JP3999238B2 - Address translation method and apparatus - Google Patents

Description

  The present invention interconnects the Internet and a local area network (LAN), mutually converts an address used in the Internet and an address used in the LAN, and uses a plurality of addresses in the LAN by one address used in the Internet. The present invention relates to an address conversion method and apparatus for enabling a terminal to access the Internet.

  Conventionally, a single address (global address) used in the Internet is shared by a plurality of terminals having only addresses (private addresses) used in the LAN, and the plurality of terminals are connected to the Internet. 2. Description of the Related Art An address translation device (NAT (Network Address Translator) device) that enables access to a network is known.

  In addition, there is also a method in which a plurality of terminals can access the Internet at the same time by allocating access from the Internet side to terminal devices by TCP (Transmission Control Protocol) or UDP (User Datagram Protocol) destination port numbers. .

  When a terminal in a LAN connected to the Internet by such an address translation device communicates with a terminal on the Internet by IPsec (Security Architecture for Internet Protocol), since there is no port number in IPsec, one terminal is assigned to one global address. Thus, only one terminal can be allocated, and one global address cannot be used by a plurality of terminals.

In order to solve such a problem, there is one in which an IPsec packet is encapsulated and sent in a UDP packet (see, for example, Patent Document 1).
JP 2002-232450 JP

  However, in such a conventional address translation device, it is necessary to support encapsulation in a UDP packet in both performing IPsec communication, and communication with a terminal that does not support encapsulation in a UDP packet is required. I could not.

  In view of the above problems, the present invention allows a plurality of IPsec communications to be performed by one global address without performing pre-registration, even if a terminal that performs IPsec communications does not support other protocols. It is an object of the present invention to provide an address translation method and apparatus that can perform this.

In order to solve the above problems, an address translation method of the present invention includes a database in which address translation rules are registered, and uses the address translation apparatus that connects a local network and a global network to each other. An address translation method for mutually converting an address used in a network and an address used in the global network, wherein the address translation device accepts a session received from a terminal of the global network, and the terminal When the packet indicating the start of IPsec communication is received from the terminal of the local network, the destination address of the packet and the IPsec of the source address are registered. Packet If the address conversion rule is not registered in the database for, and additionally registers the address conversion rule for IPsec packet the destination and source addresses in the database,
An address used in the local network and an address used in the global network are converted to each other based on an address conversion rule registered in the database.

  In order to solve the above problems, an address translation device of the present invention interconnects a local network and a global network, and uses an address used in the local network and an address used in the global network. Conversion device that mutually converts addresses used in the local network and addresses used in the global network based on address conversion rules registered in the database An address translation means; a database; means for accepting a session received from a terminal of the global network; and additionally registering in the database an address translation rule for a packet whose source is the address of the terminal; and the local network When a packet indicating the start of IPsec communication is received from a terminal of the network, if the address translation rule for the IPsec packet of the destination address and source address of the packet is not registered in the database, the destination address and source address Means for additionally registering an address translation rule for the IPsec packet in the database.

  According to the present invention, when address conversion is performed in communication between a global network and a local network, an address conversion rule corresponding to a transmission source address for a packet received from the global network is added and applied. Therefore, if the source address is different, different conversion rules are applied even with the same protocol and port number. Furthermore, an address conversion rule is added to the packet indicating the start of IPsec communication from the terminal of the local network (the first packet of IKE or the first IPsec packet) for the IPsec packet of the destination address and the source address of the packet. Is done. Therefore, the address conversion rule for IPsec communication started from the terminal of the local network is automatically registered.

  In addition, when the session is disconnected, the address translation rule added by the session may be deleted.

  Thereby, the address translation rule is deleted when the session is disconnected, and erroneous access due to the changed setting can be prevented.

  According to the present invention, an address translation rule is added to a packet whose source is the address of the terminal by a session from a terminal on the global network, so that a different address translation is used for a packet having a different source address. A rule can be applied, and a plurality of servers can be disclosed with the same port number, or a plurality of communications can be performed simultaneously with a protocol without a port number.

  In addition, when an IPsec packet is received from a local network terminal, if an address translation rule for the packet is not registered, an address translation rule for the packet is added. It is possible to automatically register an IPsec communication address conversion rule, and to perform IPsec communication without registering a prior address conversion rule.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram showing an address translation apparatus according to an embodiment of the present invention.

