WO2015117337A1 - 网络规则条目的设置方法及装置 - Google Patents

网络规则条目的设置方法及装置 Download PDF

Info

Publication number
WO2015117337A1
WO2015117337A1 PCT/CN2014/087229 CN2014087229W WO2015117337A1 WO 2015117337 A1 WO2015117337 A1 WO 2015117337A1 CN 2014087229 W CN2014087229 W CN 2014087229W WO 2015117337 A1 WO2015117337 A1 WO 2015117337A1
Authority
WO
WIPO (PCT)
Prior art keywords
domain name
address
rule entry
network
rule
Prior art date
Application number
PCT/CN2014/087229
Other languages
English (en)
French (fr)
Inventor
魏志峰
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to ES14881540T priority Critical patent/ES2749884T3/es
Priority to PL14881540T priority patent/PL3171556T3/pl
Priority to EP14881540.0A priority patent/EP3171556B1/en
Priority to US15/327,065 priority patent/US20170237706A1/en
Publication of WO2015117337A1 publication Critical patent/WO2015117337A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2557—Translation policies or rules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/04—Interdomain routing, e.g. hierarchical routing

Definitions

  • the present invention relates to the field of communications, and in particular to a method and apparatus for setting a network rule entry.
  • control routing is implemented by configuring a policy route of an IP address or an address segment.
  • a route is a process in which a router receives a packet from one interface and directs it to another interface based on the destination address of the packet.
  • the routing is controlled by configuring a static route of an IP address or an address segment or setting an iptables rule.
  • the iptables is an integrated IP packet filtering system of the Linux kernel, which is based on a network filter (netfilter) architecture. Use the iptables command to configure "rules" to manage the flow and forwarding of network packets.
  • the control device needs to know in advance the IP addresses of all the websites that need to control the routing, and select an appropriate policy to set a single IP address or address segment.
  • the IP address of the website will be dynamically added or changed.
  • a fixed IP address or an address segment is configured as a static route or an IP table rule, it needs to be constantly reset, and there is a situation in which the update is not timely.
  • the present invention provides a method and apparatus for setting a network rule entry to solve at least the above problems.
  • a method for setting a network rule entry where the first device detects whether the first domain name requested by the domain name resolution request of the second device matches the preset second domain name, where The second device is a device that is connected to the first device; when the first domain name matches the second domain name, the first device acquires the first An IP address corresponding to the domain name; the first device sets an IP address in the rule entry corresponding to the second domain name to an IP address corresponding to the first domain name.
  • the second domain name is composed of a wildcard and a secondary domain name.
  • the rule entry includes a rule to select a network path.
  • the network path is a Wide Area Network (abbreviated as) WAN connection used for forwarding data packets.
  • WAN connection used for forwarding data packets.
  • the method further includes: the first device receiving the second device a network access request, wherein the network access request carries an IP address to be accessed; the first device searches for a rule entry corresponding to the IP address to be accessed; and when the IP address to be accessed is found, When the rule is an entry, the first device controls network access based on the found rule entry.
  • the first device controls network access according to the found rule entry, including: the first device selects a specified WAN connection to send a data packet according to the found rule entry.
  • a device for setting a network rule entry where the first device includes: a detecting module, configured to detect whether the first domain name requested by the domain name resolution request of the second device is The second domain name is matched, wherein the second device is a device that is connected to the first device, and the acquiring module is configured to: when the first domain name matches the second domain name, the response from the parsing request The IP address corresponding to the first domain name is obtained, and the setting module is configured to set an IP address in the rule entry corresponding to the second domain name to an IP address corresponding to the first domain name.
  • the second domain name is composed of a wildcard and a secondary domain name.
  • the rule entry includes a rule to select a network path.
  • the network path is a WAN connection used to forward a data packet.
  • the device further includes: a receiving module, configured to receive a network access request of the second device, where the network access request carries an IP address to be accessed; and a searching module is configured to search for the to access The rule entry corresponding to the IP address; the control module is configured to control the network access according to the found rule entry when the rule entry corresponding to the IP address to be accessed is found.
  • a receiving module configured to receive a network access request of the second device, where the network access request carries an IP address to be accessed
  • a searching module is configured to search for the to access The rule entry corresponding to the IP address
  • the control module is configured to control the network access according to the found rule entry when the rule entry corresponding to the IP address to be accessed is found.
  • control module is configured to select a specified WAN connection to send a data packet according to the found rule entry.
  • the first device detects whether the first domain name requested by the domain name resolution request of the second device connected to the second device matches the preset second domain name; when the first domain name matches the second domain name, the first device Obtain an IP address corresponding to the first domain name from the response of the parsing request, and set an IP address in the rule entry corresponding to the second domain name. Set to the IP address corresponding to the first domain name. Since the first device obtains the IP address corresponding to the domain name from the response of the parsing request, it is not necessary to know the IP address of all websites in advance, and the rule entry can be updated in time when the IP address of the website changes.
  • FIG. 1 is a flowchart of a method of setting a network rule entry according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of a network networking according to the related art
  • FIG. 3 is a flow chart of domain name wildcard setting and data forwarding routing according to an embodiment of the present invention.
  • FIG. 4 is a flow diagram of network access in accordance with an embodiment of the present invention.
  • FIG. 5 is a structural block diagram of an apparatus for setting a network rule entry according to an embodiment of the present invention.
  • the Domain Name System is a distributed database on the Internet that maps domain names and IP addresses to each other. It enables users to access the Internet more easily without having to remember the IP addresses that can be directly read by the machine. .
  • the process of obtaining the IP address corresponding to the host name by the host name is called domain name resolution (or host name resolution).
  • domain name resolution or host name resolution
  • domain name resolution needs to be done by a dedicated domain name resolution server.
  • the DNS protocol runs on the User Datagram Protocol (UDP).
  • UDP User Datagram Protocol
  • the port number is usually 53.
  • RFC 2181 specifies the DNS in the RFC document
  • RFC 2136 describes the dynamic update of the DNS
  • RFC 2308 describes the reverse cache of the DNS query.
  • the domain name resolution function can be invoked.
  • the analytic function sends the domain name to be translated to the domain name resolution request and sends the UDP packet to the local domain name server. After the local domain name server finds the domain name, it returns the corresponding IP address in the response packet.
  • the domain name server must also have information connected to other servers to support forwarding when it cannot be resolved. If the domain name server cannot answer the request, the domain name server temporarily becomes another client in the DNS and sends it to the root domain name server. After request resolution, the root domain name server will be able to find the domain name servers of all the second-level domain names below, and so on, and then parse until the requested domain name is queried.
