主机， 并接收到 DMZ主机返回的回复报文后， 根据所配置的映射关系， 将其中的源 IP地址 修改为 WAN侧的客户端的公网 IP地址，从而进一步保证了能够提高广域网 侧的 IP地址的利用效率， 并且进一步为广域网侧的访问提供了较大的方便。 本发明还提供一种访问局域网中隔离区主机的装置。
参照图 5 , 图 5为本发明访问局域网中隔离区主机的装置一实施例的结构 示意图。
本实施例所提供的访问局域网中隔离区主机的装置， 包括：
第一配置模块 10, 用于配置从 WAN侧所获取的公网 IP地址与 LAN侧 的隔离区主机的私网 IP地址之间的映射关系；
第一修改模块 20, 用于当接收到 WAN侧的客户端发送的访问请求后， 根据所配置的映射关系， 修改访问请求中的目的 IP地址为 LAN侧相应的隔 离区主机的私网 IP地址 , 将修改后的访问请求发送至隔离区主机；
第二修改模块 30, 用于接收隔离区主机返回的回复报文， 将其中包含的 源 IP地址爹改为 WAN侧的客户端的公网 IP地址， 并将爹改后的回复 ^艮文 发送至 WAN侧。
在 SOHO办公区域内，当 WAN侧的客户端通过 CPE访问 LAN侧的 DMZ 主机时， CPE首先通过 WAN进行拨号， 即从 WAN侧获取 IP地址， 该 IP 地址中包括基础 IP地址和公网 IP地址。 获取到公网 IP地址后， 通过第一配 置模块 10配置其与 LAN侧的 DMZ主机的私网 IP地址之间的映射关系， 当 WAN侧的客户端访问某一台 DMZ主机时， 通过该映射关系即可将从 WAN 侧获取的公网 IP地址映射到该 DMZ主机上， 映射完成后， 该 DMZ主机便 可开始工作。
本实施例中， 配置公网 IP地址与私网 IP地址的映射关系， 可以为配置 公网 IP地址与私网 IP地址——对应的映射关系， 也可以为配置公网 IP地址 及其端口与私网 ip地址及其端口的映射关系。
当 WAN侧的客户端访问某一台 DMZ主机时， 向 CPE的 WAN侧的公 网 IP地址发送访问请求， 而 CPE接收到该访问请求后， 第一修改模块 20根 据所配置的 CPE的 WAN侧的公网 IP地址与 DMZ主机的公网 IP地址的映 射关系，将访问请求中的目的 IP地址修改为相应的 DMZ主机的私网 IP地址， 然后， 将修改了目的 IP地址的访问请求发送至 DMZ主机。
当 DMZ主机接收到携带有目的 IP地址的访问请求后， 会返回回复报文至 CPE, 此时， 第二修改模块 30将该回复报文中所包含的源 IP地址修改为 WAN 侧的客户端的公网 IP地址， 然后， 将修改了源 IP地址的回复报文发送至 WAN 侧 , 供客户端访问 DMZ主机。
本发明实施例， 通过配置从 WAN侧所获取的公网 IP地址与 LAN侧的 隔离区主机的私网 IP地址之间的映射关系； 当接收到 WAN侧的客户端发送 的访问请求后， 根据所配置的映射关系， 修改访问请求中的目的 IP地址为 LAN侧相应的隔离区主机的私网 IP地址， 将爹改后的访问请求发送至隔离 区主机； 在接收到隔离区主机返回的回复报文之后 ,将其中包含的源 IP地址 爹改为 WAN侧的客户端的公网 IP地址 ,并将爹改后的回复 ^艮文发送至 WAN 侧， 供其客户端访问。 由于 DMZ主机位于 CPE的 NAT防火墙后面， 无需 配置公网地址而是配置私网地址， 在使 DMZ主机安全性得以提高的同时， 提高了广域网侧的 IP地址的利用效率，并且为广域网侧的访问提供了较大的 方便。 参照图 6 , 图 6为本发明访问局域网中隔离区主机的装置另一实施例的结 构示意图。
基于上述实施例， 访问局域网中隔离区主机的装置还包括：
第二配置模块 40, 用于配置用于存放从 WAN侧所获取的公网 IP地址 的槽位信息， 槽位信息与公网 IP地址——对应。
在配置公网 IP地址与 LAN侧的隔离区主机的私网 IP地址之间的映射关 系之前，首先通过第二配置模块 40配置多个槽位信息，所配置的槽位信息的 数量与从 WAN侧动态所获取的公网 IP地址相同， 并且为——对应， 其用于 存放公网 IP地址； 本实施例中， 槽位信息也可以直接填充为公网 IP地址。 在配置公网 IP地址与 LAN侧的隔离区主机的私网 IP地址之间的映射关 系之前， 配置用于存放从 WAN侧所获取的公网 IP地址， 且与公网 IP地址 ——对应的槽位信息， 为提高广域网侧的 IP地址的利用效率提供了基础。 参照图 7 , 图 7为本发明访问局域网中隔离区主机的装置又一实施例的结 构示意图。