  In FIG. 1, reference numeral 1 denotes an address translation apparatus according to the present embodiment, which is interposed between a global network such as the Internet and a local area network (LAN) and connected thereto, and a WAN (Wide Area Network) such as the Internet. Are received by the WAN-side network interface unit 11 that transmits / receives packets, the LAN-side network interface unit 12 that transmits / receives packets to / from the local network LAN, and the WAN-side network interface unit 11 and the LAN-side network interface unit 12. An access control unit 13 that analyzes the received packets and performs access control, and an address that performs address conversion by analyzing the packets permitted to pass by the access control unit 13 and packets transmitted from the LAN to the WAN side. A data conversion unit 14, an authentication processing unit 15 that performs user authentication processing in response to a request from the access control unit 13, and a database unit 16 that stores data for access control, data for address conversion, and authentication data It has.

  This address translation device 1 has a firewall function, and the access control unit 13 receives the WAN side network interface unit 11 based on the access control table as shown in FIG. 2 stored in the database unit 16. It is determined whether or not to transmit the packet to the LAN side via the LAN-side network interface unit 12.

  In the access control table shown in FIG. 2, the “source IP address” column indicates the source IP address of the packet received by the WAN-side network interface unit 11, and the “protocol, source port number” column indicates the WAN-side network. The protocol name of the packet received by the interface unit 11 and the transmission source port number when the port number is used in the protocol are shown. The column “destination IP address” indicates the destination of the packet received by the WAN side network interface unit 11 Indicates the IP address, and the column of “protocol, destination port number” indicates the protocol name of the packet received by the WAN side network interface unit 11 and the destination port number when the port number is used in the protocol. Column "operation" is the source and destination of the packet received by the WAN side network interface unit 11, if they match each value in the row, shows the operation to be performed on that packet.

  As a protocol name used in the columns of “protocol, source port number” and “protocol, destination port number”, a protocol name associated with a preset protocol name and port number may be used. it can.

  For example, in the first row of the access control table shown in FIG. 2, the destination IP address is “111.111.111.2” and the protocol name is “http (HyperText Transport Protocol, eg, TCP (), regardless of the source IP address and port number. The packet “80)” of Transmission Control Protocol is transmitted to the LAN side (accept).

  Similarly, in the second row of the access control table shown in FIG. 2, the source IP address is “123.123.123.1”, the destination IP address is “111.111.111.2”, and the protocol name is “ssh (Secure SHell, eg, TCP 22) ”is transmitted to the LAN side, and in the third line, all packets are dropped.

  The access control unit 13 verifies whether or not the received packets match in order from the top row of the access control table. If they match, the access control unit 13 performs a specified operation, and the processing for the packets ends. That is, in the access control table shown in FIG. 2, the condition set in the upper row is a condition that is processed with higher priority.

  Further, the address translation device 1 stores an address translation table as shown in FIG. 3 in the database unit 16, and the address translation unit 14 receives the WAN side network interface unit 11 based on this table. The destination IP address of the packet that has passed through the access control unit 13 is converted into an IP address inside the LAN, and is transmitted to the LAN side via the LAN side network interface unit 12.

  Also, the source IP address of the packet received by the LAN-side network interface unit 12 is converted into a WAN IP address (global address) and output to the access control unit 13, and the packet permitted by the access control unit 13 is converted to the WAN side. The data is transmitted to the WAN side via the network interface unit 11.

  In the address conversion table shown in FIG. 3, the “source IP address” column indicates the source IP address of the packet received by the WAN-side network interface unit 11, and the “destination IP address” column indicates the WAN-side network interface. Indicates the destination IP address of the packet received by the unit 11, and the column “protocol, destination port number” indicates the protocol name of the packet received by the WAN side network interface unit 11 and the destination when the port number is used in the protocol. The port number indicates the internal IP address, and when the source and destination of the packet received by the WAN-side network interface unit 11 match the respective values in the row, the destination IP address of the packet is displayed. Setting The "protocol and port number" column shows the packet's private address when the source and destination of the packet received by the WAN side network interface unit 11 match the respective values in the row. The port number set in the destination port number is shown.