  • the public network refers to the Internet, and provides various network services
  • the private network is a dedicated network, which is formed to meet the needs of special services and service quality, due to This kind of network is relatively isolated from the outside world, and the network interference is small, so that it can provide high-quality services.
  • the path to the network can be selected according to the domain name, for example, through the public network or through the private network.
  • embodiments of the invention are not limited thereto.
  • different rule entries may be set for different domain names to implement control of network access. It is to be expected that the method and apparatus of the following embodiments may be implemented by a computer program unit, which may be any device, the device may include a processor and a memory, the computer program unit may be stored in a memory, the processor A computer program unit can be executed.
  • a computer program unit which may be any device, the device may include a processor and a memory, the computer program unit may be stored in a memory, the processor A computer program unit can be executed.
  • FIG. 1 is a flowchart of a method for setting a network rule entry according to an embodiment of the present invention. As shown in FIG. 1, the method includes steps S102 to S106.
  • Step S102 The first device detects whether the first domain name that is requested by the domain name resolution request of the second device matches the preset second domain name, where the second device is a device that is connected to the first device.
  • multiple second domain names may be set in advance to implement network access control of multiple second domain names.
  • the second domain name is composed of a wildcard and a secondary domain name, for example, *.abc.com, thereby implementing control of all domain names including the domain name of .abc.com.
  • the first domain name and the second domain name match it may be determined whether the part other than the wildcard in the first domain name and the second domain name match, for example, the first domain name is xyz.abc.com, and the second domain name is *.abc.com, when judging, you can judge whether the part other than the wildcard is removed, that is, whether the part of .abc.com is consistent.
  • Step S104 When the first domain name matches the second domain name, the first device acquires an IP address corresponding to the first domain name from the response to the resolution request.
  • the first device may listen to the response of the parsing request, and when the response is received, obtain an IP address corresponding to the first domain name from the response, and the IP address is carried in the response.
  • Step S106 The first device sets the IP address in the rule entry corresponding to the second domain name to the IP address corresponding to the first domain name.
  • the rule entry may be set for the domain name to be controlled (ie, the second domain name). Since the second device accesses the network by using the IP address corresponding to the second domain name of the peer end, the correspondence between the rule entry and the IP address is established. .
  • the IP address obtained in the above step S104 is the IP address corresponding to the second domain name, and the obtained IP address can be written into the rule entry corresponding to the corresponding second domain name, thereby establishing the IP address and the rule of the second domain name.
  • the correspondence of the entries is the IP address corresponding to the second domain name.
  • the above rule entry includes a rule for selecting a network path.
  • the network path is a Wide Area Network (WAN) connection used for forwarding data packets, and the WAN may include, but is not limited to, the public network and the dedicated network described above.
  • WAN Wide Area Network
  • the first device may receive a network access request of the second device, where the network access request carries an IP address to be accessed; the first device searches for a rule entry corresponding to the IP address to be accessed; When a rule entry corresponding to an IP address to be accessed is received, the first device controls network access based on the found rule entry. Preferably, the first device may select the specified WAN connection to send the data packet according to the found rule entry.
  • the first device detects whether the first domain name requested by the domain name resolution request of the second device connected to the second device matches the preset second domain name; when the first domain name matches the second domain name, The device obtains the IP address corresponding to the first domain name from the response of the parsing request, and sets the IP address in the rule entry corresponding to the second domain name to the IP address corresponding to the first domain name. Since the first device obtains the IP address corresponding to the domain name from the response of the parsing request, it is not necessary to know the IP address of all websites in advance, and the rule entry can be updated in time when the IP address of the website changes.
  • the rule entry is automatically configured according to the result of the domain name resolution, and the corresponding route is searched according to the destination IP when the network service data is forwarded, thereby implementing control routing.
  • the home gateway (corresponding to the first device) configures a domain name wildcard whitelist (corresponding to the preset second domain name) associated with the network plane, and the home gateway of the home gateway ( Corresponding to the foregoing second device, when the network service access is initiated, the DNS resolution request is first sent. If the DNS domain name is configured in the wildcard whitelist, the IP address of the DNS resolution result is intercepted, and the corresponding rule is configured for the IP address. entry.
  • the home gateway After the service of the IP address that is sent by the device is accessed to the home gateway, the home gateway first checks the rule entry according to the destination address.
  • a hash (HASH) search mode may be adopted to improve efficiency. After the home gateway query is matched, the packet is marked and the specified network plane is selected for routing.
  • IP addresses are not required to be configured as static routes, and the new services of the website can be automatically adapted when the IP address is added, thereby increasing the flexibility and application of the processing.
  • Sex corresponding to the configuration of the IP table rules (search method is sequential search), HASH retrieval can improve retrieval performance.
  • FIG. 2 is a schematic diagram of a network networking according to the related art.
  • one network plane is an Internet (Internet) network
  • the other is a dedicated network.
  • a customer premises device (CPE) is a home gateway, a personal computer (Personal Computer, PC for short) or a set-top box.
  • the home gateway can connect to two network planes and pass through two networks.
  • the broadband remote access server (BRAS) of the road plane allocates addresses.
  • the two network planes share the DNS resolution server, that is, the home gateway is connected to the device to initiate a DNS request, and the DNS resolution can be completed through the Internet plane or the private network plane.
  • FIG. 3 is a flowchart of domain name wildcard setting and data forwarding routing according to an embodiment of the present invention. As shown in FIG. 3, step S302 to step S320 are included.
  • Step S302 the home gateway sets up two network WAN connections and obtains an address.
  • Step S304 the home gateway sets a whitelist of domain name wildcards through a WEB page or other manner.
  • Step S306 the connected device accesses the network to initiate a DNS resolution request.
  • the DNS Server When the home gateway hangs the device to initiate an access and initiates a DNS resolution request to the DNS server, the DNS Server returns a resolution response.
  • Step S308 the home gateway intercepts the DNS response message.
  • the home gateway matches the content of the request in the message with the set wildcard domain name, and the matching method is to remove the matching character "*" and then match the right (for example, accessing Sohu video, the requested DNS domain name is tv.sohu. Com matches *.souhu.com entries).
  • step S310 when the matching is successful, the IP address of the parsing result in the DNS response message is configured into the kernel rule table.
  • the kernel rule table is established by using a HASH table, which is composed of a destination IPv4/IPv6 address or address segment, a protocol type, a forwarding flag (a WAN connection corresponding MARK value), a usage flag, an entry status, and a packet count.
  • a HASH table which is composed of a destination IPv4/IPv6 address or address segment, a protocol type, a forwarding flag (a WAN connection corresponding MARK value), a usage flag, an entry status, and a packet count.
  • Step S312 the home gateway downlink device initiates access according to the DNS resolution result.
  • Step S314 the home gateway intercepts the HASH table according to the destination IP address.
  • Step S316 after the message arrives at the home gateway, first query the kernel rule table. If the retrieval is successful, the field of the SKB of the message is marked with the forwarding flag in the rule entry information.
  • Subsequent messages continue to be processed in the Linux protocol stack.
  • the flag is selected to select the policy route, and the control is sent by the specified WAN connection, thereby forwarding the data packet to the corresponding network plane.
  • step S320 the message is forwarded to the corresponding network access.
  • FIG. 4 is a flow chart of network access according to an embodiment of the present invention. As shown in FIG. 4, the method includes steps S402 to S424.
  • step S402 the home gateway establishes a WAN connection, obtains an address from the Internet plane through DHCP or PPPoE dialing, configures a route, and establishes an Internet plane channel.
  • Step S404 The home gateway obtains an address from the private network plane, obtains an address from the private network plane through DHCP or PPPoE dialing, configures a route, and establishes a private network plane channel.
  • Step S406 The home gateway of the home gateway acquires the small network address (192.168.1.x) from the home gateway.
  • Step S408 the home gateway is connected to another LAN port device set-top box to obtain a small network address (192.168.1.x) from the home gateway.
  • Step S410 The home gateway hangs the device PC to perform network service access, first initiates a DNS domain name resolution request, and the DNS server returns the analysis result.
  • Step S412 the domain name wildcard processing module intercepts the DNS resolution result of step 205, and after the parsed domain name and the wildcard whitelist match, the corresponding IP address in the DNS resolution result is configured into a kernel rule table, as a rule entry for later Access queries and set up routing usage.
  • Step S414 The home PC connected to the home gateway accesses the Internet plane, and initiates access according to the parsing result. After the message arrives at the home gateway, the home gateway retrieves the kernel rule table by using the HASH method, and then searches for the network plane (Internet) according to the entry. The WAN connection is forwarded to the internet network plane.
  • Step S416 The PC connected to the home gateway accesses the private network plane, and initiates the access according to the parsing result. After the packet is sent to the home gateway, the home gateway retrieves the kernel rule table by using the HASH method, and then searches for the network plane according to the entry. The WAN connection is forwarded to the private network plane.
  • Step S418 The home gateway connects the device set-top box to perform network service access, first initiates a DNS domain name resolution request, and the DNS server returns an analysis result.
  • Step S420 the domain name wildcard processing module intercepts the DNS resolution result of step 205. After the parsed domain name and the wildcard whitelist match, the corresponding IP address in the DNS resolution result is configured into a kernel rule table, and the rule entry is provided as a rule entry. Access queries and set up routing usage.
  • Step S422 The home gateway of the home gateway accesses the Internet plane, and the access is initiated according to the parsing result. After the packet is sent to the home gateway, the home gateway retrieves the kernel rule table by using the HASH method, and then searches for the network plane (Internet) according to the entry. The WAN connection is forwarded to the internet network plane.
  • Step S424 The home gateway of the home gateway accesses the private network plane, and the access is initiated according to the parsing result. After the packet is sent to the home gateway, the home gateway searches the kernel rule table by using the HASH method, and then searches for the network plane according to the entry. The WAN connection is forwarded to the private network plane.
  • FIG. 5 is a structural block diagram of a device for setting a network rule entry according to an embodiment of the present invention.
  • the device is located in a first device.
  • the detection module 10 is configured to detect a request for resolution of a domain name resolution request of a second device. Whether the first domain name matches the preset second domain name, wherein the second device is a device that is connected to the first device; and the obtaining module 20 is configured to: when the first domain name matches the second domain name, the response from the parsing request Obtaining an IP address corresponding to the first domain name; the setting module 30 is configured to set an IP address in the rule entry corresponding to the second domain name to an IP address corresponding to the first domain name.
  • the apparatus may further include: a receiving module, configured to receive a network access request of the second device, where the network access request carries an IP address to be accessed; and the searching module is configured to find an IP to be accessed The rule entry corresponding to the address; the control module is configured to control the network access according to the found rule entry when the rule entry corresponding to the IP address to be accessed is found.
  • a receiving module configured to receive a network access request of the second device, where the network access request carries an IP address to be accessed
  • the searching module is configured to find an IP to be accessed The rule entry corresponding to the address
  • the control module is configured to control the network access according to the found rule entry when the rule entry corresponding to the IP address to be accessed is found.
  • control module is configured to select the designated WAN connection to send the data packet according to the found rule entry.
  • the first device detects whether the first domain name that is requested by the domain name resolution request of the second device that is connected is matched with the preset second domain name; when the first domain name matches the second domain name, the first device resolves the request
  • the IP address corresponding to the first domain name is obtained in the response, and the IP address in the rule entry corresponding to the second domain name is set as the IP address corresponding to the first domain name. Since the first device obtains the IP address corresponding to the domain name from the response of the parsing request, it is not necessary to know the IP address of all websites in advance, and the rule entry can be updated in time when the IP address of the website changes.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices.
  • they may be implemented by program code executable by the computing device such that they may be stored in the storage device for execution by the computing device and, in some cases, may be performed in a different order than herein.
  • the steps shown or described are either made separately into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the first device detects whether the first domain name requested by the domain name resolution request of the second device connected to the second device matches the preset second domain name; when the first domain name and the second domain name are When the domain name is matched, the first device obtains the IP address corresponding to the first domain name from the response of the resolution request, and sets the IP address in the rule entry corresponding to the second domain name to the IP address corresponding to the first domain name. Since the first device obtains the IP address corresponding to the domain name from the response of the parsing request, it is not necessary to know the IP address of all websites in advance, and the rule entry can be updated in time when the IP address of the website changes.