基于本发明访问局域网中隔离区主机的装置一实施例， 访问局域网中隔 离区主机的装置还包括：
发送模块 50 , 用于当通过 WAN侧拨号时， 向 WAN侧的服务器发送用 于表明身份的扩展标签；
填充模块 60,用于接收 WAN侧的服务器通过扩展标签所下发的多个 IP 地址， 将其中的公网 IP地址填充至相应的槽位信息中。
在配置了公网 IP地址与 LAN侧的 DMZ主机的私网 IP地址之间的映射关 系之后， 当 WAN侧的客户端需要访问 LAN侧的 DMZ主机时， CPE首先通过访 问协议建立与 WAN侧的服务器之间的连接， 即通过 WAN侧进行拨号， 本实 施例中，可以通过 DHCP协议或 PPP协议建立与 WAN侧的服务器之间的连接。
在通过 DHCP协议建立连接时， CPE的 DHCP协议客户端通过发送模块 50 向 WAN侧的服务器发送用于表明身份的扩展标签，宽带接入服务器解析该扩 展标签后， 到远程用户拨号认证系统进行认证， 而后 DHCP服务器通过判断 该 DHCP协议客户端是否开通 SOHO业务， 决定是否需要下发多个 IP地址给 CPE, 如开通， 则通过扩展标签下发多个 IP地址给 CPE, 如未开通， 则仅下 发一个 IP地址给 CPE。
当通过 PPP协议建立连接时， CPE通过发送模块 50向 WAN侧的服务器发 送用于表明身份的扩展标签， 其自身具备认证功能， 可以直接基于用户名到 远程用户拨号认证系统进行认证， 并通过判断该 DHCP协议客户端是否开通 SOHO业务， 决定是否需要下发多个 IP地址给 CPE, 如开通， 则通过扩展标签 下发多个 IP地址给 CPE, 如未开通， 则仅下发一个 IP地址给 CPE。
当 CPE接收到 WAN侧的服务器通过扩展标签所下发的多个 IP地址后， 填 充模块 60将其中的公网 IP地址填充至相应的槽位信息中。 而后， CPE将所配 置的公网 IP地址与 LAN侧的 DMZ主机的私网 IP地址之间的映射关系生效， 以 供 WAN侧的客户端访问 LAN侧的 DMZ主机。
当通过 WAN侧拨号时， 向 WAN侧的服务器发送用于表明身份的扩展 标签；并在接收到 WAN侧的服务器通过扩展标签所下发的多个 IP地址之后， 将其中的公网 IP地址填充至相应的槽位信息中， 保证了公网 IP地址与私网 IP地址之间的映射关系， 从而进一步为域网侧的访问提供了方便。 参照图 8 , 图 8为本发明访问局域网中隔离区主机的装置中第二修改模块 的结构示意图。
在本发明访问局域网中隔离区主机的装置一实施例中，第二修改模块 30 包括：
接收单元 31 , 用于接收隔离区主机根据访问请求返回的回复报文， 该回 复才艮文中包含目的 IP地址和源 IP地址， 其中， 目的 IP地址为 WAN侧的客 户端的 IP地址， 源 IP地址为隔离区主机的私网 IP地址；
修改单元 32, 用于根据所配置的映射关系， 将源 IP地址修改为 WAN侧的 客户端的公网 IP地址。
当 CPE将修改了目的 IP地址的访问请求发送至 DMZ主机后， DMZ主 机会返回回复报文至 CPE, 此时， CPE通过其接收单元 31所接收到的回复 才艮文中包括目的 IP地址和源 IP地址 , 其中， 目的 IP地址为 WAN侧的客户 端的 IP地址， 源 IP地址为隔离区主机的私网 IP地址。 然后， 修改单元 32 根据所配置的映射关系，将其中的源 IP地址修改为 WAN侧的客户端的公网 IP地址。 修改了源 IP地址后， 会将修改后的回复报文发送至 WAN侧， 供其 客户端进行访问。
当 CPE将修改了目的 IP地址的访问请求发送至 DMZ主机， 并接收到 DMZ主机返回的回复 ^艮文后， 根据所配置的映射关系， 将其中的源 IP地址 修改为 WAN侧的客户端的公网 IP地址，从而进一步保证了能够提高广域网 侧的 IP地址的利用效率， 并且进一步为广域网侧的访问提供了较大的方便。 以上所述仅为本发明的优选实施例， 并非因此限制本发明的专利范围， 凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换， 或直接 或间接运用在其他相关的技术领域， 均同理包括在本发明的专利保护范围。
工业实用性
本发明实施例由于 DMZ主机位于 CPE的 NAT防火墙后面， 无需配置 公网地址而是配置私网地址， 在使 DMZ主机安全性得以提高的同时， 提高 了广域网侧的 IP地址的利用效率，并且为广域网侧的访问提供了较大的方便。