  For example, in the first row of the address conversion table shown in FIG. 3, regardless of the source IP address, a packet with a destination IP address “111.111.111.2” and a destination port number “TCP 80 (http)” The destination IP address is rewritten to “192.168.100.5”, and the destination port number is sent as it is to the LAN side.

  Similarly, in the second row of the address conversion table shown in FIG. 3, the source IP address is “123.123.123.1”, the destination IP address is “111.111.111.2”, and the destination port number is “TCP 22 (SSH)”. The destination IP address is rewritten to “192.168.100.5” and the destination port number is transmitted to the LAN side as it is.

  By setting in this way, access to a specific port or a protocol having no port from the WAN side can be distributed to terminals in the LAN.

  Further, the address translation unit 14 verifies whether or not the received packets match in order from the top row of such an address translation table. If they match, the address translation unit 14 performs a specified operation, and the processing for the packet is completed. To do. That is, in the address conversion table of FIG. 3, the condition set in the upper row is a condition for preferential processing.

  Further, the address conversion table shown in FIG. 3 is in an initial state in which there is no terminal in communication, and a communication request from a terminal existing in the LAN causes a WAN side terminal to be described later. In response to the request, an address conversion rule is added, and addresses of packets from the WAN side to the LAN and packets from the LAN to the WAN side are converted according to the address conversion table of FIG. 3 and transmitted.

  The address translation device 1 can add an access control rule to the access control table in FIG. 2 and add an address translation rule to the address translation table in FIG. 3 in response to a request from a terminal on the WAN side.

  Specifically, when the access control unit 13 receives an access request packet of https (HyperText Transfer Protocol Security) addressed to the global address of its own device via the WAN-side network interface unit 11, the access control unit 13 and the SSL (Secure Socket Layer) If the session is established successfully, the IP address of the transmission source terminal acquired at the time of session establishment is stored, and the user identification information and password are entered to authenticate the user. The file is encrypted and transmitted to the requesting terminal via the WAN-side network interface unit 11.

  Upon receiving the encrypted user identification information and password from the requesting terminal, the access control unit 13 performs decryption and transmits the user identification information and password to the authentication processing unit 15 to request user authentication. To do.

  Upon receiving the user identification information and the password, the authentication processing unit 15 searches the user information stored in the database unit 16 for a user having identification information that matches the received user identification information. If found, the stored password of the user is compared with the received password, and if they match, an authentication normality notification is transmitted to the access control unit 13. If no matching user is found or the passwords do not match, an authentication error notification is transmitted to the access control unit 13.

  When the access control unit 13 receives the authentication normal notification from the authentication processing unit 15, the access control unit 13 encrypts an HTML file for inputting the private address, protocol, port number, etc. inside the LAN of the server to be accessed, and sends it to the requesting terminal WAN It transmits via the side network interface unit 11.

  Upon receiving an encrypted private address, protocol, or port number from the requesting terminal, the access control unit 13 performs decryption and stores the https stored in the access control table stored in the database unit 16. An access control rule in which the source IP address of the access request packet is “source IP address” and the received protocol and port number is “protocol, destination port number” is added to the address conversion unit 14 to https Request to add an address translation rule together with the source IP address of the access request packet, the received private address, protocol, and port number.

  Upon receiving an address translation rule addition request, the address translation unit 14 sets the source IP address of the https access request packet as the “source IP address” in the address translation table stored in the database unit 16 and receives the received private Add an address conversion rule with the address, protocol, and port number as “internal IP address” and “protocol, destination port number”.

  For example, an https access request packet from a terminal with a source IP address of 111.222.234.123 indicates that the destination IP address of the packet with the destination port number 111.111.111.2 and the destination port number “TCP 22” is the internal IP address 192.168. When rewriting to 100.4, as shown in FIG. 4, in the access control table, an access control rule for a terminal that has accessed via https is added to the top row of the access control table shown in FIG. It is supposed to be. In addition, as shown in FIG. 5, the address conversion table is obtained by adding the address conversion rule of the terminal accessed by https to the top row of the address conversion table shown in FIG.

  As a result, the packet with the destination IP address 111.111.111.2 with the source IP address 111.222.234.123 and the destination port number “TCP 22” passes through the access control unit 13, and the address conversion unit 14 sets the destination IP address to 192.168. The packet with the destination IP address 111.111.111.2 and the destination port number “TCP 22” having the source IP address 123.123.123.1 passes through the access control unit 13 and is transmitted to the LAN. The destination IP address is rewritten to 192.168.100.5 by the conversion unit 14 and transmitted to the LAN, and the packet with the destination port number “TCP 22” of the other source IP address is discarded by the access control unit 13. .

  Thereafter, the access control unit 13 encrypts an HTML file that displays the fact that the authentication is normal and address conversion is set for the terminal, and the private address, protocol, port number, and the like inside the conversion destination LAN. Send to.

  The terminal receives the HTML file transmitted from the address translation device 1, decrypts it, and displays it to confirm the set address translation information.

  When a user who has established an access control rule and an address conversion rule in this way and communicated with a terminal in the LAN ends communication, the user can use the HTML file received from the address conversion device 1 to display the screen. Then, the communication end button is selected, the browser displaying the HTML file is closed, or the terminal displaying the HTML file is ended.

  When the access control unit 13 of the address translation device 1 receives a communication end packet or detects that the browser is closed or the terminal is closed because a signal from the terminal is not transmitted for a certain period of time, The access control table rewritten as shown in FIG. 4 is returned to the original state as shown in FIG. 2, and the address conversion unit 14 is added with the information of the source IP address, the destination IP address, and the protocol. Notify that has ended.

  When receiving the notification of the end of communication, the address conversion unit 14 returns the address conversion table rewritten as shown in FIG. 5 to the original state as shown in FIG.

  As described above, in the present embodiment, the IP address of the terminal accessed via https is set as the source IP address, the designated address translation rule is set in the address translation table, and the access control rule associated therewith is set in the access control table. Therefore, the address translation rule can be set according to the conditions including the source IP address, and the same port number is distributed to different servers by the source IP address, or the protocol without the port number is separated by the source IP address. Communication with the terminal can be performed.

  In the present embodiment, addition of an address translation rule and an access control rule is accepted by https access, but http, SIP (Session Initiation Protocol), ssh, telnet, or the like may be used.

  When the address translation apparatus 1 having the above-described configuration receives the first packet of IPsec communication from a terminal in the LAN, the address translation rule between the destination IP address and the source IP address (private address) is stored in the address translation table. In addition, a plurality of terminals in the LAN can perform IPsec communication through the address translation device 1.

  In this regard, as shown in FIG. 6, IPsec communication between terminals in the LANs 2 and 3 connected to the first address translation device 1a and the second address translation device 1b that can communicate via the Internet 4, respectively. The case will be described.

  First, since the terminal 3a in the LAN 3 adds an address translation rule necessary for IPsec communication with the terminal 2a in the LAN 2 connected to the first address translation device 1a to the first address translation device 1a. As described above, an https access request packet is transmitted to the first address translation device 1a.

  Upon receiving the https access request packet, the first address translation device 1a establishes an SSL session with the transmission source terminal 3a, authenticates the user, and if authenticated, the first address translation device 1a is private within the LAN 2 of the server to be accessed. An HTML file for inputting an address, protocol, port number and the like is transmitted to the requesting terminal 3a.

  The terminal 3a displays the received HTML file and allows the user (user) to input access destination information. In this case, the private IP address 192.168.100.2 of the terminal 2a to be connected and IPsec as the protocol are input.

  The terminal 3a transmits the input private address and protocol to the first address translation device 1a.

  When the first address translation device 1a receives the private address and protocol from the terminal 3a, the first address translation device 1a stores the source IP address (second address) of the stored access request packet of https in the access control table stored in the database unit 16. The IP address 111.222.234.123) of the address translation device 1b is “source IP address”, and “protocol, source port number” and “protocol, destination port number” are IPsec. The source IP address of the stored https access request packet is “source IP address”, the “destination IP address” is the global address of the own device 211.250.250.100, and “protocol, destination port number” is IP ec, add an address conversion rule as shown in FIG. 8 and 192.168.100.2 as an internal IP address into the address translation table.

  Then, when the terminal 3a transmits the first IPsec packet to the second address translator 1b in order to send it through the second address translator 1b, the address translator 14 of the second address translator 1b Since the packet received from 3a is an IPsec packet, the destination IP address and the source IP address are read out to check whether or not the address translation rule relating to this IPsec communication is registered in the address translation table, and this address translation table stores this It is searched whether there is an IPsec address translation rule in which the destination IP address is registered as the source IP address and the transmission source IP address is registered as the internal IP address.

  If there is an address translation rule that matches this condition as a result of the search, the address translation unit 14 rewrites the source IP address to the address of the destination IP address of the address translation rule, and passes the rewritten packet through the access control unit 13. Transmission is performed via the WAN-side network interface unit 11.

  If there is no address translation rule that matches this condition, the destination IP address is “source IP address”, the “destination IP address” is the IP address of the local device (in this case, 111.222.234.123), and “protocol, destination An address conversion rule as shown in FIG. 9 is added to the address conversion table with IPsec as the “port number” and “internal IP address” as the source IP address (in this case, 192.168.20.2).

  Then, the address conversion unit 14 requests the access control unit 13 to add an access control rule that permits passage of an IPsec packet having a source IP address of 211.250.250.100 and a destination IP address of 111.222.234.123. To do.

  When the access control unit 13 is requested by the address conversion unit 14 to add an access control rule, the “source IP address” is 211.250.250.100, the “destination IP address” is 111.222.234.123, “protocol, source port number”. Then, an access control rule as shown in FIG. 10 is added to the access control table in which “protocol, destination port number” is IPsec and operation is accept.

  In addition, after the addition of the access control rule of the access control unit 13 is completed, the address conversion unit 14 rewrites and rewrites the source IP address of the received packet with the global IP address of the own device (in this case, 111.222.234.123). The packet is transmitted through the access control unit 13 and the WAN side network interface unit 11.

  Thereafter, communication by IPsec is performed between the terminal 2a and the terminal 3a.

  When the communication by IPsec is completed, the user of the terminal 3a selects the button for ending communication from the screen displayed with the HTML file received from the first address translation device 1a or displays the HTML file. Close the current browser or close the terminal displaying the HTML file.

  The access control unit 13 of the first address translation device 1a receives a communication end packet, or the browser is closed or the terminal is closed because a signal from the terminal 3a is not transmitted for a certain period of time. 7 is deleted, the added access control rule is deleted as shown in FIG. 7, and the address translation unit 14 is notified that the communication of the source IP address 111.222.234.123, the destination IP address 211.250.250.100, and the protocol IPsec has ended.

  Upon receiving the notification of the end of communication, the address translation unit 14 of the first address translation device 1a deletes the address translation rule added as shown in FIG. 8 corresponding to the source IP address, destination IP address, and protocol. To do.

  When the access control unit 13 of the second address translation device 1b receives a communication end packet or detects that the browser has been closed or the terminal has been terminated due to a signal not being transmitted from the terminal 3a for a certain period of time. As shown in FIG. 10, the added access control rule is deleted, and the address translation unit 14 is notified that the communication with the source IP address 211.250.250.100, the destination IP address 111.222.234.123, and the protocol IPsec has ended.

  Upon receiving notification of the end of communication, the address translation unit 14 of the second address translation device 1b deletes the added address translation rule as shown in FIG. 9 for the source IP address, destination IP address, and protocol.

  As described above, in this embodiment, since the address conversion rule is set according to the condition including the source IP address, the same port number is distributed to different servers according to the source IP address, or the protocol without the port number is used as the source. It is possible to communicate with different terminals by IP address.

  In addition, when an address translation rule for a destination IP address and a source IP address of an IPsec packet received from the LAN side is not registered, an address translation rule for an IPsec packet based on the destination IP address and the source IP address is registered. Therefore, the address conversion rule for IPsec communication started from a terminal in the LAN is automatically registered, and IPsec communication can be performed without registering the address conversion rule in advance.

  Further, as shown in FIGS. 11 and 12, communication can be performed without contradiction even when there are a plurality of terminals performing IPsec communication. That is, in the configuration shown in FIG. 11, in addition to the configuration of FIG. 6, the LAN 4 is connected to the Internet 4 via the third address translation device 1c whose IP address is 222.111.123.234, and the private IP address is included in the LAN 5 There is a terminal 5a whose IP address is 192.168.50.2 and a terminal 5b whose private IP address is 192.168.50.3.

  In such an environment, when the terminal 2a in the LAN 2 performs IPsec communication with the terminal 3a in the LAN 3, and the terminal 2b in LAN 2 performs IPsec communication with the terminal 5a in the LAN 5, the first address translation device 1a By using the same procedure as described above, the source IP address of the stored https access request packet is set as “source IP address”, the global address 211.250.250.100 of the own device as “destination IP address”, “protocol, destination” Address translation rules as shown in FIG. 12 are added to the address translation table with IPsec as the “Nation port number” and 192.168.100.2 and 192.168.100.3 as the internal IP addresses. As a result, a plurality of terminals can simultaneously perform IPsec communication.

  In the present embodiment, the address conversion apparatus 1 authenticates the WAN terminal. However, the authentication is performed by the server through the server on the WAN, and the address is converted by a request from the server. In the apparatus 1, the access control rule and the address conversion rule may be added or deleted.

  By doing so, it is possible to operate with stealth (accessible protocols and port numbers are hidden) from the WAN.

  In this embodiment, the address translation rule and the access control rule are added by the first packet of IPsec communication. However, the address translation rule and the access control rule may be added by a packet indicating the start of IPsec communication. Alternatively, an address translation rule and an access control rule may be added by the first packet of IKE (Internet Key Exchange).

1 is a block diagram showing an address translation apparatus according to an embodiment of the present invention. The figure which shows the access control table of the address translation apparatus of one Embodiment of this invention. The figure which shows the address conversion table of the address converter of one Embodiment of this invention The figure which shows the access control table after adding the access control rule of the address translation apparatus of one Embodiment of this invention The figure which shows the address translation table after the address translation rule addition of the address translation apparatus of one Embodiment of this invention. 1 is a network configuration diagram showing an example of use of an address translation device according to an embodiment of the present invention. The figure which shows the access control rule added in the address translation apparatus of the receiving side in the IPsec communication between the address translation apparatuses of one Embodiment of this invention The figure which shows the address translation rule added with the address translation apparatus of the receiving side in the IPsec communication between the address translation apparatuses of one Embodiment of this invention The figure which shows the address translation rule added with the address translation apparatus of the originating side in the IPsec communication between the address translation apparatuses of one Embodiment of this invention The figure which shows the access control rule added in the address | side address translation apparatus in the IPsec communication between the address translation apparatuses of one Embodiment of this invention 1 is a network configuration diagram showing an example of use of an address translation device according to an embodiment of the present invention. The figure which shows the address translation rule added with the address translation apparatus of the receiving side in the IPsec communication between the address translation apparatuses of one Embodiment of this invention

Explanation of symbols

  DESCRIPTION OF SYMBOLS 11 ... WAN side network interface part, 12 ... LAN side network interface part, 13 ... Access control part, 14 ... Address conversion part, 15 ... Authentication process part, 16 ... Database part, 1a ... 1st address conversion apparatus, 1b ... 2nd address translation device, 1c... 3rd address translation device, 2, 3, 5... LAN, 4... Internet, 2a, 2b, 3a, 3b, 5a, 5b.

Claims (4)

An address translation device having a database in which address translation rules are registered and interconnecting a local network and a global network is used, and an address used in the local network is used in the global network. An address conversion method for converting addresses to each other,
The address translator is
Accepts a session received from a terminal of the global network, and additionally registers an address translation rule for a packet having the address of the terminal as a transmission source,
When a packet indicating the start of IPsec communication is received from a terminal of the local network, if the address translation rule for the IPsec packet of the destination address and the source address of the packet is not registered in the database, the destination address and An additional address translation rule for the IPsec packet of the source address is registered in the database,
An address conversion method, wherein an address used in the local network and an address used in the global network are converted from each other based on an address conversion rule registered in the database. The address translation method according to claim 1, wherein the address translation device deletes an address translation rule added by the session from the database when the session is disconnected. An address translation device that interconnects a local network and a global network and translates an address used in the local network and an address used in the global network,
An address translation unit that translates an address used in the local network and an address used in the global network based on an address translation rule registered in a database;
The database;
Means for accepting a session received from a terminal of the global network and additionally registering in the database an address translation rule for a packet whose source is the terminal address;
When a packet indicating the start of IPsec communication is received from a terminal of the local network, if the address translation rule for the IPsec packet of the destination address and the source address of the packet is not registered in the database, the destination address and Means for additionally registering an address translation rule for an IPsec packet of a source address in the database. The address translation device according to claim 3, further comprising means for deleting an address translation rule added by the session from the database when the session is disconnected.

Images