Abstract

本发明公开了一种网络规则条目的设置方法及装置，其中，网络规则条目的设置方法包括：第一设备检测第二设备的域名解析请求所请求解析的第一域名是否与预设的第二域名匹配，其中，第二设备为第一设备下挂的设备；当第一域名与所述第二域名匹配时，第一设备从解析请求的响应中获取第一域名对应的IP地址；第一设备将第二域名对应的规则条目中的IP地址设置为第一域名对应的IP地址。通过本发明，无需事先知晓所有网站的IP地址，并且在网站的IP地址发生变化时可以及时更新规则条目。

Description

网络规则条目的设置方法及装置 技术领域
本发明涉及通信领域，具体而言，涉及一种网络规则条目的设置方法及装置。
背景技术
相关技术中，多采用通过配置IP地址或地址段的策略路由的方式实现控制选路。路由是指路由器从一个接口上收到数据包，根据数据包的目的地址进行定向并转发到另一个接口的过程。
在相关技术中，采用通过配置IP地址或地址段的静态路由或设置iptables规则方式来控制选路，iptables是Linux内核集成的IP信息包过滤系统，它建立在网络过滤器(netfilter)架构基础上，通过iptables命令配置“规则”来管理网络封包的流动与转送的动作。
在上述的方式下，控制设备需要事先知晓所有要控制选路的网站的IP地址，并选择合适策略设置单个IP地址或地址段。然而，网站的IP地址会动态增加或变化，在配置固定的IP地址或地址段为静态路由或IP表规则的情况下，需要不断的重新设置，并且存在更新不及时的情况。
针对相关技术中如何设置网络规则条目的问题，目前尚未提出有效的解决方案。
发明内容
针对如何设置网络规则条目的问题，本发明提供了一种网络规则条目的设置方法及装置，以至少解决上述问题。
根据本发明的一个实施例，提供了一种网络规则条目的设置方法，包括：第一设备检测第二设备的域名解析请求所请求解析的第一域名是否与预设的第二域名匹配，其中，所述第二设备为所述第一设备下挂的设备；当所述第一域名与所述第二域名匹配时，所述第一设备从所述解析请求的响应中获取所述第一域名对应的IP地址；所述第一设备将所述第二域名对应的规则条目中的IP地址设置为所述第一域名对应的IP地址。
优选地，所述第二域名由通配符和次级域名组成。
优选地，所述规则条目包括选择网络路径的规则。
优选地，所述网络路径为转发数据包所使用的广域网(Wide Area Network，简称为)WAN连接。
优选地，所述第一设备将所述第二域名对应的规则条目中的IP地址设置为所述第一域名对应的IP地址之后，还包括：所述第一设备接收所述第二设备的网络访问请求，其中，所述网络访问请求中携带有要访问的IP地址；所述第一设备查找所述要访问的IP地址对应的规则条目；当查找到所述要访问的IP地址对应的规则条目时，所述第一设备根据查找到的规则条目控制网络访问。
优选地，所述第一设备根据查找到的规则条目控制网络访问，包括：所述第一设备按照所述查找到的规则条目选择指定的WAN连接发送数据包。
根据本发明的另一个实施例，提供了一种网络规则条目的设置装置，位于第一设备，包括：检测模块，设置为检测第二设备的域名解析请求所请求解析的第一域名是否与预设的第二域名匹配，其中，所述第二设备为第一设备下挂的设备；获取模块，设置为当所述第一域名与所述第二域名匹配时，从所述解析请求的响应中获取所述第一域名对应的IP地址；设置模块，设置为将所述第二域名对应的规则条目中的IP地址设置为所述第一域名对应的IP地址。
优选地，所述第二域名由通配符和次级域名组成。
优选地，所述规则条目包括选择网络路径的规则。
优选地，所述网络路径为转发数据包所使用的WAN连接。
优选地，上述装置还包括：接收模块，设置为接收所述第二设备的网络访问请求，其中，所述网络访问请求中携带有要访问的IP地址；查找模块，设置为查找所述要访问的IP地址对应的规则条目；控制模块，设置为当查找到所述要访问的IP地址对应的规则条目时，根据查找到的规则条目控制网络访问。
优选地，所述控制模块，设置为按照所述查找到的规则条目选择指定的WAN连接发送数据包。
通过本发明，第一设备检测其下挂的第二设备的域名解析请求所请求解析的第一域名是否与预设的第二域名匹配；当第一域名与第二域名匹配时，第一设备从解析请求的响应中获取第一域名对应的IP地址，将第二域名对应的规则条目中的IP地址设 置为第一域名对应的IP地址。由于第一设备从解析请求的响应中获取域名对应的IP地址，从而无需事先知晓所有网站的IP地址，并且在网站的IP地址发生变化时可以及时更新规则条目。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本发明实施例的网络规则条目的设置方法的流程图；
图2是根据相关技术的网络组网的示意图；
图3是根据本发明实施例的域名通配符设置和数据转发选路的流程图；
图4是根据本发明实施例的网络访问的流程图；以及
图5是根据本发明实施例的网络规则条目的设置装置的结构框图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
域名系统(Domain Name System，简称为DNS)是因特网上作为域名和IP地址相互映射的一个分布式数据库，能够使用户更方便的访问互联网，而不用去记住能够被机器直接读取的IP地址。通过主机名，最终得到该主机名对应的IP地址的过程叫做域名解析(或主机名解析)。通常域名解析需要由专门的域名解析服务器来完成。DNS协议运行在用户数据报协议(User Datagram Protocol，简称为UDP)之上，通常所使用的端口号为53。在RFC文档中RFC2181对DNS有规范说明，RFC2136对DNS的动态更新进行说明，RFC 2308对DNS查询的反向缓存进行说明。
一般的，当应用过程需要将一个主机域名映射为IP地址时，可以调用域名解析函数，解析函数将待转换的域名放在域名解析请求中，以UDP报文方式发给本地域名服务器。本地的域名服务器查到域名后，将对应的IP地址放在应答报文中返回。同时域名服务器还必须具有连向其他服务器的信息以支持不能解析时的转发。若域名服务器不能回答该请求，则此域名服务器就暂成为DNS中的另一个客户，向根域名服务器发 出请求解析，根域名服务器一定能找到下面的所有二级域名的域名服务器，这样以此类推，一直向下解析，直到查询到所请求的域名。
在通信系统中存在多种网络路径，例如，公网和专网，公网指互联网，提供各种网络业务；专网是专用网络，为满足特殊业务和服务质量的需要而组建的网络，由于这种网络与外界相对隔离，网络干扰小，从而能提供高质量的服务。作为网络控制的一个例子，可以根据域名选择访问网络的路径，例如，通过公网还是通过专网访问网络。但本发明实施例并不限于此。
在本发明实施例中，可以针对不同的域名设置不同的规则条目，以实现对网络访问的控制。可以预料的是，以下实施例的方法和装置可以通过计算机程序单元实现，以下实施例的设备可以是任意的设备，设备可以包括处理器和存储器，上述计算机程序单元可以存储在存储器中，处理器可以执行计算机程序单元。
下面对本发明实施例进行描述。
图1是根据本发明实施例的网络规则条目的设置方法的流程图，如图1所示，该方法包括步骤S102至步骤S106。
步骤S102，第一设备检测第二设备的域名解析请求所请求解析的第一域名是否与预设的第二域名匹配，其中，第二设备为第一设备下挂的设备。
优选地，在本发明实施例中，可以设置预先设置多个第二域名，以实现多个第二域名的网络访问控制。
优选地，上述第二域名由通配符和次级域名组成，例如，*.abc.com，从而实现对所有域名包括.abc.com的域名的控制。
优选地，判断第一域名与第二域名是否匹配时，可以判断第一域名与第二域名中除通配符之外的部分是否匹配，例如，第一域名为xyz.abc.com，第二域名为*.abc.com，在判断时可以判断除去通配符之外的部分，即.abc.com这部分是否一致。
步骤S104，当第一域名与所述第二域名匹配时，第一设备从解析请求的响应中获取第一域名对应的IP地址。
优选地，第一设备可以监听上述解析请求的响应，在监听到该响应时，从该响应中获取第一域名对应的IP地址，该IP地址携带在响应中。
步骤S106，第一设备将第二域名对应的规则条目中的IP地址设置为第一域名对应的IP地址。
优选地，可以为要控制的域名(即第二域名)设置规则条目，由于第二设备访问网络时使用的是对端的第二域名对应的IP地址，因此，建立规则条目与IP地址的对应关系。在上述步骤S104中获取到的IP地址就是第二域名对应的IP地址，可以将该获取到的IP地址写入对应的第二域名对应的规则条目，从而建立了第二域名的IP地址与规则条目的对应关系。
优选地，上述规则条目包括选择网络路径的规则。优选地，网络路径为转发数据包所使用的广域网(Wide Area Network，简称为WAN)连接，WAN可以包括但不限于上述的公用网络和专用网络。
在上述步骤S106之后，第一设备可以接收第二设备的网络访问请求，其中，网络访问请求中携带有要访问的IP地址；第一设备查找要访问的IP地址对应的规则条目；当查找到要访问的IP地址对应的规则条目时，第一设备根据查找到的规则条目控制网络访问。优选地，第一设备可以按照查找到的规则条目选择指定的WAN连接发送数据包。
通过本发明实施例，第一设备检测其下挂的第二设备的域名解析请求所请求解析的第一域名是否与预设的第二域名匹配；当第一域名与第二域名匹配时，第一设备从解析请求的响应中获取第一域名对应的IP地址，将第二域名对应的规则条目中的IP地址设置为第一域名对应的IP地址。由于第一设备从解析请求的响应中获取域名对应的IP地址，从而无需事先知晓所有网站的IP地址，并且在网站的IP地址发生变化时可以及时更新规则条目。
下面以家庭网关为例对本发明实施例的上述方法进行描述。
在本发明实施例中，可以实现根据域名解析的结果自动配置规则条目，在网络业务数据转发时根据目的IP查找对应的路由，实现控制选路。
在本发明实施例中，家庭网关(对应于上述的第一设备)采用路由方式配置域名通配符白名单(对应于上述的预设的第二域名)关联网路平面，家庭网关的下挂设备(对应于上述的第二设备)发起网络业务访问时，首先发出DNS解析请求，若该DNS域名在配置域名通配符白名单中，则拦截DNS的解析结果的解析IP地址，将IP地址配置相应的规则条目。
当下挂设备发起的到解析出的IP地址的业务访问到家庭网关后，家庭网关首先根据目的地址查规则条目，在本发明实施例中，为提高效率可以采用哈希(HASH)检索方式。家庭网关查询匹配到之后，将报文打上标志，选择指定的网络平面进行路由。
在本发明实施例中，根据域名通配符方式，不需要穷举所有的IP地址配置成静态路由，在网站的新增业务对应增加了IP地址时也能自动适应，增加了处理的灵活性和适用性，相对应与配置IP表规则方式(检索方式为顺序查找)，HASH检索能够提高检索性能。
下面结合图2的组网对本发明实施例进行描述。
图2是根据相关技术的网络组网的示意图，如图2所示，本发明的实施例网络组网，在网络中存在两个网络，一个网络平面为互联网(Internet)网络，另一个为专网网络；其中用户侧设备(Customer Premise Equipment，简称为CPE)为家庭网关，下挂个人计算机(Personal Computer，简称为PC)或机顶盒，家庭网关可以连接到两个网络平面，分别通过两个网路平面的宽带远程接入服务器(Broadband Remote Access Server，简称为BRAS)分配地址。两个网络平面共用DNS解析服务器，也就是家庭网关下挂设备发起DNS请求，通过互联网平面或专网平面都能完成DNS解析。
图3是根据本发明实施例的域名通配符设置和数据转发选路的流程图，如图3所示，包括步骤S302至步骤S320。
步骤S302，家庭网关设置两个网络WAN连接、获取地址。
步骤S304，家庭网关通过WEB页面或其它方式设置域名通配符白名单。
例如，设置*.souhu.com来对控制所有以souhu.com结尾的搜狐网站的域名访问，设置*.qq.com来对控制所有以qq.com结尾的腾讯网站的域名访问。
步骤S306，下挂设备访问网络发起DNS解析请求。
当家庭网关下挂设备发起访问，发起DNS解析请求到DNS Server，DNS Server返回解析应答。
步骤S308，家庭网关拦截DNS应答报文。
在上述步骤S308中，家庭网关根据报文中请求内容和设置的通配符域名匹配，匹配方法为去掉统配字符“*”后右匹配(例如：访问搜狐视频，请求的DNS域名为tv.sohu.com与*.souhu.com条目匹配)。
步骤S310，匹配成功时，将DNS应答报文中的解析结果IP地址配置到内核规则表。
为提高检索效率，内核规则表采用HASH表建立，该内核规则HASH表由目的IPv4/IPv6地址或地址段、协议类型、转发标志(WAN连接对应MARK值)、使用标志、条目状态、收发包计数等字段组成。
步骤S312，家庭网关下挂设备根据DNS解析结果发起访问。
步骤S314，家庭网关截包根据目的IP地址查询HASH表。
步骤S316，报文到家庭网关后，首先查询内核规则表，若检索成功则将报文的SKB一个字段打上查询到的规则条目信息中转发标志。
后续报文继续在Linux协议栈中处理，查找路由时判断此标志选择策略路由，控制由指定的WAN连接发出，从而将数据包转发到相应的网络平面。
步骤S318，根据转发标志选对应WAN连接。
步骤S320，报文转发到相应的网络访问。
图4是根据本发明实施例的网络访问的流程图，如图4所示，该方法包括步骤S402至步骤S424。
步骤S402，家庭网关建立WAN连接，通过DHCP方式或PPPoE拨号方式从互联网平面获取到地址，配置路由，建立互联网平面通道。
步骤S404，家庭网关从专网平面获取到地址，通过DHCP方式或PPPoE拨号方式从专网平面获取到地址，配置路由，建立专网平面通道。
步骤S406，家庭网关一个LAN口下挂设备PC从家庭网关获取小网地址(192.168.1.x)。
步骤S408，家庭网关另一个LAN口下挂设备机顶盒从家庭网关获取小网地址(192.168.1.x)。
步骤S410，家庭网关下挂设备PC进行网络业务访问，首先发起DNS域名解析请求，DNS Server返回解析结果。
步骤S412，域名通配符处理模块拦截205步骤的DNS解析结果，当解析的域名和通配符白名单中条目匹配上之后，将DNS解析结果中对应的IP地址配置成内核规则表中，作为规则条目供后面的访问查询和设置路由使用。
步骤S414，家庭网关下挂设备PC访问互联网平面，根据解析结果发起访问，报文到家庭网关后，家庭网关通过HASH方法检索内核规则表，检索到之后即按照条目中指定网络平面(互联网)的WAN连接转发到互联网网络平面。
步骤S416，家庭网关下挂设备PC访问专网平面，根据解析结果发起访问，报文到家庭网关后，家庭网关通过HASH方法检索内核规则表，检索到之后即按照条目中指定网络平面(专网)的WAN连接转发到专网网络平面。
步骤S418，家庭网关下挂设备机顶盒进行网络业务访问，首先发起DNS域名解析请求，DNS Server返回解析结果。
步骤S420，域名通配符处理模块拦截205步骤的DNS解析结果，当解析的域名和通配符白名单中条目匹配上之后，将DNS解析结果中对应的IP地址配置成内核规则表中，作为规则条目供后面的访问查询和设置路由使用。
步骤S422，家庭网关下挂设备机顶盒访问互联网平面，根据解析结果发起访问，报文到家庭网关后，家庭网关通过HASH方法检索内核规则表，检索到之后即按照条目中指定网络平面(互联网)的WAN连接转发到互联网网络平面。
步骤S424，家庭网关下挂设备机顶盒访问专网平面，根据解析结果发起访问，报文到家庭网关后，家庭网关通过HASH方法检索内核规则表，检索到之后即按照条目中指定网络平面(专网)的WAN连接转发到专网网络平面。
下面对本发明实施例的网络规则条目的设置装置进行描述。
图5是根据本发明实施例的网络规则条目的设置装置的结构框图，该装置位于第一设备，如图5所示包括：检测模块10，设置为检测第二设备的域名解析请求所请求解析的第一域名是否与预设的第二域名匹配，其中，第二设备为第一设备下挂的设备；获取模块20，设置为当第一域名与第二域名匹配时，从解析请求的响应中获取第一域名对应的IP地址；设置模块30，设置为将第二域名对应的规则条目中的IP地址设置为第一域名对应的IP地址。
优选地，上述装置还可以包括：接收模块，设置为接收第二设备的网络访问请求，其中，网络访问请求中携带有要访问的IP地址；查找模块，设置为查找要访问的IP 地址对应的规则条目；控制模块，设置为当查找到要访问的IP地址对应的规则条目时，根据查找到的规则条目控制网络访问。
优选地，控制模块，设置为按照查找到的规则条目选择指定的WAN连接发送数据包。
对于本装置的其他部分，参见本发明实施例的上述描述，在此不再赘述。
从以上的描述中，可以看出，本发明实施例实现了如下技术效果：
第一设备检测其下挂的第二设备的域名解析请求所请求解析的第一域名是否与预设的第二域名匹配；当第一域名与第二域名匹配时，第一设备从解析请求的响应中获取第一域名对应的IP地址，将第二域名对应的规则条目中的IP地址设置为第一域名对应的IP地址。由于第一设备从解析请求的响应中获取域名对应的IP地址，从而无需事先知晓所有网站的IP地址，并且在网站的IP地址发生变化时可以及时更新规则条目。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，优选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
基于本发明实施例提供的上述技术方案，第一设备检测其下挂的第二设备的域名解析请求所请求解析的第一域名是否与预设的第二域名匹配；当第一域名与第二域名匹配时，第一设备从解析请求的响应中获取第一域名对应的IP地址，将第二域名对应的规则条目中的IP地址设置为第一域名对应的IP地址。由于第一设备从解析请求的响应中获取域名对应的IP地址，从而无需事先知晓所有网站的IP地址，并且在网站的IP地址发生变化时可以及时更新规则条目。

Claims (12)

  1. 一种网络规则条目的设置方法，包括：
    第一设备检测第二设备的域名解析请求所请求解析的第一域名是否与预设的第二域名匹配，其中，所述第二设备为所述第一设备下挂的设备；
    当所述第一域名与所述第二域名匹配时，所述第一设备从所述解析请求的响应中获取所述第一域名对应的IP地址；
    所述第一设备将所述第二域名对应的规则条目中的IP地址设置为所述第一域名对应的IP地址。
  2. 根据权利要求1所述的方法，其中，所述第二域名由通配符和次级域名组成。
  3. 根据权利要求1所述的方法，其中，所述规则条目包括选择网络路径的规则。
  4. 根据权利要求2所述的方法，其中，所述网络路径为转发数据包所使用的广域网WAN连接。
  5. 根据权利要求1所述的方法，其中，所述第一设备将所述第二域名对应的规则条目中的IP地址设置为所述第一域名对应的IP地址之后，还包括：
    所述第一设备接收所述第二设备的网络访问请求，其中，所述网络访问请求中携带有要访问的IP地址；
    所述第一设备查找所述要访问的IP地址对应的规则条目；
    当查找到所述要访问的IP地址对应的规则条目时，所述第一设备根据查找到的规则条目控制网络访问。
  6. 根据权利要求5所述的方法，其中，所述第一设备根据查找到的规则条目控制网络访问，包括：
    所述第一设备按照所述查找到的规则条目选择指定的WAN连接发送数据包。
  7. 一种网络规则条目的设置装置，位于第一设备，包括：
    检测模块，设置为检测第二设备的域名解析请求所请求解析的第一域名是否与预设的第二域名匹配，其中，所述第二设备为第一设备下挂的设备；
    获取模块，设置为当所述第一域名与所述第二域名匹配时，从所述解析请求的响应中获取所述第一域名对应的IP地址；
    设置模块，设置为将所述第二域名对应的规则条目中的IP地址设置为所述第一域名对应的IP地址。
  8. 根据权利要求7所述的装置，其中，所述第二域名由通配符和次级域名组成。
  9. 根据权利要求7所述的装置，其中，所述规则条目包括选择网络路径的规则。
  10. 根据权利要求9所述的装置，其中，所述网络路径为转发数据包所使用的广域网WAN连接。
  11. 根据权利要求7所述的装置，其中，还包括：
    接收模块，设置为接收所述第二设备的网络访问请求，其中，所述网络访问请求中携带有要访问的IP地址；
    查找模块，设置为查找所述要访问的IP地址对应的规则条目；
    控制模块，设置为当查找到所述要访问的IP地址对应的规则条目时，根据查找到的规则条目控制网络访问。
  12. 根据权利要求11所述的装置，其中，所述控制模块，设置为按照所述查找到的规则条目选择指定的WAN连接发送数据包。
PCT/CN2014/087229 2014-07-18 2014-09-23 网络规则条目的设置方法及装置 WO2015117337A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
ES14881540T ES2749884T3 (es) 2014-07-18 2014-09-23 Método y aparato para configurar una entrada de regla de red
PL14881540T PL3171556T3 (pl) 2014-07-18 2014-09-23 Sposób i urządzenie do ustawiania wpisu reguły sieciowej
EP14881540.0A EP3171556B1 (en) 2014-07-18 2014-09-23 Method and apparatus for setting network rule entry
US15/327,065 US20170237706A1 (en) 2014-07-18 2014-09-23 Method and apparatus for setting network rule entry

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410346378.7 2014-07-18
CN201410346378.7A CN105323173B (zh) 2014-07-18 2014-07-18 网络规则条目的设置方法及装置

Publications (1)

Publication Number Publication Date
WO2015117337A1 true WO2015117337A1 (zh) 2015-08-13

Family

ID=53777165

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/087229 WO2015117337A1 (zh) 2014-07-18 2014-09-23 网络规则条目的设置方法及装置

Country Status (6)

Country Link
US (1) US20170237706A1 (zh)
EP (1) EP3171556B1 (zh)
CN (1) CN105323173B (zh)
ES (1) ES2749884T3 (zh)
PL (1) PL3171556T3 (zh)
WO (1) WO2015117337A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105592046A (zh) * 2015-08-25 2016-05-18 杭州华三通信技术有限公司 一种免认证访问方法和装置
WO2018090795A1 (en) * 2016-11-18 2018-05-24 Thomson Licensing Method and device for providing services

Families Citing this family (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9912634B2 (en) * 2015-03-12 2018-03-06 General Motors Llc Enhancing DNS availability
CN107508929A (zh) * 2017-09-11 2017-12-22 杭州迪普科技股份有限公司 一种配置ip地址的方法及装置
US11082448B2 (en) * 2018-06-14 2021-08-03 International Business Machines Corporation Preventing phishing using DNS
US11677713B2 (en) * 2018-10-05 2023-06-13 Vmware, Inc. Domain-name-based network-connection attestation
CN109600385B (zh) * 2018-12-28 2021-06-15 绿盟科技集团股份有限公司 一种访问控制方法及装置
CN111447291B (zh) * 2018-12-29 2024-04-05 三六零科技集团有限公司 基于dns的调度方法、系统及电子设备
US11394746B2 (en) * 2019-03-07 2022-07-19 Lookout, Inc. DNS prefetching based on triggers for increased security
CN111865876B (zh) 2019-04-29 2021-10-15 华为技术有限公司 网络的访问控制方法和设备
US11223599B1 (en) * 2020-08-17 2022-01-11 Netflix, Inc. Techniques for templated domain management
CN112039888B (zh) * 2020-08-31 2023-06-02 成都安恒信息技术有限公司 一种域名访问控制的接入方法、装置、设备及介质
US11671347B2 (en) * 2020-09-30 2023-06-06 Vmware, Inc. On-demand packet redirection
US11563715B2 (en) * 2020-11-23 2023-01-24 Juniper Networks, Inc. Pattern matching by a network device for domain names with wildcard characters
CN113810510A (zh) * 2021-07-30 2021-12-17 绿盟科技集团股份有限公司 一种域名访问方法、装置及电子设备
CN114143332A (zh) * 2021-11-03 2022-03-04 阿里巴巴（中国）有限公司 基于内容分发网络cdn的处理方法、电子设备和介质
CN114374622B (zh) * 2021-12-31 2023-12-19 恒安嘉新（北京）科技股份公司 一种基于融合分流设备的分流方法及融合分流设备
CN116233273B (zh) * 2023-05-09 2023-08-01 国网信息通信产业集团有限公司 一种基于5g通信网络的报文传输系统及方法
CN117041392A (zh) * 2023-10-07 2023-11-10 中科方德软件有限公司 数据包的处理方法、装置、电子设备和介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102104512A (zh) * 2011-01-07 2011-06-22 华为技术有限公司 确定接口信息的方法和设备
CN103532852A (zh) * 2013-10-11 2014-01-22 小米科技有限责任公司 一种路由调度方法、装置及网络设备
US20140089523A1 (en) * 2012-09-21 2014-03-27 Interdigital Patent Holdings, Inc. Systems and methods for providing dns server selection using andsf in multi-interface hosts
CN103812770A (zh) * 2012-11-12 2014-05-21 华为技术有限公司 云业务报文重定向的方法、系统和云网关

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100489853C (zh) * 2006-12-28 2009-05-20 腾讯科技（深圳）有限公司 一种快速查询黑白名单的系统及方法
CN102025793A (zh) * 2010-01-22 2011-04-20 中国移动通信集团北京有限公司 一种ip网络中的域名解析方法、系统及dns服务器
US8549609B2 (en) * 2011-05-31 2013-10-01 Red Hat, Inc. Updating firewall rules
US9369345B2 (en) * 2011-11-11 2016-06-14 Pismo Labs Technology Limited Method and system for allowing the use of domain names in enforcing network policy

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102104512A (zh) * 2011-01-07 2011-06-22 华为技术有限公司 确定接口信息的方法和设备
US20140089523A1 (en) * 2012-09-21 2014-03-27 Interdigital Patent Holdings, Inc. Systems and methods for providing dns server selection using andsf in multi-interface hosts
CN103812770A (zh) * 2012-11-12 2014-05-21 华为技术有限公司 云业务报文重定向的方法、系统和云网关
CN103532852A (zh) * 2013-10-11 2014-01-22 小米科技有限责任公司 一种路由调度方法、装置及网络设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3171556A4 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105592046A (zh) * 2015-08-25 2016-05-18 杭州华三通信技术有限公司 一种免认证访问方法和装置
CN105592046B (zh) * 2015-08-25 2019-04-12 新华三技术有限公司 一种免认证访问方法和装置
WO2018090795A1 (en) * 2016-11-18 2018-05-24 Thomson Licensing Method and device for providing services

Also Published As

Publication number Publication date
ES2749884T3 (es) 2020-03-24
CN105323173B (zh) 2019-02-12
EP3171556A1 (en) 2017-05-24
PL3171556T3 (pl) 2020-11-02
CN105323173A (zh) 2016-02-10
EP3171556B1 (en) 2019-07-17
EP3171556A4 (en) 2017-07-12
US20170237706A1 (en) 2017-08-17

Similar Documents

Publication Publication Date Title
WO2015117337A1 (zh) 网络规则条目的设置方法及装置
US10440057B2 (en) Methods, apparatus and systems for processing service requests
US8554946B2 (en) NAT traversal method and apparatus
US10298486B2 (en) Selecting network services based on hostname
JP4361803B2 (ja) ネットワーク・アドレス・トランスレータ設定のためにパラメータを借りる方法及び装置
EP3461226A1 (en) Home gateway and forwarding service method thereof
US20130089092A1 (en) Method for preventing address conflict, and access node
CN110995886A (zh) 网络地址的管理方法、装置、电子设备及介质
TWI513239B (zh) 網路設備及其進行路由轉發的方法
US8510419B2 (en) Identifying a subnet address range from DNS information
JP2019522416A (ja) Ｄｎｓリクエストの抑制のためのシステム及び方法
CN116232972A (zh) 一种基于业务或内容的代理路由器
JP5350333B2 (ja) パケット中継装置及びネットワークシステム
US11196666B2 (en) Receiver directed anonymization of identifier flows in identity enabled networks
Cisco AppleTalk Commands
US11381503B2 (en) Data packet routing method and data packet routing device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14881540

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2014881540

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2014881540

Country of ref document: EP