Claims

权 利 要 求 书
1、 一种访问局域网中隔离区主机的方法， 包括：
配置从广域网 WAN侧所获取的公网 IP地址与局域网 LAN侧的隔离区 主机的私网 IP地址之间的映射关系；
当接收到 WAN侧的客户端发送的访问请求后， 根据所配置的所述映射 关系 , 修改所述访问请求中的目的 IP地址为 LAN侧相应的隔离区主机的私 网 IP地址， 将修改后的所述访问请求发送至所述隔离区主机；
接收所述隔离区主机返回的回复报文，将其中包含的源 IP地址修改为所 述 WAN侧的客户端的公网 IP地址，并将修改后的所述回复 ^艮文发送至 WAN 侧。
2、 根据权利要求 1所述的方法， 其中， 在执行所述配置从 WAN侧所获 取的公网 IP地址与 LAN侧的隔离区主机的私网 IP地址之间的映射关系之前, 还包括：
配置用于存放从 WAN侧所获取的公网 IP地址的槽位信息，所述槽位信 息与所述公网 IP地址——对应。
3、 根据权利要求 2所述的方法， 其中， 所述配置从 WAN侧所获取的公 网 IP地址与 LAN侧的隔离区主机的私网 IP地址之间的映射关系包括：
配置所述公网 IP地址与所述私网 IP地址的——对应的映射关系， 或配 置所述公网 IP地址及其端口与所述私网 IP地址及其端口的映射关系。
4、 根据权利要求 3所述的方法， 其中， 在执行所述配置从 WAN侧所获 取的公网 IP地址与 LAN侧的隔离区主机的私网 IP地址之间的映射关系之后 , 还包括：
当通过 WAN侧拨号时， 向 WAN侧的服务器发送用于表明身份的扩展 标签；
接收所述 WAN侧的服务器通过所述扩展标签所下发的多个 IP地址，将 其中的公网 IP地址填充至相应的所述槽位信息中。
5、根据权利要求 1至 4中任一项所述的方法， 其中， 所述接收隔离区主 机返回的回复 ^艮文， 将其中包含的源 IP地址修改为所述公网 IP地址包括： 接收所述隔离区主机根据所述访问请求返回的回复报文， 该回复报文中 包含目的 IP地址和源 IP地址， 其中， 所述目的 IP地址为所述 WAN侧的客 户端的 IP地址， 所述源 IP地址为所述隔离区主机的私网 IP地址；
根据所配置的所述映射关系，将所述源 IP地址修改为所述 WAN侧的客 户端的公网 IP地址。
6、 一种访问局域网中隔离区主机的装置， 包括：
第一配置模块， 设置为： 配置从广域网 WAN侧所获取的公网 IP地址与 局域网 LAN侧的隔离区主机的私网 IP地址之间的映射关系；
第一修改模块，设置为：当接收到 WAN侧的客户端发送的访问请求后， 根据所配置的所述映射关系， 修改所述访问请求中的目的 IP地址为 LAN侧 相应的隔离区主机的私网 IP地址 ,将修改后的所述访问请求发送至所述隔离 区主机；
第二修改模块， 设置为： 接收所述隔离区主机返回的回复报文， 将其中 包含的源 IP地址修改为所述 WAN侧的客户端的公网 IP地址， 并将修改后 的所述回复 ^艮文发送至 WAN侧。
7、 根据权利要求 6所述的装置， 其中， 还包括：
