WO2022127663A1

WO2022127663A1 - Wireless broadband router, message processing method and apparatus, and domain name resolution method and apparatus

Info

Publication number: WO2022127663A1
Application number: PCT/CN2021/136357
Authority: WO
Inventors: 张伟
Original assignee: 华为技术有限公司
Priority date: 2020-12-18
Filing date: 2021-12-08
Publication date: 2022-06-23
Also published as: CN114726824B; CN114726824A

Abstract

Provided are a wireless broadband router, a message processing method and apparatus, and a domain name resolution method and apparatus, which relate to the technical field of communications. The wireless broadband router operates in a bridge mode and stores a pseudo IP address in a local area network and an SNAT rule which is used for converting the pseudo IP address into a WAN side IP address of the wireless broadband router. The wireless broadband router is used for sending, to a service server, a first handshake message carrying a source IP address that is the WAN side IP address. The wireless broadband router is also used for receiving a second handshake message, which is sent by the service server and carries a destination IP address that is the WAN side IP address, and converting the WAN side IP address in the received second handshake message into the pseudo IP address according to the SNAT rule. A wireless broadband router performs conversion between a pseudo IP address and a WAN side IP address, such that the wireless broadband router that operates in a bridge mode can normally perform a native service, thereby ensuring that a major technical defect, a requirement change, security vulnerabilities, etc. are incorporated in a timely manner, thus improving the product reliability.

Description

Wireless broadband router, message processing and domain name resolution method and device

"This application claims the priority of the patent application submitted to the State Intellectual Property Office on December 18, 2020, the application number is 202011507318.0, and the invention name is "Wireless Broadband Router, Message Processing and Domain Name Resolution Method and Device", and its entire content incorporated herein by reference".

technical field

The present application relates to the field of communication technologies, and in particular, to a wireless broadband router, a packet processing and domain name resolution method and device.

Background technique

With the development of the 5th Generation (5G) mobile communication technology, major operators around the world have begun to gradually deploy 5G systems, and the use of mobile terminals has also undergone tremendous changes. The wireless broadband router is different from the traditional home router using optical fiber access. The wireless broadband router is installed with a subscriber identity module (SIM) card. The wireless broadband router dials up through the SIM card and establishes communication with the access network equipment. The use of wireless broadband routers greatly reduces the wiring cost, and the mobility is flexible, and the market share is increasing year by year.

However, when the wireless broadband router works in a bridge mode (also called a bridge mode), the local business of the wireless broadband router and the server in the wide area network (WAN) communication cannot be performed normally.

SUMMARY OF THE INVENTION

The embodiments of the present application provide a wireless broadband router, a packet processing and domain name resolution method and device, which are used to enable the local service of the wireless broadband router working in bridge mode to communicate with a server in a WAN to proceed normally.

In a first aspect, a wireless broadband router is provided. The wireless broadband router works in a bridge mode. The wireless broadband router stores a first IP address and a SNAT rule for converting the first IP address to the second IP address. The first IP address is stored in the wireless broadband router. The IP address is the pseudo address of the wireless broadband router in the local area network, and the second IP address is the IP address of the wireless broadband router in the WAN; the wireless broadband router is used to send the first handshake message carrying the second IP address to the service server , the first handshake message carrying the second IP address is used to request the establishment of a connection with the service server, the source IP address in the first handshake message carrying the second IP address is the second IP address, and the destination IP address is the service The IP address of the server; the wireless broadband router is also used to receive the second handshake message carrying the second IP address sent by the service server, and the second handshake message carrying the second IP address After the first handshake packet with the second IP address is sent to the wireless broadband router, the source IP address in the second handshake packet carrying the second IP address is the IP address of the service server, and the destination IP address is the second IP address. address; the wireless broadband router is also used to convert the second IP address in the received second handshake message carrying the second IP address into the first IP address according to the SNAT rule, and obtain the second IP address carrying the first IP address. Second handshake message. The wireless broadband router in the first aspect can make the wireless broadband router working in bridge mode normal by setting the IP address in the LAN as a pseudo IP address, and using SNAT rules to convert the pseudo IP address and the WAN side IP address. To carry out local business, for example, to carry out OTA online upgrade, so as to ensure the timely integration of major technical defects, demand changes, security loopholes, etc., and improve product reliability.

In a possible implementation manner, the wireless broadband router is further configured to generate a first handshake packet carrying the first IP address, and the source IP address in the first handshake packet carrying the first IP address is the first IP address, the destination IP address is the IP address of the service server; the wireless broadband router is also used to convert the first IP address in the first handshake packet carrying the first IP address into the second IP address according to the SNAT rule, and obtain The first handshake packet carrying the second IP address. In this possible implementation manner, by converting the first IP address in the generated first handshake message carrying the first IP address into the second IP address, the first handshake message sent to the service server can be Carrying the second IP address, because the second IP address is the IP address of the WAN side, so that the service server can identify the packet.

In a possible implementation manner, the wireless broadband router includes: a bridging module and a firewall module; the bridging module is used to send the SNAT rule to the firewall module; the firewall module is used to generate the first translation rule and the second translation rule according to the SNAT rule , the first conversion rule is used to convert the first IP address in the message to the second IP address when the first IP address is carried in the judgment message, and the second conversion rule is used to judge the message in the message. In the case of carrying the second IP address, the second IP address in the packet is converted into the first IP address. In this possible implementation manner, by converting the SNAT rule into the first conversion rule and the second conversion rule, the wireless broadband router can realize the bidirectional conversion of the first IP address and the second IP address, thereby ensuring the report sent to the service server. The message is recognized by the service server, and the message received from the service server is recognized by the local service module in the wireless broadband router.

In a possible implementation manner, the wireless broadband router further includes: a local service module; a local service module, configured to send a first handshake message carrying the first IP address to the firewall module; In the first handshake packet of the IP address, the firewall module is further configured to convert the first IP address in the first handshake packet carrying the first IP address into the second IP address according to the first conversion rule, and obtain the first handshake packet carrying the first IP address. The first handshake packet with the second IP address; the firewall module is further configured to send the first handshake packet carrying the second IP address to the service server; the firewall module is further configured to receive the second IP address from the service server. The second handshake packet of the address; in response to receiving the second handshake packet carrying the second IP address, the firewall module is further configured to include the second handshake packet carrying the second IP address in the second handshake packet carrying the second IP address according to the second conversion rule The second IP address is converted into the first IP address, and the second handshake message carrying the first IP address is obtained; the firewall module is also used to send the second handshake message carrying the first IP address to the local service module. . In this possible implementation manner, the bidirectional conversion between the first IP address and the second IP address is realized by adopting the first conversion rule and the second conversion rule, thereby ensuring that the message sent to the service server is recognized by the service server and received from the service server. The received message is recognized by the local service module in the wireless broadband router.

In a possible implementation manner, the first IP address is stored in the bridge module.

In a second aspect, a packet processing method is provided, which is applied to a wireless broadband router. The wireless broadband router works in a bridge mode. The wireless broadband router stores a first IP address and a method for converting the first IP address into a second IP address. The SNAT rule of the address, the first IP address is the pseudo address of the wireless broadband router in the local area network, and the second IP address is the IP address of the wireless broadband router in the wide area network; the method includes: the wireless broadband router sends a message carrying the second IP address to the service server. The first handshake packet carrying the second IP address is used to request the establishment of a connection with the service server, and the source IP address in the first handshake packet carrying the second IP address is the second IP address. IP address, the destination IP address is the IP address of the service server; the wireless broadband router receives the second handshake message carrying the second IP address sent by the service server, and the second handshake message carrying the second IP address is the service server in After receiving the first handshake packet carrying the second IP address, and sent to the wireless broadband router, the source IP address in the second handshake packet carrying the second IP address is the IP address of the service server, and the destination IP address is the second IP address; the wireless broadband router converts the second IP address in the received second handshake message carrying the second IP address into the first IP address according to the SNAT rule, and obtains the second IP address carrying the first IP address. Second handshake message.

In a possible implementation manner, the method further includes: the wireless broadband router generates a first handshake packet carrying the first IP address, and according to SNAT rules, the first handshake packet in the first handshake packet carrying the first IP address An IP address is converted into a second IP address, and a first handshake packet carrying the second IP address is obtained. The source IP address in the first handshake packet carrying the first IP address is the first IP address, and the destination IP address is the IP address of the service server.

In a possible implementation, the wireless broadband router includes: a bridge module and a firewall module; the method further includes: the bridge module sends an SNAT rule to the firewall module; the firewall module generates a first translation rule and a second translation rule according to the SNAT rule, The first conversion rule is used to convert the first IP address in the packet to the second IP address when the judgment packet carries the first IP address, and the second conversion rule is used to carry the first IP address in the judgment packet. In the case of the second IP address, the second IP address in the packet is converted into the first IP address.

In a possible implementation manner, the wireless broadband router further includes: a local service module; the method further includes: the local service module sends a first handshake message carrying the first IP address to the firewall module; In the first handshake packet of the first IP address, the firewall module converts the first IP address in the first handshake packet carrying the first IP address into the second IP address according to the first conversion rule, and obtains the second IP address. The first handshake packet of the address; the firewall module sends the first handshake packet carrying the second IP address to the service server; the firewall module receives the second handshake packet carrying the second IP address from the service server; response After receiving the second handshake message carrying the second IP address, the firewall module converts the second IP address in the second handshake message carrying the second IP address into the first IP address according to the second conversion rule, and obtains the first IP address. The second handshake packet of the first IP address; the firewall module sends the second handshake packet carrying the first IP address to the local service module.

In a third aspect, a wireless broadband router is provided, the wireless broadband router works in a bridge mode, a first IP address and an SNAT rule are stored in the wireless broadband router, and the SNAT rule is used to convert the first IP address to the second IP address, The first IP address is the pseudo address of the wireless broadband router in the local area network, and the second IP address is the IP address of the wireless broadband router in the wide area network; the wireless broadband router includes: a processing unit and a communication unit; the communication unit is used for sending to the service server. The first handshake packet carrying the second IP address, the first handshake packet carrying the second IP address is used to request the establishment of a connection with the service server, and the source IP in the first handshake packet carrying the second IP address The address is the second IP address, and the destination IP address is the IP address of the service server; the communication unit is further configured to receive the second handshake message carrying the second IP address sent by the service server, and the second handshake message carrying the second IP address The handshake packet is sent by the service server to the wireless broadband router after receiving the first handshake packet carrying the second IP address. The source IP address in the second handshake packet carrying the second IP address is the service server. The IP address, the destination IP address is the second IP address; the processing unit is used to convert the second IP address in the received second handshake message carrying the second IP address into the first IP address according to the SNAT rule, A second handshake packet carrying the first IP address is obtained.

In a possible implementation manner, the processing unit is further configured to generate a first handshake packet carrying the first IP address, and according to the SNAT rule, the first IP address in the first handshake packet carrying the first IP address is The address is converted into the second IP address, and the first handshake packet carrying the second IP address is obtained. The source IP address in the first handshake packet carrying the first IP address is the first IP address, and the destination IP address is the service The IP address of the server.

In a fourth aspect, a message processing device is provided, comprising: a processor; the processor is connected to a memory, the memory is used to store computer-executed instructions, and the processor executes the computer-executed instructions stored in the memory, so that the message processing device realizes the first Any of the two methods provided. Exemplarily, the memory and the processor may be integrated together, or may be independent devices. In the latter case, the memory may be located in the message processing device or outside the message processing device. The message processing device may exist in the form of a chip product.

A fifth aspect provides a message processing device, comprising: a processor and an interface, the processor is coupled to the memory through the interface, and when the processor executes the computer program or instructions in the memory, any one of the methods provided in the second aspect is made method is executed.

In a sixth aspect, a computer-readable storage medium is provided, including instructions, which, when executed on a computer, cause the computer to implement any one of the methods provided in the second aspect.

In a seventh aspect, there is provided a computer program product comprising instructions, which, when the instructions are executed on a computer, enable the computer to implement any one of the methods provided in the second aspect. For the technical effects brought by any one of the implementation manners of the second aspect to the seventh aspect, reference may be made to the technical effects brought by the corresponding implementation manners in the first aspect, which will not be repeated here.

In an eighth aspect, a wireless broadband router is provided. The wireless broadband router works in a bridge mode. The wireless broadband router includes a DNS domain name request interception module, a DNS domain name resolution proxy module, and a DNS domain name resolution response module. The DNS domain name request interception module stores a The first domain name; the DNS domain name request interception module, configured to receive the first DNS domain name resolution request sent by the first terminal, the first DNS domain name resolution request carries the second domain name, and the first DNS domain name resolution request is used to request to resolve the second domain name domain name; the DNS domain name request interception module is further configured to send a second DNS domain name resolution request to the DNS domain name resolution proxy module when it is determined that the second domain name is the same as the first domain name, where the second DNS domain name resolution request carries the first domain name resolution request domain name; in response to receiving the second DNS domain name resolution request, the DNS domain name resolution proxy module is used to determine the maintenance IP address of the wireless broadband router corresponding to the first domain name; the DNS domain name resolution proxy module is also used to respond to the DNS domain name resolution The module sends a first message, and the first message carries the maintenance IP address; the DNS domain name resolution response module is used to receive the first message; the DNS domain name resolution response module is further configured to send a response to the first DNS domain name resolution request to the first terminal , the response of the first DNS domain name resolution request includes the maintenance IP address. The wireless broadband router provided in the eighth aspect, by intercepting and parsing the DNS domain name resolution request for accessing the local domain name, can make the wireless broadband router work in the bridge mode, the user can normally access the web maintenance page of the local domain name through the terminal , configure and view the operating parameters of the wireless broadband router, reduce the maintenance complexity of the wireless broadband router, improve the upgrade efficiency of the wireless broadband router, and improve the user experience.

In a possible implementation manner, the DNS domain name request interception module is further configured to send a third DNS domain name resolution request to the DNS server when it is determined that the second domain name is different from the first domain name, and the third DNS domain name resolution request is Carry a second domain name. In this possible implementation, when the user accesses a non-first domain name (ie, a non-local domain name), the DNS domain name request interception module does not intercept the DNS domain name resolution request, but sends the DNS domain name resolution request to the DNS server, so that the DNS server Determine the IP address corresponding to the domain name accessed by the user to ensure that the user can access non-local domain names normally.

In a possible implementation manner, the DNS domain name resolution proxy module stores a corresponding relationship between the first domain name and the maintenance IP address; the DNS domain name resolution proxy module is specifically configured to determine the corresponding relationship with the first domain name according to the corresponding relationship. Maintain IP addresses. In this possible implementation, by storing the correspondence between the first domain name (that is, the local domain name) and the maintenance IP address in the DNS domain name resolution proxy module, the DNS domain name resolution proxy module can determine the local machine according to the local domain name The maintenance IP address corresponding to the domain name ensures that users can access the local domain name normally.

In a possible implementation manner, the wireless broadband router further includes a bridging module; the bridging module is used to send the first domain name to the DNS domain name request interception module; in response to receiving the first domain name, the DNS domain name request interception module is also used to save first domain name. In this possible implementation, the DNS domain name request interception module can compare the first domain name with the second domain name when receiving the DNS domain name resolution request by saving the first domain name, so as to determine whether to intercept the DNS domain name resolution request.

In a possible implementation manner, the DNS domain name resolution response module is further configured to parse the first message, and generate a response to the first DNS domain name resolution request according to the parsed maintenance IP address.

In a possible implementation manner, the first DNS domain name resolution request and the second DNS domain name resolution request further include a source IP address and a destination IP address, where the source IP address is the IP address of the first terminal, and the destination IP address is the DNS server IP address. In this possible implementation manner, by carrying the source IP address and the destination IP address in the DNS domain name resolution request, the device receiving the DNS domain name resolution request can determine which device sent the request and to which device, so that the correct is forwarded or processed on the device.

A ninth aspect provides a domain name resolution method, which is applied to a wireless broadband router, the wireless broadband router works in a bridge mode, and the wireless broadband router includes: a DNS domain name request interception module, a DNS domain name resolution proxy module, and a DNS domain name resolution response module, DNS The domain name request interception module stores the first domain name, and the method includes: the DNS domain name request interception module receives the first DNS domain name resolution request sent by the first terminal, the first DNS domain name resolution request carries the second domain name, and the first DNS domain name resolution request The request is used to request to resolve the second domain name; the DNS domain name request interception module sends a second DNS domain name resolution request to the DNS domain name resolution proxy module when it is determined that the second domain name is the same as the first domain name, and the second DNS domain name resolution request carries There is a first domain name; in response to receiving the second DNS domain name resolution request, the DNS domain name resolution proxy module determines the maintenance IP address of the wireless broadband router corresponding to the first domain name; the DNS domain name resolution proxy module sends the first DNS domain name resolution response module. message, the first message carries the maintenance IP address; the DNS domain name resolution response module receives the first message; the DNS domain name resolution response module sends a response to the first DNS domain name resolution request to the first terminal, and the response to the first DNS domain name resolution request includes Maintain IP addresses.

In a possible implementation manner, the method further includes: when the DNS domain name request interception module determines that the second domain name is different from the first domain name, sending a third DNS domain name resolution request to the DNS server, the third DNS domain name resolution request carries the second domain name in the .

In a possible implementation manner, the DNS domain name resolution proxy module stores the correspondence between the first domain name and the maintenance IP address, and the DNS domain name resolution proxy module determines the maintenance IP address of the wireless broadband router corresponding to the first domain name , including: the DNS domain name resolution proxy module determines the maintenance IP address corresponding to the first domain name according to the corresponding relationship.

In a possible implementation manner, the wireless broadband router further includes a bridging module; the method further includes: the bridging module sends the first domain name to the DNS domain name request interception module; in response to receiving the first domain name, the DNS domain name request interception module saves the first domain name domain name.

In a possible implementation manner, before the DNS domain name resolution response module sends a response to the first DNS domain name resolution request to the first terminal, the method further includes: the DNS domain name resolution response module parses the first message, and analyzes the first message according to the resolution. The output maintenance IP address generates a response to the first DNS domain name resolution request.

In a possible implementation manner, the first DNS domain name resolution request and the second DNS domain name resolution request further include a source IP address and a destination IP address, where the source IP address is the IP address of the first terminal, and the destination IP address is the DNS server IP address.

A tenth aspect provides a domain name resolution method, which is applied to a wireless broadband router, the wireless broadband router works in a bridge mode, and the wireless broadband router stores a first domain name; the method includes: the wireless broadband router receives a first domain name from a first terminal. A DNS domain name resolution request, the first DNS domain name resolution request carries the second domain name, and the first DNS domain name resolution request is used to request resolution of the second domain name; when the wireless broadband router determines that the second domain name is the same as the first domain name, Determine the maintenance IP address of the wireless broadband router corresponding to the first domain name; the wireless broadband router sends a response to the first DNS domain name resolution request to the first terminal, and the response to the first DNS domain name resolution request includes the maintenance IP address.

In a possible implementation manner, the method further includes: when the wireless broadband router determines that the second domain name is different from the first domain name, sending a third DNS domain name resolution request to the DNS server, where the third DNS domain name resolution request carries There is a second domain name.

In a possible implementation manner, the wireless broadband router stores the correspondence between the first domain name and the maintenance IP address.

In a possible implementation manner, the first DNS domain name resolution request further includes a source IP address and a destination IP address, where the source IP address is the IP address of the first terminal, and the destination IP address is the IP address of the DNS server.

In an eleventh aspect, a wireless broadband router is provided, the wireless broadband router works in a bridge mode, and the wireless broadband router stores a first domain name; the wireless broadband router includes: a processing unit and a communication unit; A first DNS domain name resolution request from a terminal, the first DNS domain name resolution request carries the second domain name, and the first DNS domain name resolution request is used to request to resolve the second domain name; the processing unit is used to determine the relationship between the second domain name and the first domain name. In the case of the same domain name, determine the maintenance IP address of the wireless broadband router corresponding to the first domain name; the communication unit is further configured to send to the first terminal a response to the first DNS domain name resolution request, a response to the first DNS domain name resolution request This includes maintaining IP addresses.

In a possible implementation manner, the communication unit is further configured to send a third DNS domain name resolution request to the DNS server when it is determined that the second domain name is different from the first domain name, where the third DNS domain name resolution request carries the third DNS domain name resolution request. Second domain name.

A twelfth aspect provides a domain name resolution device, comprising: a processor; the processor is connected to a memory, the memory is used to store computer execution instructions, and the processor executes the computer execution instructions stored in the memory, so that the domain name resolution device realizes the ninth Any one of the methods provided in the aspect, or, implement any one of the methods provided by the tenth aspect. Exemplarily, the memory and the processor may be integrated together, or may be independent devices. In the latter case, the memory may be located in the domain name resolution device or outside the domain name resolution device. The domain name resolution device may exist in the form of a chip.

A thirteenth aspect provides a domain name resolution apparatus, comprising: a processor and an interface, the processor is coupled with the memory through the interface, and when the processor executes the computer program or instructions in the memory, any one of the methods provided in the ninth aspect is made The method, or any one of the methods provided by the tenth aspect is performed.

A fourteenth aspect provides a computer-readable storage medium, comprising instructions that, when the instructions are run on a computer, cause the computer to execute any one of the methods provided in the ninth aspect, or, any one of the methods provided in the tenth aspect method.

A fifteenth aspect provides a computer program product containing instructions that, when the instructions are run on a computer, cause the computer to execute any one of the methods provided in the ninth aspect, or any one of the methods provided in the tenth aspect.

For the technical effect brought by any one of the implementation manners of the ninth aspect to the fifteenth aspect, reference may be made to the technical effect brought by the corresponding implementation manner in the eighth aspect, which will not be repeated here.

A sixteenth aspect provides a domain name resolution system, including: a first terminal and a wireless broadband router, the wireless broadband router works in a bridge mode, and the wireless broadband router stores a first domain name; Send a first DNS domain name resolution request, where the first DNS domain name resolution request carries the second domain name, and the first DNS domain name resolution request is used to request resolution of the second domain name; in response to receiving the first DNS domain name resolution request, the wireless broadband router uses In the case where it is determined that the second domain name is the same as the first domain name, the maintenance IP address of the wireless broadband router corresponding to the first domain name is determined; the wireless broadband router is also used to send the first DNS domain name resolution request to the first terminal. In response, the response of the first DNS domain name resolution request includes the maintenance IP address; in response to receiving the response of the first DNS domain name resolution request, the first terminal is further configured to access the Web maintenance page of the wireless broadband router according to the maintenance IP address.

In a possible implementation manner, the domain name resolution system further includes: a DNS server; and a wireless broadband router, which is further configured to send a third DNS domain name resolution request to the DNS server when it is determined that the second domain name is different from the first domain name, The third DNS domain name resolution request carries the second domain name; in response to receiving the third DNS domain name resolution request, the DNS server is used to determine the IP address corresponding to the second domain name; the DNS server is also used to send to the first terminal In response to the third DNS domain name resolution request, the response to the third DNS domain name resolution request includes the IP address corresponding to the second domain name; in response to receiving the response to the third DNS domain name resolution request, the first terminal is further configured to The IP address corresponding to the domain name accesses the web page corresponding to the second domain name.

For the technical effects brought by any one of the implementations in the sixteenth aspect, reference may be made to the technical effects brought by the corresponding implementations in the eighth aspect, which will not be repeated here.

It should be noted that, on the premise that the solutions are not contradictory, the solutions in the above aspects can be combined.

Description of drawings

1 is a schematic diagram of a network architecture when a wireless broadband router provided by an embodiment of the present application is in a routing mode;

2 is a schematic flowchart of domain name resolution when a wireless broadband router provided by an embodiment of the present application is in routing mode;

3 is a schematic diagram of a network architecture when a wireless broadband router provided by an embodiment of the present application is in a bridge mode;

4 is a schematic diagram of IP address allocation when a wireless broadband router provided by an embodiment of the present application is in bridge mode;

5 is a flowchart of domain name resolution when a wireless broadband router provided by an embodiment of the present application is in bridge mode;

6 is a schematic diagram of the composition of a wireless broadband router according to an embodiment of the present application;

FIG. 7 is a flowchart of a message processing method provided by an embodiment of the present application;

8 is a flowchart of another packet processing method provided by an embodiment of the present application;

FIG. 9 is a schematic diagram of the composition of another wireless broadband router provided by an embodiment of the present application;

10 is a flowchart of a method for domain name resolution provided by an embodiment of the present application;

11 is a flowchart of another method for domain name resolution provided by an embodiment of the present application;

12 is a flowchart of another method for domain name resolution provided by an embodiment of the present application;

13 is a schematic diagram of the composition of another wireless broadband router provided by an embodiment of the present application;

14 is a schematic diagram of a hardware structure of a wireless broadband router provided by an embodiment of the application;

FIG. 15 is a schematic diagram of a hardware structure of another wireless broadband router provided by an embodiment of the present application.

Detailed ways

In the description of this application, unless otherwise specified, "/" means or means, for example, A/B can mean A or B. In this article, "and/or" is only an association relationship to describe the associated objects, which means that there can be three kinds of relationships, for example, A and/or B, which can mean that A exists alone, A and B exist at the same time, and B exists alone these three situations. In the description of this application, unless stated otherwise, "at least one" means one or more, and "plurality" means two or more.

In addition, in order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish the same or similar items with basically the same function and effect. Those skilled in the art can understand that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like are not necessarily different.

The technical solutions of the embodiments of the present application can be applied to 4G systems, various systems based on 4G system evolution, 5G systems, and various systems based on 5G system evolution. The 4G system may also be called an evolved packet system (EPS). The core network (CN) of the 4G system may be called an evolved packet core (EPC), and the access network may be called long term evolution (LTE). The core network of the 5G system can be called 5GC (5G core), and the access network can be called new radio (NR).

For the convenience of understanding the following, some concepts involved in this application are briefly introduced first.

Domain Name: Also known as a domain, it is the name of a computer or computer group on a network consisting of a string of names separated by dots, which is used to locate and identify computers during data transmission (sometimes also referred to as geographic location). Domain names include local domain names and public domain names. The public domain name may be, for example, www.XXX.com, www.XXX.cn, and the like. There is no fixed form for native domain names.

Domain name resolution: It is a service that resolves a domain name into an IP address, allowing users to easily access a website by accessing the domain name. It is completed by the domain name system (DNS). Although an internet protocol (IP) address can uniquely identify a computer on a network, an IP address is a long string of numbers, such as 14.215.177.39, 111.230.159.21, 192.168.8.200, 192.168.8.100, etc., which is not enough. Intuitive, and it is very inconvenient for users to remember. The domain name and IP address are mapped to each other through DNS, so that users can access the website more conveniently. Users only need to know the easy-to-remember domain name, instead of memorizing the domain name that can be directly read by the machine. IP address. For example, if the domain name www.XXX.com and the IP address 14.215.177.39 are mapped to each other, when the user accesses www.XXX.com through the terminal, the DNS can resolve the domain name www.XXX.com to the IP address 14.215.177.39 and return it to the terminal, The terminal can access the website by visiting the IP address 14.215.177.39.

Local domain name: The local domain name of a device (eg, device 1 ) refers to the domain name of the local domain where device 1 is located (the domain where the current network to which device 1 is attached is located). Not filed in the public network, only other devices (eg, device 2) in the local area network (LAN) can access. The mapping between the local domain name and the IP address of the device 1 is implemented by the DNS domain name resolution proxy module in the device 1 . A LAN can also be called a private network or an intranet. The method of Internet access for the local domain name is: the user enters the local domain name in device 2 - device 2 sends a DNS domain name resolution request to device 1 - the DNS domain name resolution proxy module in device 1 resolves the local domain name into an IP address And return to the device 2 - the device 2 accesses the IP address - to the access destination.

Public domain name: The domain name registered in the WAN can be accessed by anyone. WAN can also be called public network or external network. The mapping between the public domain name and the IP address is realized by the DNS server in the WAN. A DNS server is a server that provides translation services between IP addresses and domain names. The Internet access method for the public domain name is as follows: the user enters the public domain name on the device 3 - the device 3 sends a DNS domain name resolution request to the DNS server - the DNS server parses the public domain name into an IP address and returns it to the device 3 - Device 3 accesses the IP address—reaches the access destination.

Firewall: Firewall technology is to help computer networks build a relatively isolated protective barrier between internal and external networks by organically combining various software and hardware devices for security management and screening to protect user data and information security. a technology.

Firewall rules: Firewall rules are rules used to isolate some information between internal and external networks. For example, the source network address translation (SNAT) rule can prevent the external network from obtaining the IP address of the device in the internal network.

WAN side IP address of the wireless broadband router: The IP address assigned by the operator is used to identify the wireless broadband router in the WAN.

Maintenance IP address of the wireless broadband router: The factory-set IP address of the wireless broadband router is used to identify the wireless broadband router in the LAN. Each wireless broadband router has a unique maintenance IP address. The maintenance IP address of the wireless broadband router may also be called the gateway address of the wireless broadband router.

The above is a brief introduction to some concepts involved in this application.

In order to reduce wiring costs and improve the mobility of routers, routers have evolved from traditional home routers using optical fiber access to wireless broadband routers. Taking the wireless broadband router as a boundary, the wireless broadband router and connected devices (eg, home routers, terminals, etc.) belong to the LAN, and the wireless broadband router and above belong to the WAN. Wireless broadband routers can work in two modes. One mode is routing mode and the other mode is bridge mode.

When the wireless broadband router works in routing mode, see Figure 1, the wireless broadband router occupies the DNS server IP address and the WAN side IP assigned by the operator (for example, a dynamic host configuration protocol (DHCP) server) to the wireless broadband router address, the wireless broadband router assigns the WAN side IP address and the DNS server IP address to the terminal (for example, personal computer (PC), mobile phone or tablet computer, etc.) connected to it, and the DNS server IP address assigned to the terminal is used for the terminal. The destination IP address of the domain name request. For example, referring to Figure 1, the wireless broadband router assigns the PC an IP address of 192.168.9.100 and a DNS server IP address of 192.168.8.1. In routing mode, the DNS server IP address assigned by the wireless broadband router to the terminal may be the same as the maintenance IP address of the wireless broadband router, or it may be different from the maintenance IP address of the wireless broadband router. Since it is generally the same, therefore, in this application The method provided by the present application is exemplified by taking that the IP address of the DNS server allocated to the terminal is the same as the maintenance IP address of the wireless broadband router as an example. Taking a PC as an example, when a user logs in to the World Wide Web (web) maintenance page of the wireless broadband router on the PC using the local domain name of the wireless broadband router (it is assumed to be cpe.win in this application), the PC sends a message to the wireless broadband router. The destination IP address in the sent DNS domain name resolution request is the DNS server IP address assigned by the wireless broadband router to the PC (that is, the maintenance IP address 192.168.8.1 of the wireless broadband router). When the DNS domain name resolution request passes through the wireless broadband router, it will be directly transferred to the DNS domain name resolution proxy module of the wireless broadband router for resolution. The DNS domain name resolution proxy module resolves the local domain name to the maintenance IP address of the wireless broadband router according to the factory configuration and returns To the PC, after receiving the result of domain name resolution, the PC uses the maintenance IP address to access the web maintenance page of the wireless broadband router. In this case, referring to Figure 2, taking a PC as an example, the specific process includes:

201. The DNS domain name resolution proxy module in the wireless broadband router obtains the binding setting of the local domain name and the maintenance IP address in the factory setting. That is to say, the corresponding relationship between cpe.win and the maintenance IP address will be stored in the DNS domain name resolution proxy module. Exemplarily, the correspondence between the local domain name and the maintenance IP address may be expressed as: cpe.win→192.168.8.1.

202. The user opens the browser of the PC, and enters the local domain name cpe.win in the address bar of the browser.

203. The PC sends a DNS domain name resolution request to the DNS domain name resolution proxy module in the wireless broadband router. Among them, the DNS domain name resolution request includes the source IP address (src ip, that is, the IP address of the PC 192.168.9.100), the destination IP address (dst ip, that is, the DNS server IP address 192.168.8.1 configured for the PC) and the queried domain name ( query name, i.e. cpe.win).

204. The DNS domain name resolution proxy module in the wireless broadband router resolves the local domain name cpe.win to the maintenance IP address 192.168.8.1. The specific DNS domain name resolution proxy module can resolve the local domain name cpe.win to the corresponding maintenance IP address 192.168.8.1 according to the binding relationship between the local domain name and the maintenance IP address set by the factory.

205. The DNS domain name resolution proxy module in the wireless broadband router sends the maintenance IP address to the DNS domain name resolution response module in the wireless broadband router.

206. The DNS domain name resolution response module in the wireless broadband router generates (also can be described as assembling) a response to the DNS domain name resolution request, and the resolution result included in the response to the DNS domain name resolution request is the maintenance IP address 192.168.8.1.

207. The DNS domain name resolution response module in the wireless broadband router returns a response to the DNS domain name resolution request to the PC. Among them, the response of the DNS domain name resolution request includes the source IP address (src ip, that is, the maintenance IP address 192.168.8.1), the destination IP address (dst ip, that is, the IP address of the PC 192.168.9.100), the query domain name (query name, i.e. cpe.win) and the query result (answer, i.e. maintain the IP address 192.168.8.1).

208. The PC subsequently uses the maintenance IP address 192.168.8.1 to access the web maintenance page of the wireless broadband router.

With the development of 5G mobile communication technology, major operators have begun to gradually deploy 5G networks. Compared with the fourth generation (4th Generation, 4G) network, the working frequency of the 5G network is higher, and the higher the working frequency of electromagnetic waves, the worse the ability to bypass obstacles. Especially in cities with dense buildings, the quality of indoor communication is greatly affected. Therefore, referring to Figure 3, major operators have introduced a networking scheme of "wireless broadband router (outdoor) + home router (indoor)". The wireless broadband router works outdoors near the window, which can avoid the problem of indoor signal attenuation. At the same time, the home router is connected to the wireless broadband router through a network cable in a bridge mode (the wireless broadband router works in bridge mode at this time). In this solution, power over Ethernet (POE) is used to forward data between the wireless broadband router and the home router, and supply power to the wireless broadband router and the home router. The wireless broadband router provides the ability to access the Internet, and the home router provides The ability of terminal access is improved, and the two routers open up the Internet access in a bridge mode, giving full play to the advantages of high bandwidth and low latency of the 5G network.

When the outdoor wireless broadband router works in bridge mode, see Figure 4, it will send the DNS server IP address and the WAN side IP address assigned by the operator to the wireless broadband router to the indoor home router. The WAN side IP address assigned by itself does not occupy the IP address of the DNS server. It is completely transparent to the WAN. It only provides the transparent transmission capability of wireless Internet access, and transparently transmits all received packets. For example, referring to Figure 4, the wireless broadband router sends the DNS server IP address 10.98.48.123 and the WAN side IP address 10.62.17.183 assigned by the operator to the wireless broadband router to the indoor home router. The home router assigns an IP address and a DNS server IP address to the connected terminal, for example, assigns the PC an IP address of 192.168.9.100. Here, because the wireless broadband router does not have the gateway capability and cannot assign the DNS server IP address, the home router assigns the DNS server IP address to the connected terminal (here, the DNS server IP address assigned to the terminal is the one received from the wireless broadband router. DNS server IP address 10.98.48.123). Taking a PC as an example, when using the local domain name cpe.win of the wireless broadband router to log in to the web maintenance page of the wireless broadband router, the destination IP address in the DNS domain name resolution request is the DNS server IP address 10.98.48.123 assigned to the terminal, but Since cpe.win is a local domain name, it is not recorded in the WAN, that is, the DNS server will not store the corresponding relationship between the local domain name cpe.win and the maintenance IP address. Therefore, the DNS server cannot resolve the native domain name. Therefore, the PC cannot use cpe.win to access the web maintenance page of the wireless broadband router, and thus cannot view and configure the running network parameters of the wireless broadband router (for example, store dial-up parameters, view device status, view wireless fidelity, wifi) parameters, check if there is new firmware to upgrade, etc.), which brings difficulties to users and maintainers. Referring to Figure 5, taking a PC as an example, the specific process includes:

501 , same as step 201 , see step 201 .

502 , same as step 202 , see step 202 .

503. The PC sends a DNS domain name resolution request to the DNS server. Among them, the DNS domain name resolution request includes the source IP address (src ip, that is, the IP address of the PC 192.168.9.100), the destination IP address (dst ip, that is, the DNS server IP address 10.98.48.123) and the query domain name (query name, that is, cpe.win).

When step 503 is specifically implemented, the DNS domain name resolution request sent by the PC first reaches the wireless broadband router, because when the wireless broadband router works in bridge mode, it does not occupy the WAN side IP address allocated for itself, nor does it occupy the DNS server IP address, It is completely transparent to the WAN, only provides the transparent transmission capability of wireless Internet access, and transparently transmits all received packets. Therefore, after receiving the DNS domain name resolution request, the wireless broadband router will send the received DNS domain name resolution request. Sent to the DNS server.

504. Since cpe.win is not registered in the WAN, the DNS server resolution fails.

505. The DNS server returns a response to the DNS domain name resolution request to the PC. Among them, the response of the DNS domain name resolution request includes the source IP address (src ip, that is, the DNS server IP address 10.98.48.123), the destination IP address (dst ip, that is, the IP address of the PC 192.168.9.100), the query domain name (query name) , namely cpe.win) and the query result (answer). The query result here is an error.

506. Because the parsing fails, the PC cannot log in to the web maintenance page of the wireless broadband router.

When the wireless broadband router works in the routing mode, the user can normally log in to the web maintenance page of the wireless broadband router through the terminal. When the wireless broadband router works in bridge mode, the user cannot log in to the web maintenance page of the wireless broadband router normally through the terminal. However, due to security loopholes and other reasons, there are many scenarios in which the firmware of wireless broadband routers is upgraded. Since it is in bridge mode, it is not possible to view and configure operating network parameters. Therefore, only the maintenance personnel of the operator regularly visit users, temporarily split the networking scheme of "wireless broadband router + home router", and disconnect the two. Access the PC under the wireless broadband router and change the working mode from bridge mode to routing mode, log in to the web maintenance page of the wireless broadband router through the maintenance IP address, enter the upgrade management and maintenance page, and manually perform online firmware upgrade operations. After the firmware upgrade is completed, it will return to the bridge mode and the networking mode of "wireless broadband router + home router". This solution, in order to maintain and upgrade the wireless broadband router, requires the operator's maintenance personnel to go to the user's home to change the networking scheme, which has a great impact on the user's use; at the same time, there is a certain delay in manual maintenance, which is a major security vulnerability. If the upgrade is not timely, it is easy to cause network security problems; the maintenance method is complicated, and the user experience is difficult to operate.

In addition, when the wireless broadband router works in the bridge mode, the operator has a requirement for device management of the wireless broadband router. However, after the wireless broadband router does not have an IP address on the WAN side, it loses its independent identity in the WAN, so that the wireless broadband router needs to communicate with the server in the WAN (for example, Over-The-Air (OTA) server, operator technology Report 069 (Technical Report-069, TR069) server) communication's local business (wireless broadband router's own business, such as OTA online upgrade, TR069 device management) cannot be performed normally.

That is to say, due to the bridge mode, the wireless broadband router will have two problems:

Problem 1. The local business of the wireless broadband router and the server in the WAN cannot be carried out normally.

Problem 2. The maintenance of wireless broadband routers is complicated and the upgrade lags.

Among them, the reason for problem 1 is that the wireless broadband router does not occupy the IP address on the WAN side and loses its independent identity in the WAN. The reason for problem 2 is that because the wireless broadband router does not occupy the IP address on the WAN side and loses its independent identification in the WAN, it can only provide the transparent transmission capability of wireless Internet access. After the wireless broadband router receives the DNS domain name resolution request, it transparently It is transmitted to the DNS server in the WAN, but the DNS server cannot resolve the local domain name in the DNS domain name resolution request, so that the user cannot access the web maintenance page of the wireless broadband router.

In order to solve these two problems, the present application provides the following first and second embodiments. Solve problems such as complicated maintenance and lagging upgrade of wireless broadband routers. In the first embodiment and the second embodiment, the wireless broadband router still works in the bridge mode, and it is not necessary to change the working mode of the wireless broadband router and the on-site networking environment. The methods provided in the embodiments of the present application can be applied to the bridging scenario of the "wireless broadband router + home router" networking scenario, and can also be applied to the bridging scenario of all routing devices, without limitation.

Example 1

In the first embodiment, when the wireless broadband router works in bridge mode, a first IP address can be set for the wireless broadband router (the first IP address is the pseudo IP address of the wireless broadband router in the LAN, not the real IP address, this In the specific implementation manner of the application, the first IP address is called a pseudo IP address), and the pseudo IP address and the second IP address (the second IP address is the wireless broadband) in the message (for example, the handshake message) are analyzed by using the firewall SNAT technology. The IP address of the router in the WAN, that is, the WAN side IP address of the wireless broadband router, the second IP address is referred to as the WAN side IP address in the specific implementation of this application) is converted, that is, the pseudo IP address is used inside the wireless broadband router, When the message is sent to the WAN, the IP address of the WAN side is used, so as to achieve the purpose of identifying the wireless broadband router by the WAN, and then realize the normal operation of the local service of the communication between the wireless broadband router and the server in the WAN.

Referring to FIG. 6 , the functional modules of the wireless broadband router involved in the message processing method provided by the first embodiment include: a local service module located in the application state (the local service module can provide local services such as OTA services, TR069 services, etc.) ) and bridging modules, firewall modules (eg, Netfilter modules) located in the Linux kernel routing stack. Embodiment 1 mainly improves the bridge module and the firewall module. The functions of each module are as follows:

Bridge module: used to set a pseudo IP address for the wireless broadband router in bridge mode.

Firewall module: This module is a standard open source module of the Linux kernel routing protocol stack, which is used to handle common functions such as packet filtering, address translation (NAT) translation, and packet forwarding of the firewall. In the first embodiment, it is mainly used for the processing of SNAT rules, for example, to determine when to use the WAN side IP address and when to use the pseudo IP address, and to convert the WAN side IP address and the pseudo IP address. The SNAT rules of the firewall module can be configured and managed through configuration tools (for example, application-mode iptables). Specifically, the bridging module can send SNAT rules to iptables, and iptables receives the SNAT rules set by the bridging module, and then sends them to the firewall module to take effect.

Local service module: Local service refers to the service of the wireless broadband router itself, such as OTA online upgrade, TR069 device management, etc. These services need to establish communication with the corresponding service server in the WAN to transmit data. There is no data exchange between the local service and the home router and the terminal in the LAN.

For more specific functions of each module, please refer to each step below. Referring to FIG. 7 , the packet processing method provided by Embodiment 1 includes:

701. The bridging module sets the IP address of the wireless broadband router in the LAN as a pseudo IP address.

Specifically, the bridging module may perform step 701 after the wireless broadband router is powered on, the system is started, and the wireless broadband router works in the bridge mode. The pseudo IP address belongs to the IP address of the private network segment. The IP address of the private network segment is used in the LAN, and the IP address of the private network segment cannot be accessed through the WAN. The pseudo IP address can be stored in the bridge module. When the wireless broadband router works in bridge mode, the bridge module sets the IP address of the wireless broadband router in the LAN as a pseudo IP address (it can be understood as making the pseudo IP address effective). When the wireless broadband router works in routing mode, the IP address of the wireless broadband router in the LAN can be the maintenance IP address by default, or the bridge module can set the IP address of the wireless broadband router in the LAN as the maintenance IP address (which can be understood as Make the maintenance IP address take effect). Exemplarily, the pseudo IP address may be 172.28.28.28.

702. The bridging module delivers the SNAT rule to the firewall module.

When step 702 is specifically implemented, the bridging module may issue SNAT rules to the firewall module through iptables. The SNAT rule is used to convert the pseudo IP address in the packet to the WAN side IP address. Specifically, the SNAT rule is used to convert the pseudo IP address in the packet whose source IP address is the pseudo IP address to the WAN side IP address. The message here may be a handshake message hereinafter. Exemplarily, the WAN side IP address of the wireless broadband router is 10.62.17.183. Exemplarily, the SNAT rule can be expressed as: iptables-t nat-A POSTROUTING-s 172.28.28.28-j SNAT--to-source 10.62.17.183. Among them, "iptables" indicates that the configuration tool is iptables, "t nat-A POSTROUTING" indicates that the rule is added to the main chain named POSTROUTING in the table named nat, and "s 172.28.28.28" indicates the IP address before modification It is 172.28.28.28, "SNAT" indicates that the firewall rule is a SNAT rule, and "to-source 10.62.17.183" indicates that the modified IP address is 10.62.17.183.

703. The firewall module takes the received SNAT rule into effect.

When step 703 is specifically implemented, validating the SNAT rule includes: storing the correspondence between the pseudo IP address and the WAN side IP address. After receiving the SNAT rule sent by the bridging module, the firewall module parses the SNAT rule, and generates a first translation rule and a second translation rule according to the SNAT rule. The first conversion rule is used to carry the pseudo IP in the judgment packet (for example, the handshake packet received by the firewall module from the local service module, such as the first handshake packet and the third handshake packet below) In the case of an address, the pseudo IP address in the message is converted into the WAN side IP address, and the second conversion rule is used to determine the message (for example, the handshake message received by the firewall module from the service server, such as the following In the case that the WAN side IP address is carried in the second handshake message), the WAN side IP address in the message is converted into a pseudo IP address.

Exemplarily, the firewall module may establish an internal hook function (hook function) corresponding to the SNAT rule to detect whether the packet satisfies the SNAT rule, so as to precisely match the packet.

704. The bridging module sends a pseudo IP address to the local service module.

When step 704 is specifically implemented, the bridging module may spontaneously send a pseudo IP address to the local service module after step 701. At this time, step 704, step 702 and step 703 are executed in no particular order. In another case, the local service module can send a request message to the bridging module when needed (for example, when it is determined to establish a connection with the service server), the request message is used to request a pseudo IP address, and the bridging module can The request message sends a pseudo IP address to the local service module, and the pseudo IP address may be carried in the response message of the request message.

705. The local service module establishes a connection with the service server.

It should be noted that the local service is generally a self-starting, fixed-cycle service, such as OTA online upgrade. Every 24 hours, the local OTA upgrade module actively establishes a connection with the OTA server in the WAN to check whether there is new firmware.

When step 705 is specifically implemented, the local service module may establish a connection with the service server when the execution period of the service arrives. Taking the OTA online upgrade as an example, the local OTA upgrade module can establish a connection with the OTA server in the WAN when the execution period of the OTA online upgrade service arrives.

When step 705 is specifically implemented, the local service module and the service server can perform three-way handshake, and in the process of the three-way handshake, the firewall module will receive the received data from the local service module according to the SNAT rule (specifically according to the first conversion rule). The pseudo IP address in the handshake packet is replaced with the WAN side IP address, and sent to the service server, and the WAN side IP address in the received handshake packet from the service server is also changed according to the SNAT rule (specifically according to the second conversion rule). The address is replaced with a pseudo IP address and sent to the local service module.

Wherein, the specific implementation process of step 705 includes:

11) The local service module sends a first handshake message to the firewall module, and the first handshake message is used to request to establish a connection with the service server. The source IP address carried in the header of the first handshake packet is a pseudo IP address (ie 172.28.28.28), and the destination IP address is the IP address of the service server (it is assumed to be 118.194.55.121 in this application).

The first handshake message may be referred to as a connection establishment (synchronous, SYN) message.

12) The firewall module replaces the pseudo IP address (ie 172.28.28.28) in the first handshake message with the WAN side IP address (ie 10.62.17.183) according to the SNAT rule.

Step 12) During specific implementation, the firewall module replaces the pseudo IP address (ie 172.28.28.28) in the first handshake message with the WAN side IP address (ie 10.62.17.183) according to the first translation rule generated by the SNAT rule. . By converting the pseudo IP address in the first handshake packet to the WAN side IP address, the first handshake packet sent to the service server can carry the WAN side IP address, so that the service server can identify the packet.

Step 12) During concrete realization, the firewall module can determine whether the first handshake message matches the first conversion rule or the second conversion rule according to the source IP address and the destination IP address in the first handshake message, because the source IP If the address is a pseudo IP address, it is determined that the first handshake packet matches the first translation rule. In this case, go to step 12).

13) The firewall module sends the first handshake message to the service server. At this time, the source IP address in the packet header of the first handshake packet is the WAN side IP address (ie, 10.62.17.183).

After receiving the first handshake packet, the service server parses the first handshake packet, determines that the destination IP address in the first handshake packet is the same as the IP address of the service server, and determines that the first handshake is completed.

14) The service server sends a second handshake message to the firewall module (which can also be considered as a response message to the first handshake message), and the source IP address in the header of the second handshake message is the service server's source IP address. The IP address (ie 118.194.55.121), and the destination IP address is the WAN side IP address (ie 10.62.17.183).

The second handshake message may be referred to as establishing a connection confirmation (synchronous-acknowledgement, SYN-ACK). The second handshake message is sent by the service server to the wireless broadband router after receiving the first handshake message.

15) After receiving the second handshake message, the firewall module replaces the WAN side IP address (ie 10.62.17.183) in the second handshake message with a pseudo IP address (ie 172.28.28.28) according to the SNAT rule.

Step 15) During specific implementation, the firewall module replaces the WAN side IP address (ie 10.62.17.183) in the second handshake message with a pseudo IP address (ie 172.28.28.28) according to the second translation rule generated by the SNAT rule . By converting the WAN side IP address in the second handshake packet into a pseudo IP address, the second handshake packet sent to the local service module can carry the pseudo IP address, so that the local service module can identify the fake IP address. message.

Step 15) when concretely realized, the firewall module can determine whether the second handshake message matches the first conversion rule or the second conversion rule according to the source IP address and the destination IP address in the second handshake message, because the destination IP If the address is the WAN side IP address, it is determined that the second handshake packet matches the second translation rule. In this case, go to step 15).

16) The firewall module sends a second handshake message to the local service module. At this time, the destination IP address in the packet header of the second handshake packet is a pseudo IP address (ie, 172.28.28.28).

After receiving the second handshake packet, the local service module parses the second handshake packet, determines that the destination IP address in the second handshake packet is the same as the pseudo IP address, and determines to complete the second handshake.

17) The local service module sends the third handshake message to the firewall module. The source IP address carried in the header of the third handshake message is the pseudo IP address (ie 172.28.28.28), and the destination IP address is the service server's. IP address (ie 118.194.55.121).

The third handshake message may be called an ACK message. The third handshake message is sent by the local service module to the firewall module after receiving the second handshake message.

18) The firewall module replaces the pseudo IP address (ie 172.28.28.28) in the third handshake message with the WAN side IP address (ie 10.62.17.183) according to the SNAT rule.

The specific implementation of step 18) is similar to that of step 12), which can be understood by reference, and will not be repeated here.

19) The firewall module sends a third handshake message to the service server. At this time, the source IP address in the packet header of the third handshake packet is the WAN side IP address (ie, 10.62.17.183).

After receiving the third handshake packet, the service server parses the third handshake packet, determines that the destination IP address in the third handshake packet is the same as the IP address of the service server, and determines that the third handshake is completed.

After the three-way handshake is successful, the local service module can perform data communication with the service server to realize local service.

In the first embodiment, the wireless broadband router and the service server communicate through the transmission control protocol (transmission control protocol, TCP) communication protocol. The Request For Comments (RFC) 793 specification issued by Engineering Task Force, IETF) does not involve changes in the message format and the TCP connection establishment process in Embodiment 1, so it will not be described in detail.

It should be noted that through the maintenance test interface of the wireless broadband router, the IP address configured on the current WAN port network card eth_x (network card name) of the wireless broadband router can be obtained, according to which the IP address of the wireless broadband router can be determined. Wherein, when the wireless broadband router works in routing mode, the IP address of the wireless broadband router is the IP address of the WAN side, and when the wireless broadband router works in bridge mode, the IP address of the wireless broadband router is a pseudo address. Exemplarily, by entering the "ifconfig" command on the maintenance test interface of the wireless broadband router, you can view the network card information of eth_x as follows:

root:/$ifconfig

eth_x Link encap:Ethernet HWaddr 58:02:03:04:05:06

inet addr: 172.28.28.28 Mask: 255.255.0.0

inet6 addr:fe80::5a02:3ff:fe04:506/64 Scope:Link

UP RUNNING MTU:1500 Metric:1

RX packets: 25 errors: 0 dropped: 0 overruns() frame: 0

TX packets: 25 errors: 0 dropped: 7 overruns() carrier: 0

collisions:()txqueuelen:1000

RX bytes: 8618(8.4KiB)TX bytes: 2629(2.5KiB)

Among them, "root:/$ifconfig" means "enter the command ifconfig in the root directory".

"eth_x Link encap:Ethernet HWaddr 58:02:03:04:05:06" is used to indicate the hardware type of the network card.

"inet addr: 172.28.28.28 Mask: 255.255.0.0" is used to indicate the IP address (IPv4 address) 172.28.28.28 of the network card and the mask 255.255.0.0 corresponding to the IP address.

"inet6 addr:fe80::5a02:3ff:fe04:506/64 Scope:Link" is used to indicate the IPv6 address of the network card fe80::5a02:3ff:fe04:506/64, and indicates that the IPv6 address is a link address.

"UP RUNNING MTU:1500 Metric:1" is used to indicate the running status of the current network card.

"RX packets: 25 errors: 0 dropped: 0 overruns() frame: 0

TX packets: 25 errors: 0 dropped: 7 overruns() carrier: 0

collisions:()txqueuelen:1000

RX bytes:8618(8.4KiB)TX bytes:2629(2.5KiB)" is used to indicate the status of the current network card's sending and receiving data packets.

It can be seen that by entering the "ifconfig" command on the maintenance test interface of the wireless broadband router, you can view the IP address of the wireless broadband router. In this example, the IP address is 172.28.28.28. The specific meanings of the parameters in this example are existing and will not be described again.

It should be noted that SNAT rules can also be obtained through the maintenance test interface of the wireless broadband router. Exemplarily, by entering the "iptables-t nat-nvl" command on the maintenance interface of the wireless broadband router, the firewall rules that can be viewed are as follows:

root:/$iptables-t nat-nvl

Chain POSTROUTING(policy ACCEPT 93 packets,5588bytes)

pkts bytes target prot opt in out source destination

101 6072 BRIDGE_LOCAL_SERVICE all--**0.0.0.0/0 0.0.0.0/0

Chain BRIDGE_LOCAL_SERVICE(1 references)

pkts bytes target prot opt in out source destination

40 2748 SNAT all--**172.28.28.28 0.0.0.0/0 to:10.62.17.183

Among them, "root:/$iptables-t nat-nvl" means "enter the command iptables-t nat-nvl in the root directory".

"Chain POSTROUTING(policy ACCEPT 93 packets, 5588bytes)

pkts bytes target prot opt in out source destination

101 6072 BRIDGE_LOCAL_SERVICE all--**0.0.0.0/0 0.0.0.0/0" means that the firewall rule of the main chain of POSTROUTING contains a sub-chain of BRIDGE_LOCAL_SERVICE.

"Chain BRIDGE_LOCAL_SERVICE(1 references)

pkts bytes target prot opt in out source destination

40 2748 SNAT all--**172.28.28.28 0.0.0.0/0 to:10.62.17.183" indicates the firewall rules of the sub-chain of BRIDGE_LOCAL_SERVICE. Specifically, "Chain BRIDGE_LOCAL_SERVICE" indicates "the chain where the firewall rules are located, where BRIDGE_LOCAL_SERVICE is The sub-chain of the bridge mode local service, the sub-chain is attached to the main chain POSTROUTING of the firewall"; "1 references" indicates the number of times it is referenced by other chains; "pkts" indicates the number of received packets, this is 40; "bytes" indicates the total number of bytes of received packets, here is 2748; "target" indicates the target rule hit by the firewall, here is the SNAT rule; "prot" indicates the network protocol applicable to the firewall rule , here is all, indicating that all network protocols are applicable; "opt" indicates an optional option for firewall rules, where "--" means it does not exist; "in" and "out" indicate which network card the packet is received from. In, which network card to send from, here are all * means any network card can be; "source" means the source IP address that needs to be replaced in the firewall rule, here is the pseudo IP address 172.28.28.28; "destination" means in the firewall rule Replace the source IP address, here is the WAN side IP address 10.62.17.183; "0.0.0.0/0" indicates that the firewall rule applies to all destination IP addresses.

In this example, the firewall rule of the subchain of BRIDGE_LOCAL_SERVICE is the SNAT rule above.

The method provided by the first embodiment, by setting the local IP address of the wireless broadband router as a pseudo IP address, and using SNAT rules to convert the pseudo IP address and the WAN side IP address, can make the wireless broadband working in bridge mode. The router normally performs local services, such as OTA online upgrade, so as to ensure the timely integration of major technical defects, requirements changes, security loopholes, etc., and improve product reliability.

In the first embodiment, the packet processing method provided by the present application is described by taking each module in the wireless broadband router as an example to perform the above method interactively. The process shown in 8 is realized, including:

801. The wireless broadband router sends a first handshake packet carrying the IP address of the WAN side to the service server, the first handshake packet carrying the IP address of the WAN side is used to request to establish a connection with the service server, and the first handshake packet carrying the IP address of the WAN side is used to request the establishment of a connection with the service server. The source IP address in the one-time handshake packet is the IP address of the WAN side, and the destination IP address is the IP address of the service server. Correspondingly, the service server receives the first handshake message carrying the WAN side IP address from the wireless broadband router.

The wireless broadband router works in bridge mode, and the wireless broadband router stores pseudo IP addresses and SNAT rules, and the SNAT rules are used to convert the pseudo IP addresses into WAN side IP addresses.

Optionally, referring to FIG. 8, before step 801, the method further includes step 800a and step 800b:

800a. The wireless broadband router generates a first handshake packet carrying a pseudo IP address, where the source IP address in the first handshake packet carrying the pseudo IP address is the pseudo IP address, and the destination IP address is the IP address of the service server.

800b, the wireless broadband router converts the pseudo IP address in the first handshake packet carrying the pseudo IP address into the WAN side IP address according to the SNAT rule, and obtains the first handshake packet carrying the WAN side IP address.

802. The service server sends a second handshake packet carrying the IP address of the WAN side to the wireless broadband router. The second handshake packet is sent by the service server to the wireless broadband router after receiving the first handshake packet, and the second handshake packet is sent to the wireless broadband router. The source IP address in the second handshake packet is the IP address of the service server, and the destination IP address is the WAN side IP address. Correspondingly, the wireless broadband router receives the second handshake message that carries the IP address of the WAN side and is sent by the service server.

803. The wireless broadband router converts the WAN side IP address in the received second handshake message carrying the WAN side IP address into a pseudo IP address according to the SNAT rule.

Optionally, after step 803, referring to FIG. 8, the method further includes:

804. The wireless broadband router sends a third handshake packet carrying the IP address of the WAN side to the service server, and the source IP address in the third handshake packet carrying the IP address of the WAN side is the IP address of the WAN side, and the destination IP address is the service The IP address of the server. Correspondingly, the service server receives the third handshake message carrying the IP address of the WAN side from the wireless broadband router.

Similar to the first handshake packet, the third handshake packet carrying the WAN side IP address can also be obtained by converting the pseudo IP address in the third handshake packet carrying the pseudo IP address into the WAN side IP address. of. The third-way handshake message carrying the pseudo IP address can be generated by the wireless broadband router.

In addition, the wireless broadband router may also generate the above-mentioned first conversion rule and the above-mentioned second conversion rule according to the SNAT rule. For the related explanation and specific implementation of the method shown in FIG. 8 , refer to the embodiment shown in FIG. 7 . It only needs to be considered that the interaction between the various modules in the wireless broadband router does not exist, and the execution of the various modules in the wireless broadband router is performed. The actions can be understood as actions performed by the wireless broadband router, and will not be repeated here.

Embodiment 2

In the second embodiment, when the wireless broadband router works in the bridge mode, the terminal connected to the home router sends the first domain name (that is, the local domain name) to the wireless broadband router through the home router. The wireless broadband router will no longer transparently transmit the DNS domain name resolution request, but will intercept it, and resolve the local domain name to the maintenance IP address of the wireless broadband router, and then resolve the DNS domain name to the requested address. The response is returned to the terminal accessing the local domain name, so that the terminal connected to the home router can access the web maintenance page through the local domain name, and configure and view operating parameters.

Referring to FIG. 9 , the functional modules of the wireless broadband router involved in the domain name resolution method provided by the second embodiment include: a bridge module and a DNS domain name resolution proxy module located in the application state, and a DNS domain name request interception module located in the Linux kernel routing protocol stack. And DNS domain name resolution response module. The second embodiment adds a DNS domain name request interception module, and also improves the bridging module and the DNS domain name resolution response module. The functions of each module are as follows:

Bridging module: used to issue the local domain name to the DNS domain name request interception module.

DNS domain name resolution proxy module: used to receive the DNS domain name resolution request of the local domain name, and after successful resolution, send the resolution result to the DNS domain name resolution response module. The DNS domain name resolution proxy module stores the corresponding relationship between the local domain name and the maintenance IP address, and the corresponding relationship can be factory-set.

DNS domain name request interception module: used to filter all received DNS domain name resolution requests, intercept DNS domain name resolution requests for local domain names, and forward them to the DNS domain name resolution proxy module for resolution.

DNS domain name resolution response module: used to receive the resolution result after the DNS domain name resolution proxy module parses, generate a response to the DNS domain name resolution request according to the resolution result, and send it to the terminal that sends the DNS domain name resolution request.

For more specific functions of each module, please refer to each step below. The application scenario of the second embodiment may be: the user uses a terminal (for example, a PC, a mobile phone, a tablet computer, etc.) to enter the local domain name in the address bar of the browser, access the web maintenance page of the wireless broadband router, and view and set the wireless broadband router. operating network parameters. Referring to FIG. 10 , the domain name resolution method provided by the second embodiment includes:

1001. After the wireless broadband router is started, the bridge module sends the local domain name to the DNS domain name request interception module. Exemplarily, the local domain name may be cpe.win.

Among them, the bridging module can read the local domain name from the factory configuration of the wireless broadband router.

1002. The DNS domain name request interception module saves the domain name of the local machine for subsequent determination of which DNS domain name resolution request to intercept.

Specifically, the local domain name may be stored in the global memory of the wireless broadband router.

1003 , the user enters the local domain name cpe.win in the address bar of the browser on the terminal (assumed to be the first terminal) connected to the home router to access the web maintenance page of the wireless broadband router.

1004. The first terminal sends a first DNS domain name resolution request to the DNS domain name request interception module in the wireless broadband router, where the first DNS domain name resolution request carries the second domain name, and the first DNS domain name resolution request is used to request to resolve the second domain name .

In the embodiment shown in FIG. 10, the second domain name is cpe.win. The source IP address in the first DNS domain name resolution request is the IP address of the first terminal (assumed to be 192.168.9.100), the destination IP address is the DNS server IP address (assumed to be 10.98.48.123), and the query name is cpe.win.

1005. The DNS domain name request interception module compares the domain name (that is, the second domain name) queried by the first DNS domain name resolution request with the saved local domain name.

Specifically, when step 1005 is specifically implemented, the DNS domain name request interception module obtains the queried domain name (obtained through the query name field) after receiving the first DNS domain name resolution request, and compares the queried domain name with the saved local domain name.

1006. If the queried domain name is the same as the saved local domain name, the DNS domain name request interception module sends a second DNS domain name resolution request to the DNS domain name resolution proxy module.

The source IP address in the second DNS domain name resolution request is the IP address of the first terminal (ie 192.168.9.100), the destination IP address is the DNS server IP address (ie 10.98.48.123), and the query name is cpe. win.

The first DNS domain name resolution request and the second DNS domain name resolution request may be the same DNS domain name resolution request, or may be different DNS domain name resolution requests.

1007. The DNS domain name resolution proxy module resolves the local domain name in the second DNS domain name resolution request into a maintenance IP address (ie, 192.168.8.1). That is to say, the DNS domain name resolution proxy module determines the maintenance IP address of the wireless broadband router corresponding to the local domain name.

The DNS domain name resolution proxy module resolves the local domain name to the maintenance IP address according to the corresponding relationship between the local domain name and the maintenance IP address.

1008. The DNS domain name resolution proxy module sends a first message to the DNS domain name resolution response module, where the first message carries the maintenance IP address.

Further, the first message also carries the source IP address as the DNS server IP address (ie 10.98.48.123), the destination IP address as the IP address of the first terminal (ie 192.168.9.100), and the query domain name (query name) as cpe .win and other information.

1009. The DNS domain name resolution response module generates a response to the first DNS domain name resolution request according to the received first message. The response to the first DNS domain name resolution request includes the maintenance IP address.

Specifically, the DNS domain name resolution response module parses the first message, and generates a response to the first DNS domain name resolution request according to the parsed maintenance IP address.

1010. The DNS domain name resolution response module sends a response to the first DNS domain name resolution request to the first terminal.

The source IP address in the response of the first DNS domain name resolution request is the DNS server IP address (ie 10.98.48.123), the destination IP address is the IP address of the first terminal (ie 192.168.9.100), and the query name is cpe.win, the query result (answer) is the maintenance IP address (ie 192.168.8.1).

1011. The first terminal uses the maintenance IP address to access the web maintenance page of the wireless broadband router.

It should be noted that the DNS domain name request interception module only intercepts DNS domain name resolution requests whose queried domain names are stored local domain names, and does not intercept DNS domain name resolution requests whose queried domain names are other domain names (that is, does not intercept queried domain names that are non-local. DNS domain name resolution request of the machine domain name). In order to make the above-mentioned embodiment more clear, the following is an exemplary description of the process of a user accessing a non-local domain name, referring to FIG. 11 , including:

1101-1102 are the same as step 1001 and step 1002, respectively.

1103. The user enters www.XXX.com in the address bar of the browser on the first terminal to access the public website.

1104. The first terminal sends a third DNS domain name resolution request to the DNS domain name request interception module in the wireless broadband router, where the third DNS domain name resolution request carries the second domain name, and the third DNS domain name resolution request is used to request to resolve the second domain name .

In the embodiment shown in FIG. 11 , the second domain name is www.XXX.com. The source IP address in the third DNS domain name resolution request is the IP address of the first terminal (assumed to be 192.168.9.100), the destination IP address is the DNS server IP address (assumed to be 10.98.48.123), and the query name is www.XXX.com.

1105. The DNS domain name request interception module compares the domain name (that is, the second domain name) queried by the third DNS domain name resolution request with the saved local domain name. Step 1105 is the same as step 1005 described above.

1106. If the queried domain name is different from the saved local domain name, the DNS domain name request interception module sends a third DNS domain name resolution request to the DNS server, where the third DNS domain name resolution request carries the second domain name.

Before step 1106, the DNS server determines the IP address corresponding to the second domain name. Specifically, the DNS server stores the correspondence between the second domain name and the IP address. The DNS server may determine the IP address corresponding to the second domain name according to the corresponding relationship.

1107. The DNS server resolves www.XXX.com to an IP address (assuming 10.3.42.32) according to the third DNS domain name resolution request, and generates a response to the third DNS domain name resolution request. In step 1107, the corresponding relationship between www.XXX.com and the IP address is stored in the DNS server. When the DNS server determines that the domain name included in the third DNS domain name resolution request is www.XXX.com, it can www.XXX.com resolves to the corresponding IP address.

1108. The DNS server sends a response to the third DNS domain name resolution request to the first terminal.

When step 1108 is specifically implemented, the DNS server may send a response to the third DNS domain name resolution request to the DNS domain name resolution response module, and the DNS domain name resolution response module sends the response to the third DNS domain name resolution request to the first terminal.

The source IP address in the response of the third DNS domain name resolution request is the DNS server IP address (ie 10.98.48.123), the destination IP address is the IP address of the first terminal (ie 192.168.9.100), the query domain name (query name) ) is www.XXX.com, and the query result (answer) is the IP address corresponding to www.XXX.com (ie 10.3.42.32).

1109. After obtaining the IP address corresponding to www.XXX.com (ie, 10.3.42.32), the first terminal uses the IP address 10.3.42.32 to access the public website.

In the method provided by the second embodiment, when the communication message is captured on the WAN port eth_x of the wireless broadband router through the dimension testing interface of the wireless broadband router, since the DNS domain name resolution request of cpe.win is intercepted by the DNS domain name request interception module, the It will be forwarded to the WAN side for processing through the WAN port eth_x, so the DNS domain name resolution request of cpe.win and the response of the DNS domain name resolution request will not exist in these communication packets.

The DNS domain name resolution in the second embodiment, the format of the request message and the response message in the DNS domain name resolution process, refer to the RFC1034 and RFC1035 specifications issued by the IETF. The second embodiment does not involve the change of the message format, so it will not be described in detail.

In the method provided by the second embodiment, by intercepting and parsing the DNS domain name resolution request for accessing the local domain name, when the wireless broadband router works in the bridge mode, the user can normally access the web maintenance page of the local domain name through the terminal, and configure And view the operating parameters of the wireless broadband router, which reduces the maintenance complexity of the wireless broadband router, improves the upgrade efficiency of the wireless broadband router, and improves the user experience.

In the second embodiment, the domain name resolution method provided by the present application is described by taking each module in the wireless broadband router as an example to perform the above method interactively. The shown process is realized, including:

1201. The first terminal sends a first DNS domain name resolution request to the wireless broadband router, where the first DNS domain name resolution request carries the second domain name. Correspondingly, the wireless broadband router receives the first DNS domain name resolution request from the first terminal.

The wireless broadband router works in a bridge mode, and the wireless broadband router stores a local domain name. The first DNS domain name resolution request further includes a source IP address and a destination IP address, where the source IP address is the IP address of the first terminal, and the destination IP address is the IP address of the DNS server.

When the wireless broadband router determines that the second domain name is the same as the local domain name, go to steps 1202 to 1204, and when the wireless broadband router determines that the second domain name is different from the local domain name, go to steps 1205 to 1208.

1202. The wireless broadband router determines the maintenance IP address of the wireless broadband router corresponding to the domain name of the local machine.

The wireless broadband router may store the correspondence between the local domain name and the maintenance IP address. The wireless broadband router can determine the maintenance IP address of the wireless broadband router corresponding to the local domain name according to the corresponding relationship.

1203. The wireless broadband router sends a response to the first DNS domain name resolution request to the first terminal, where the response to the first DNS domain name resolution request includes the maintenance IP address. Correspondingly, the first terminal receives a response to the first DNS domain name resolution request from the wireless broadband router.

1204. The first terminal accesses the Web maintenance page of the wireless broadband router according to the maintenance IP address.

1205. The wireless broadband router sends a third DNS domain name resolution request to the DNS server, where the third DNS domain name resolution request carries the second domain name. Correspondingly, the DNS server receives the third DNS domain name resolution request from the wireless broadband router.

1206. The DNS server determines an IP address corresponding to the second domain name.

The DNS server may store the correspondence between the second domain name and the IP address. The DNS server may determine the IP address corresponding to the second domain name according to the corresponding relationship.

1207. The DNS server sends a response to the third DNS domain name resolution request to the first terminal, where the response to the third DNS domain name resolution request includes an IP address corresponding to the second domain name. Correspondingly, the first terminal receives a response to the third DNS domain name resolution request from the DNS server.

1208. The first terminal accesses a webpage corresponding to the second domain name according to the IP address corresponding to the second domain name (ie, accesses a public network website).

For the related explanation and specific implementation of the method shown in FIG. 12, refer to the embodiments shown in FIG. 10 and FIG. 11. It only needs to be considered that the interaction between various modules in the wireless broadband router does not exist, and the various modules in the wireless broadband router The actions performed by the module can be understood as actions performed by the wireless broadband router, and details are not repeated here.

In the above-mentioned first and second embodiments, the terminal connected to the home router and the wireless broadband router may communicate through the home router. The methods provided in the first embodiment and the second embodiment may be combined. In this case, the modules included in the wireless broadband router are shown in FIG. 13 , and the functions of each module can be referred to above, and will not be repeated.

In order to realize the above-mentioned functions, the wireless broadband router includes at least one of the corresponding hardware structure and software module for executing each function. Those skilled in the art should easily realize that the present application can be implemented in hardware or a combination of hardware and computer software with the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

For example, when the present application is implemented in the form of hardware, an embodiment of the present application further provides a schematic diagram of the hardware structure of a wireless broadband router, see FIG. 14 or FIG. 15 , the wireless broadband router includes a processor 1401, and optionally, further includes Memory 1402 connected to processor 1401.

The processor 1401 can be a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more processors for controlling the execution of the programs of the present application. integrated circuit. The processor 1401 may also include multiple CPUs, and the processor 1401 may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. A processor herein may refer to one or more devices, circuits, or processing cores for processing data (eg, computer program instructions).

The memory 1402 may be read-only memory (ROM) or other type of static storage device that can store static information and instructions, random access memory (RAM), or other type of static storage device that can store information and instructions It can also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, CD-ROM storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being executed by a computer Any other medium accessed is not limited in this embodiment of the present application. The memory 1402 may exist independently (in this case, the memory 1402 may be located outside the wireless broadband router, or may be located in the wireless broadband router), or may be integrated with the processor 1401 . Among them, the memory 1402 may contain computer program code. The processor 1401 is configured to execute the computer program code stored in the memory 1402, thereby implementing the method provided by the embodiments of the present application.

In a first possible implementation manner, referring to FIG. 14 , the wireless broadband router further includes a transceiver 1403 . The processor 1401, the memory 1402 and the transceiver 1403 are connected by a bus. The transceiver 1403 is used to communicate with other devices or communication networks. Optionally, the transceiver 1403 may include a transmitter and a receiver. A device in the transceiver 1403 for implementing the receiving function may be regarded as a receiver, and the receiver is configured to perform the receiving steps in the embodiments of the present application. A device in the transceiver 1403 for implementing the sending function may be regarded as a transmitter, and the transmitter is used to perform the sending step in the embodiment of the present application. Exemplarily, the processor 1401 is configured to control and manage the actions of the wireless broadband router, for example, the processor 1401 is configured to control the execution of each step in the above method. The processor 1401 may communicate with other network entities through the transceiver 1403, eg, with a DNS server. The memory 1402 is used to store program codes and data of the wireless broadband router.

In a second possible implementation, referring to FIG. 15 , the processor 1401 includes a logic circuit and an input interface and/or an output interface. Exemplarily, the output interface is used for performing the sending action in the corresponding method, and the input interface is used for performing the receiving action in the corresponding method. The processor 1401 is used to control and manage the actions of the wireless broadband router. For example, the processor 1401 is used to control and execute each step in the above method. The processor 1401 may communicate with other network entities, eg, with a DNS server, through an input interface and/or an output interface. The memory 1402 is used to store program codes and data of the wireless broadband router.

In the implementation process, each step in the method provided in this embodiment may be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software. The steps of the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

Embodiments of the present application further provide a computer-readable storage medium, including instructions, which, when executed on a computer, cause the computer to execute any of the foregoing methods.

Embodiments of the present application also provide a computer program product containing instructions, which, when run on a computer, enables the computer to execute any of the above methods.

In the above-mentioned embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable device. Computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server, or data center over a wire (e.g. coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg infrared, wireless, microwave, etc.) means to transmit to another website site, computer, server or data center. Computer-readable storage media can be any available media that can be accessed by a computer or data storage devices including one or more servers, data centers, etc., that can be integrated with the media. Useful media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)), and the like.

Although the application is described herein in conjunction with various embodiments, in practicing the claimed application, those skilled in the art can understand and implement the disclosure by reviewing the drawings, the disclosure, and the appended claims Other variations of the embodiment. In the claims, the word "comprising" (comprising) does not exclude other components or steps, and "a" or "an" does not exclude a plurality. A single processor or other unit may fulfill the functions of several items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that these measures cannot be combined to advantage.

Although the application has been described in conjunction with specific features and embodiments thereof, it will be apparent that various modifications and combinations can be made therein without departing from the spirit and scope of the application. Accordingly, this specification and drawings are merely exemplary illustrations of the application as defined by the appended claims, and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of this application. Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

A wireless broadband router, characterized in that the wireless broadband router works in a bridge mode, and the wireless broadband router stores a first network interconnection protocol IP address and a source network address translation SNAT rule, and the SNAT rule is used for Converting the first IP address into a second IP address, where the first IP address is the pseudo address of the wireless broadband router in the local area network, and the second IP address is the IP address of the wireless broadband router in the wide area network;

The wireless broadband router is configured to send a first handshake message carrying the second IP address to a service server, and the first handshake message carrying the second IP address is used to request a connection with the service The server establishes a connection, the source IP address in the first handshake message carrying the second IP address is the second IP address, and the destination IP address is the IP address of the service server;

The wireless broadband router is further configured to receive a second handshake message carrying the second IP address sent by the service server, where the second handshake message carrying the second IP address is the After receiving the first handshake message carrying the second IP address, the service server sends it to the wireless broadband router, and the second handshake message carrying the second IP address is sent to the wireless broadband router. The source IP address is the IP address of the service server, and the destination IP address is the second IP address;

The wireless broadband router is further configured to convert the second IP address in the received second handshake message carrying the second IP address into the first IP address according to the SNAT rule , and obtain the second handshake packet carrying the first IP address.
The wireless broadband router according to claim 1, wherein,

The wireless broadband router is further configured to generate a first handshake message carrying the first IP address, and the source IP address in the first handshake message carrying the first IP address is the first handshake message. an IP address, where the destination IP address is the IP address of the service server;

The wireless broadband router is further configured to convert the first IP address in the first handshake message carrying the first IP address into the second IP address according to the SNAT rule, and obtain the the first handshake message carrying the second IP address.
The wireless broadband router according to claim 1 or 2, wherein the wireless broadband router comprises: a bridge module and a firewall module;

The bridging module is configured to send the SNAT rule to the firewall module;

The firewall module is configured to generate a first translation rule and a second translation rule according to the SNAT rule, and the first translation rule is used to, when judging that the first IP address is carried in the message, convert the The first IP address in the packet is converted into the second IP address, and the second translation rule is used to convert the packet into the second IP address when it is determined that the packet carries the second IP address. The second IP address in is converted into the first IP address.
The wireless broadband router according to claim 3, wherein the wireless broadband router further comprises: a local service module;

The local service module is configured to send the first handshake message carrying the first IP address to the firewall module, and the source IP address in the first handshake message carrying the first IP address The address is the first IP address, and the destination IP address is the IP address of the service server;

In response to receiving the first handshake message carrying the first IP address, the firewall module is further configured to convert the first handshake message carrying the first IP address according to the first conversion rule. Converting the first IP address in the second handshake message to the second IP address, and obtaining the first handshake message carrying the second IP address;

The firewall module is further configured to send the first handshake message carrying the second IP address to the service server;

The firewall module is further configured to receive the second handshake message carrying the second IP address from the service server;

In response to receiving the second handshake message carrying the second IP address, the firewall module is further configured to convert the second handshake message carrying the second IP address according to the second conversion rule. The second IP address in the message is converted into the first IP address, and the second handshake message carrying the first IP address is obtained;

The firewall module is further configured to send the second handshake message carrying the first IP address to the local service module.
The wireless broadband router according to claim 3 or 4, wherein the first IP address is stored in the bridge module.
A message processing method, characterized in that it is applied to a wireless broadband router, the wireless broadband router works in a bridge mode, and the wireless broadband router stores a first network interconnection protocol IP address and a source network address translation SNAT rule , the SNAT rule is used to convert the first IP address into a second IP address, where the first IP address is the pseudo address of the wireless broadband router in the local area network, and the second IP address is the wireless broadband router an IP address in a wide area network; the method includes:

The wireless broadband router sends a first handshake message carrying the second IP address to the service server, and the first handshake message carrying the second IP address is used to request to establish a connection with the service server, carrying The source IP address in the first handshake message of the second IP address is the second IP address, and the destination IP address is the IP address of the service server;

The wireless broadband router receives the second handshake message that carries the second IP address and is sent by the service server, and the second handshake message that carries the second IP address is received by the service server. After the first handshake message carrying the second IP address is sent to the wireless broadband router, the source IP address in the second handshake message carrying the second IP address is: The IP address of the service server, and the destination IP address is the second IP address;

The wireless broadband router converts the second IP address in the received second handshake message carrying the second IP address into the first IP address according to the SNAT rule, and obtains the first IP address. The second handshake message for the first IP address.
The method according to claim 6, wherein the method further comprises:

The wireless broadband router generates a first handshake packet carrying the first IP address, and the source IP address in the first handshake packet carrying the first IP address is the first IP address, and the destination IP address is the first IP address. The address is the IP address of the service server;

The wireless broadband router converts the first IP address in the first handshake message carrying the first IP address into the second IP address according to the SNAT rule, and obtains the second IP address carrying the second IP address The first handshake message.
The method according to claim 6 or 7, wherein the wireless broadband router comprises: a bridge module and a firewall module; the method further comprises:

The bridging module sends the SNAT rule to the firewall module;

The firewall module generates a first translation rule and a second translation rule according to the SNAT rule, and the first translation rule is used for, in the case of judging that the first IP address is carried in the packet, the packet is The first IP address is converted into the second IP address, and the second conversion rule is used to convert all the The second IP address is converted into the first IP address.
The method according to claim 8, wherein the wireless broadband router further comprises: a local service module; the method further comprises:

The local service module sends a first handshake message carrying the first IP address to the firewall module, and the source IP address in the first handshake message carrying the first IP address is the the first IP address, and the destination IP address is the IP address of the service server;

In response to receiving the first handshake message carrying the first IP address, the firewall module converts the first handshake message carrying the first IP address according to the first translation rule. The first IP address in is converted into the second IP address, and the first handshake message carrying the second IP address is obtained;

The firewall module sends the first handshake message carrying the second IP address to the service server;

The firewall module receives the second handshake message carrying the second IP address from the service server;

In response to receiving the second handshake message carrying the second IP address, the firewall module converts the second handshake message carrying the second IP address according to the second translation rule. Converting the second IP address to the first IP address, and obtaining the second handshake message carrying the first IP address;

The firewall module sends the second handshake message carrying the first IP address to the local service module.
The method according to claim 8 or 9, wherein the first IP address is stored in the bridge module.
A wireless broadband router, characterized in that the wireless broadband router works in a bridge mode, and the wireless broadband router comprises: a domain name system DNS domain name request interception module, a DNS domain name resolution proxy module and a DNS domain name resolution response module, the DNS The domain name request interception module stores the first domain name;

The DNS domain name request interception module is configured to receive a first DNS domain name resolution request sent by a first terminal, the first DNS domain name resolution request carries a second domain name, and the first DNS domain name resolution request is used for requesting resolution the second domain name;

The DNS domain name request interception module is further configured to send a second DNS domain name resolution request to the DNS domain name resolution proxy module when it is determined that the second domain name is the same as the first domain name, the second DNS The domain name resolution request carries the first domain name;

In response to receiving the second DNS domain name resolution request, the DNS domain name resolution proxy module is configured to determine the maintenance network interconnection protocol IP address of the wireless broadband router corresponding to the first domain name;

The DNS domain name resolution proxy module is also used to send a first message to the DNS domain name resolution response module, and the first message carries the maintenance IP address;

The DNS domain name resolution response module is configured to receive the first message;

The DNS domain name resolution response module is further configured to send a response to the first DNS domain name resolution request to the first terminal, where the response to the first DNS domain name resolution request includes the maintenance IP address.
The wireless broadband router according to claim 11, wherein,

The DNS domain name request interception module is further configured to send a third DNS domain name resolution request to the DNS server when it is determined that the second domain name is different from the first domain name, where the third DNS domain name resolution request carries There is the second domain name.
The wireless broadband router according to claim 11 or 12, wherein the DNS domain name resolution proxy module stores a correspondence between the first domain name and the maintenance IP address;

The DNS domain name resolution proxy module is specifically configured to determine the maintenance IP address corresponding to the first domain name according to the corresponding relationship.
The wireless broadband router according to any one of claims 11-13, wherein the wireless broadband router further comprises a bridge module;

The bridging module is configured to send the first domain name to the DNS domain name request interception module;

In response to receiving the first domain name, the DNS domain name request interception module is further configured to save the first domain name.
The wireless broadband router according to any one of claims 11-14, wherein,

The DNS domain name resolution response module is further configured to parse the first message, and generate a response to the first DNS domain name resolution request according to the parsed maintenance IP address.
The wireless broadband router according to any one of claims 11-15, wherein the first DNS domain name resolution request and the second DNS domain name resolution request further include a source IP address and a destination IP address, and the The source IP address is the IP address of the first terminal, and the destination IP address is the IP address of the DNS server.
A method for domain name resolution, characterized in that it is applied to a wireless broadband router, the wireless broadband router works in a bridge mode, and the wireless broadband router comprises: a domain name system DNS domain name request interception module, a DNS domain name resolution proxy module, and a DNS domain name resolution The response module, the DNS domain name request interception module stores the first domain name, and the method includes:

The DNS domain name request interception module receives the first DNS domain name resolution request sent by the first terminal, the first DNS domain name resolution request carries the second domain name, and the first DNS domain name resolution request is used to request to resolve the first DNS domain name resolution request. Second domain name;

When determining that the second domain name is the same as the first domain name, the DNS domain name request interception module sends a second DNS domain name resolution request to the DNS domain name resolution proxy module, in which the second DNS domain name resolution request is carrying the first domain name;

In response to receiving the second DNS domain name resolution request, the DNS domain name resolution proxy module determines the maintenance network interconnection protocol IP address of the wireless broadband router corresponding to the first domain name;

The DNS domain name resolution proxy module sends a first message to the DNS domain name resolution response module, where the first message carries the maintenance IP address;

The DNS domain name resolution response module receives the first message;

The DNS domain name resolution response module sends a response to the first DNS domain name resolution request to the first terminal, where the response to the first DNS domain name resolution request includes the maintenance IP address.
The method of claim 17, wherein the method further comprises:

When determining that the second domain name is different from the first domain name, the DNS domain name request interception module sends a third DNS domain name resolution request to the DNS server, where the third DNS domain name resolution request carries the first DNS domain name resolution request. Second domain name.
The method according to claim 17 or 18, wherein the DNS domain name resolution proxy module stores a correspondence between the first domain name and the maintenance IP address, and the DNS domain name resolution proxy module determines The maintenance IP address of the wireless broadband router corresponding to the first domain name, including:

The DNS domain name resolution proxy module determines the maintenance IP address corresponding to the first domain name according to the corresponding relationship.
The method according to any one of claims 17-19, wherein the wireless broadband router further comprises a bridge module; the method further comprises:

The bridging module sends the first domain name to the DNS domain name request interception module;

In response to receiving the first domain name, the DNS domain name request interception module stores the first domain name.
The method according to any one of claims 17-20, wherein before the DNS domain name resolution response module sends a response to the first DNS domain name resolution request to the first terminal, the method further comprises: :

The DNS domain name resolution response module parses the first message, and generates a response to the first DNS domain name resolution request according to the parsed maintenance IP address.
The method according to any one of claims 17-21, wherein the first DNS domain name resolution request and the second DNS domain name resolution request further include a source IP address and a destination IP address, and the source IP address The address is the IP address of the first terminal, and the destination IP address is the IP address of the DNS server.
A domain name resolution method, characterized in that it is applied to a wireless broadband router, the wireless broadband router works in a bridge mode, and the wireless broadband router stores a first domain name; the method includes:

The wireless broadband router receives a first domain name system DNS domain name resolution request from the first terminal, the first DNS domain name resolution request carries a second domain name, and the first DNS domain name resolution request is used to request to resolve the second domain name;

When determining that the second domain name is the same as the first domain name, the wireless broadband router determines the maintenance network interconnection protocol IP address of the wireless broadband router corresponding to the first domain name;

The wireless broadband router sends a response to the first DNS domain name resolution request to the first terminal, where the response to the first DNS domain name resolution request includes the maintenance IP address.
The method of claim 23, wherein the method further comprises:

When determining that the second domain name is different from the first domain name, the wireless broadband router sends a third DNS domain name resolution request to the DNS server, where the third DNS domain name resolution request carries the second domain name .
The method according to claim 23 or 24, wherein the wireless broadband router stores a correspondence between the first domain name and the maintenance IP address.
The method according to any one of claims 23-25, wherein the first DNS domain name resolution request further includes a source IP address and a destination IP address, and the source IP address is the IP address of the first terminal , the destination IP address is the IP address of the DNS server.
A domain name resolution system, comprising: a first terminal and a wireless broadband router, wherein the wireless broadband router works in a bridge mode, and the wireless broadband router stores a first domain name;

The first terminal is configured to send a first domain name system DNS domain name resolution request to the wireless broadband router, where the first DNS domain name resolution request carries a second domain name, and the first DNS domain name resolution request is used to request resolve the second domain name;

In response to receiving the first DNS domain name resolution request, the wireless broadband router is configured to, in the case of determining that the second domain name is the same as the first domain name, determine the The maintenance network interconnection protocol IP address of the wireless broadband router;

The wireless broadband router is further configured to send a response to the first DNS domain name resolution request to the first terminal, where the response to the first DNS domain name resolution request includes the maintenance IP address;

In response to receiving the response of the first DNS domain name resolution request, the first terminal is further configured to access the global wide area network Web maintenance page of the wireless broadband router according to the maintenance IP address.
The domain name resolution system according to claim 27, wherein the domain name resolution system further comprises: a DNS server;

The wireless broadband router is further configured to send a third DNS domain name resolution request to the DNS server when it is determined that the second domain name is different from the first domain name, where the third DNS domain name resolution request carries having the second domain name;

In response to receiving the third DNS domain name resolution request, the DNS server is configured to determine an IP address corresponding to the second domain name;

The DNS server is further configured to send a response to the third DNS domain name resolution request to the first terminal, where the response to the third DNS domain name resolution request includes an IP address corresponding to the second domain name;

In response to receiving the response of the third DNS domain name resolution request, the first terminal is further configured to access the webpage corresponding to the second domain name according to the IP address corresponding to the second domain name.
The domain name resolution system according to claim 27 or 28, wherein the wireless broadband router stores the correspondence between the first domain name and the maintenance IP address.
The domain name resolution system according to any one of claims 27 to 29, wherein the first DNS domain name resolution request further includes a source IP address and a destination IP address, and the source IP address is the address of the first terminal. IP address, where the destination IP address is the IP address of the DNS server.
A message processing device, comprising: a processor;

The processor is connected to a memory, and the memory is used to store computer-executed instructions, and the processor executes the computer-executed instructions stored in the memory, so that the message processing apparatus can implement any one of claims 6-10. one of the methods described.
A domain name resolution device, characterized in that it comprises: a processor;

The processor is connected to a memory, the memory is used to store computer-executed instructions, and the processor executes the computer-executed instructions stored in the memory, so that the domain name resolution apparatus can implement any one of claims 17-22. The method of claim 23, alternatively, implement the method of any one of claims 23-26.