第二配置模块， 设置为： 配置用于存放从 WAN侧所获取的公网 IP地址 的槽位信息， 所述槽位信息与所述公网 IP地址——对应。
8、 根据权利要求 7所述的装置， 其中， 所述第一配置模块设置为： 配置所述公网 IP地址与所述私网 IP地址的——对应的映射关系， 或配 置所述公网 IP地址及其端口与所述私网 IP地址及其端口的映射关系。
9、 根据权利要求 8所述的装置， 其中， 还包括：
发送模块， 设置为： 当通过 WAN侧拨号时， 向 WAN侧的服务器发送 用于表明身份的扩展标签； 填充模块， 设置为： 接收所述 WAN侧的服务器通过所述扩展标签所下 发的多个 IP地址， 将其中的公网 IP地址填充至相应的所述槽位信息中。
10、 根据权利要求 6至 9中任一项所述的装置， 其中， 所述第二修改模 块包括：
接收单元， 设置为： 接收所述隔离区主机根据所述访问请求返回的回复 报文， 该回复报文中包含目的 IP地址和源 IP地址， 其中， 所述目的 IP地址 为所述 WAN侧的客户端的 IP地址， 所述源 IP地址为所述隔离区主机的私 网 IP地址；
修改单元， 设置为： 根据所配置的所述映射关系， 将所述源 IP地址修改 为所述 WAN侧的客户端的公网 IP地址。
PCT/CN2013/083642 2013-01-16 2013-09-17 访问局域网中隔离区主机的方法和装置 WO2014110912A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US14/651,845 US10171418B2 (en) 2013-01-16 2013-09-17 Method and apparatus for accessing demilitarized zone host on local area network
EP13871858.0A EP2922253A4 (en) 2013-01-16 2013-09-17 METHOD AND APPARATUS FOR ACCESSING A HOST OF A DEMILITARIZED AREA ON A LOCAL NETWORK

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310016322.0A CN103095705B (zh) 2013-01-16 2013-01-16 访问局域网中隔离区主机的方法和装置
CN201310016322.0 2013-01-16

Publications (1)

Publication Number Publication Date
WO2014110912A1 true WO2014110912A1 (zh) 2014-07-24

Family

ID=48207838

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2013/083642 WO2014110912A1 (zh) 2013-01-16 2013-09-17 访问局域网中隔离区主机的方法和装置

Country Status (4)

Country Link
US (1) US10171418B2 (zh)
EP (1) EP2922253A4 (zh)
CN (1) CN103095705B (zh)
WO (1) WO2014110912A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103095705B (zh) * 2013-01-16 2016-02-10 中兴通讯股份有限公司 访问局域网中隔离区主机的方法和装置
CN104780229A (zh) * 2014-01-09 2015-07-15 东莞市微云系统科技有限公司 通过云终端设置云服务器ip地址的方法、系统和云系统
CN105763592A (zh) * 2014-12-19 2016-07-13 中兴通讯股份有限公司 集群内外数据交互方法、集群网关和源设备
CN106843895B (zh) * 2017-02-07 2020-05-19 上海网易小额贷款有限公司 用于处理请求的方法、系统和可读存储介质
CN113301179A (zh) * 2021-04-28 2021-08-24 武汉大塔技术有限公司 一种实现lte/5g桥模式的方法及无线路由设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030033418A1 (en) * 2001-07-19 2003-02-13 Young Bruce Fitzgerald Method of implementing and configuring an MGCP application layer gateway
CN102143233A (zh) * 2011-04-07 2011-08-03 深圳市共进电子有限公司 一种用户终端设备及网络接入方法
CN102149024A (zh) * 2010-02-04 2011-08-10 华为技术有限公司 一种olt代理管理onu的方法、设备及系统
CN103095705A (zh) * 2013-01-16 2013-05-08 中兴通讯股份有限公司 访问局域网中隔离区主机的方法和装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7274684B2 (en) * 2001-10-10 2007-09-25 Bruce Fitzgerald Young Method and system for implementing and managing a multimedia access network device
US20060126613A1 (en) * 2004-12-09 2006-06-15 Nortel Networks Limited Multi-homed broadband router
EP2471307B1 (en) * 2009-08-25 2017-07-05 Telefonaktiebolaget LM Ericsson (publ) Relocation of mobility anchor for nomadic subscribers
CN102104525B (zh) * 2011-03-16 2013-04-24 华为技术有限公司 媒体网关设备及转发数据帧的方法
CN102209124B (zh) * 2011-06-08 2014-03-12 杭州华三通信技术有限公司 私网与公网通信的方法及网络地址转换设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030033418A1 (en) * 2001-07-19 2003-02-13 Young Bruce Fitzgerald Method of implementing and configuring an MGCP application layer gateway
CN102149024A (zh) * 2010-02-04 2011-08-10 华为技术有限公司 一种olt代理管理onu的方法、设备及系统
CN102143233A (zh) * 2011-04-07 2011-08-03 深圳市共进电子有限公司 一种用户终端设备及网络接入方法
CN103095705A (zh) * 2013-01-16 2013-05-08 中兴通讯股份有限公司 访问局域网中隔离区主机的方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2922253A4 *

Also Published As

Publication number Publication date
EP2922253A1 (en) 2015-09-23
US20150319134A1 (en) 2015-11-05
CN103095705A (zh) 2013-05-08
US10171418B2 (en) 2019-01-01
EP2922253A4 (en) 2016-06-29
CN103095705B (zh) 2016-02-10

Similar Documents

Publication Publication Date Title
CN103580980B (zh) 虚拟网络自动发现和自动配置的方法及其装置
US8559448B2 (en) Method and apparatus for communication of data packets between local networks
CN102577255B (zh) 云计算中企业的第2层无缝站点扩展
EP1936883B1 (en) Service provisioning method and system thereof
CN101056178B (zh) 一种控制用户网络访问权限的方法和系统
CN102025792B (zh) 路由器及其ip地址设置方法
CN102231725B (zh) 一种动态主机配置协议报文的认证方法、设备及系统
WO2014110912A1 (zh) 访问局域网中隔离区主机的方法和装置
CN101834864B (zh) 一种三层虚拟专用网中攻击防范的方法及装置
WO2012088911A1 (zh) Ip终端接入网络的方法和装置
EP2838242B1 (en) Method and apparatus for preventing network-side media access control address from being counterfeited
US20140161121A1 (en) Method, System and Device for Authenticating IP Phone and Negotiating Voice Domain
KR20110060895A (ko) 다중 인터넷 액세스를 제공하기 위한 방법 및 게이트웨이
CN105207778A (zh) 一种在接入网关设备上实现包身份标识及数字签名的方法
WO2019047611A1 (zh) 一种数据传输方法、pnf sdn控制器、vnf sdn控制器及系统
EP3170301A1 (en) Access to a node
JP4028421B2 (ja) 音声通信ゲート装置のアドレス管理方法および管理装置並びにプログラム
WO2012041168A1 (zh) 用于IPv6网络的网络连接处理方法及其装置
Rajput et al. The helping protocol “DHCP”
CA2475938A1 (en) A system and method of internet access and management
EP2663049B1 (en) Authentication method based on dhcp, dhcp server and client
CN105812499B (zh) 通信方法和通信系统及虚拟客户终端设备
CN102404227B (zh) 一种层次型穿越内网的路由系统
CN102577299A (zh) 简化的接入网认证信息承载协议
WO2013107055A1 (zh) 获取用户信息的方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13871858

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 14651845

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2013871858

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE