JP6223871B2 - Relay device - Google Patents

Description

  The present invention relates to a relay device that can be used as a home gateway that separates a general home LAN and a WAN.

  Currently, when connecting to a network in a general home, a home gateway is often provided at the connection to the network, and this home gateway often functions as a router such as a DHCP server function or a NAPT function. Also, as various services such as optical telephones and VPNs are provided, many functions are implemented in the home gateway. For this reason, the business operator may narrow down the development model and make it possible to use a part or all of the installed functions according to the contract and setting with the user.

  Depending on the contract of the user, a home gateway relay device that can be used as a router may be set up to operate as an L3 switch. In this case, even if it has a function that can operate as a SIP server, DNS server, or the like, the packets used in those functions are bridged as they are.

  Many of such home gateway relay devices can be accessed from a web browser of a terminal on the LAN side, call a web page for changing settings, and change various settings. In order to call the setting change web page, in the IPv4 environment, a local IP address such as http://192.168.0.1 or http://192.168.1.1 has been generally specified (Non-Patent Document). 1).

  However, it is often difficult for a user unfamiliar with a computer to enter an IP address, which is a list of numbers, in the address field. For this reason, by specifying an easy-to-understand domain name such as http: //web.setup/ or http: // (company name) .setup / (For example, Non-Patent Document 2).

http://windows.microsoft.com/en-us/windows/set-up-wireless-router http://buffalo.jp/support_s/buf9960/

  However, when a web page of a setting screen is requested from a subordinate terminal on the LAN side to a relay apparatus once set as an L3 bridge, even if an address is specified by a domain name, it may fail. When accessing with a domain name, a subordinate terminal first transmits a DNS packet in order to resolve the DNS name. However, a relay device that is an L3 bridge bridges this and is mainly managed by the operator. It will be sent to the upper DNS server. Since the upper DNS server does not have the domain information of the requested setting screen of the relay device, it cannot respond to a request for resolving the name of the DNS to be designated as a result. For this reason, since it is not possible to specify the relay device itself that is switched to L3, the setting screen cannot be called by the domain name.

  In order to solve this, it is conceivable to perform DNS resolution by placing domain information of individual home gateway relay devices on the DNS server. However, the number of addresses that can be registered for the domain is limited, and it is not realistic to register all the addresses of the home gateway relay devices that can be returned to the DNS server.

  As another method, when the home gateway relay device is set to the L3 bridge, it may be set to actually operate as a proxy. If it is a proxy, it can behave as a DNS server in response to a DNS name resolution request, so if there is a domain name request specifying the relay device itself from a subordinate terminal, it returns its own IP address. By doing so, access by domain name becomes possible. However, in order to operate as a proxy, all packets are once terminated at the relay device and regenerated, so a decrease in throughput is unavoidable and the processing load of the relay device also increases. You may need to raise it. Furthermore, the act of acting as a proxy may make it difficult to differentiate from a service with more functions due to the classification of services provided by the operator.

  By the way, although it is impossible to access with a domain name, many relay devices have an IP address even if they are L3 bridged, so if you specify the IP address directly, the web page of the setting screen It is possible to call However, designation by direct typing of an IP address, which is difficult for beginners even with IPv4, becomes even more difficult when IPv6 addresses with low readability become mainstream.

  As another method, there is a relay device that can be switched to the router mode by executing physical initialization, but it is initialized including the setting values set by other users, so it is convenient for the user. Is often impaired.

  Therefore, the present invention improves the convenience for the user by enabling a response to a request for a setting screen addressed to the domain name without reducing the throughput as much as possible when the home gateway relay device functions as an L3 switch. For the purpose.

This invention
A relay device having a LAN side interface, a WAN side interface, and an L3 bridge unit that relays between them,
The DNS query packet received from the LAN side interface is transferred to the WAN side interface, and the DNS query packet is analyzed. As a result of the analysis, if the DNS query packet designates the relay device itself, the IP address of the relay device itself A DNS response including an address is returned to the source address of the DNS query packet, and before and after the return, the DNS response to the DNS query packet returned from the external DNS server received from the WAN side interface is blocked. The above-described problem has been solved by the relay device.

That is, if the DNS query packet requests the address resolution of the relay device itself, the relay device itself transmits the IP address of the relay device itself as a DNS server, and the request source specifies the relay device itself by the domain name. It becomes possible.
On the other hand, instead of analyzing after stopping all the packets, basically, all packets are transferred to the WAN side to prevent a decrease in throughput. In parallel, the DNS query packet is copied inside, and while the response is returned from the DNS server at the end of the WAN side interface, the DNS query packet is analyzed and a response as necessary is sent. You can go ahead. If the DNS query packet designates the relay device itself, the DNS server at the end of the WAN side interface returns an error as a DNS response, but the relay device blocks this so that the terminal on the LAN side Error information is prevented from reaching the relay station, and only the IP address sent by the relay device itself is transmitted.

As a form which concretely realizes the present invention,
A relay device having a LAN side interface, a WAN side interface, and an L3 bridge unit that relays between them,
A DNS processing unit for processing a DNS query packet;
An address lock table that records the domain of a packet that specifies the relay device itself among the DNS query packets that pass through the relay device, and holds information in a locked state that blocks a DNS response to the DNS query packet;
A switch table having a value that allows passage if there is no record of the domain in the locked state in the address lock table, and a value that restricts passage if there is one or more records of the domain in the locked state; ,
A relay device having
The L3 bridge is
A query relay copy means for transferring the DNS query packet received from the LAN side interface to the WAN side interface, copying the DNS query packet and delivering it to the DNS processing unit;
Corresponding packet discarding means for discarding the DNS response packet when the DNS response is received from the WAN side interface and the domain included in the DNS response corresponds to the information indicating the lock state recorded in the address lock table. When,
Self-address notifying means for transmitting a DNS response including the address of the relay device itself to a source address of a DNS query packet requesting resolution of the name of the relay device itself;
Switch confirmation means for referring to the switch table when a DNS response is received from the WAN side interface;
If the switch table is a value that allows passage, switch reference transfer means for quickly transferring the DNS response to the LAN side interface by L3 bridging,
Have
The DNS processing unit
Query determination means for determining whether the received DNS query packet is for resolving the address of the relay device itself;
Self-address designation for generating a DNS response that resolves the DNS name including the IP address of the relay device itself to the source address of the DNS query packet determined by the query determination means to resolve the address of the relay device itself Means,
Lock domain recording means for recording the domain of the DNS query packet determined to be for address resolution of the relay device itself by the query determining means in the address lock table and making the lock state, and recording of the address lock table Of these, a domain that no longer needs to be blocked can be realized by a relay device having a lock releasing means for releasing the locked state.

  According to the present invention, even when the home gateway relay device is used as an L3 switch, it is possible to easily change the setting from the terminal while preventing a decrease in throughput. Thus, once installed, it is easy to change to a contract for enjoying a further service that uses another function of the relay device, so that it is easy to apply to both the installer and the operator.

FIG. 1 is a schematic diagram including the functional block of the relay device according to the present invention and the configuration on the LAN side WAN side Example of address lock table Configuration screen domain table example Switch table example Example of processing flow of L3 bridge unit when receiving from LAN side Example of processing flow of DNS processing unit when received from LAN side Example of processing flow of L3 bridge unit when received from WAN side Example of processing flow of DNS processing unit when received from WAN side Sequence diagram showing an example of processing when a DNS query packet designating the relay device itself is received Sequence diagram showing an example of processing when a DNS query packet designating a device other than the relay device is received

The present invention will be specifically described below.
The present invention is a relay device provided between a LAN and a WAN. Basically, a relay device that can be used as a home gateway used in a LAN such as a general household or a small-scale business is targeted. In other words, it is not a relay device having a high computing capacity such as that used in a large-scale network. The relay device basically does not perform processing such as routing and address translation when operating as an L3 switch. However, the relay apparatus according to the present invention includes a case where a router having these functions can be switched to a mode that operates as an L3 switch by changing a setting. This is an invention for enabling such setting change from the LAN side.

  FIG. 1 shows a surrounding network configuration diagram including a functional block diagram of the relay apparatus 1 according to the present invention. In the LAN 5 such as a home network or a small business network, a terminal 2 having an HTTP client function capable of accessing the relay device 1 and changing settings is provided. Specifically, a personal computer, a tablet, a smart phone, or the like in which a web browser is installed. The WAN 6, which is an external network, includes a communication carrier network, the Internet, and the like. The DNS server 3 is provided in an environment that can be accessed within the network, and can inquire when the terminal 2 performs web access.

  In addition, other devices may be provided on the LAN 5 side and the WAN 6 side. For example, the WAN 6 may be connected to an external network via the edge router 7. In this case, the relay device 1 actually exists in the LAN 5 partitioned by the edge router 7. Hereinafter, this state will be described as an example.

  The relay device 1 has a LAN side interface 21 connected to the LAN 5 and a WAN side interface 22 connected to the WAN 6, and has an L3 bridge unit 11 connecting between them. Also, it has a DNS processing unit 12 that delivers a packet from the L3 bridge unit 11. These may be programs executed by a calculation unit (not shown), or may be implemented by hardware having the function.

  In addition, the relay device 1 includes a storage unit 17. Although the storage unit 17 itself may be a volatile memory or a non-volatile memory, a volatile memory is basically used for a table described later in the present invention. The storage unit 17 is provided with at least one table and can be referred to or rewritten from the DNS processing unit 12 and the L3 bridge unit 11.

  When the DNS processing unit 12 receives the DNS query packet designating the relay device 1 itself, the DNS processing unit 12 resolves the DNS name by itself and responds to the terminal 2, and also responds to the DNS query packet from the DNS server 3. The NoSuchName response packet is blocked by itself without being sent to the terminal 2. Therefore, when a packet designating the relay device 1 itself is received, the contents are recorded in the storage unit 17, and when the L3 bridge unit 11 receives a response packet from the WAN side interface 22, By referring to the record, the packet can be blocked if necessary. Specifically, a table as necessary is created in the storage unit 17.

  When the DNS processing packet 12 is received by the DNS processing unit 12, the address lock table 14 is used to resolve a name for a domain that requests a screen of the relay device 1 itself. 10 is a table in which a block target address for discarding a NoSuchName response packet from the server 3 is described. An example of this table is shown in FIG. For the combination of the address of the DNS server 3 that is the destination of the received DNS query packet and the domain indicating the requested relay device 1 itself, the number of DNS query packets that have inquired about the domain has passed through the L3 bridge unit 11. The number of locks to be counted until a response is received, and a timer that is a timeout time.

In this address lock table 14, DNS query packets may be sent to a plurality of DNS servers 3 when there are a plurality of terminals 2. Processing is possible even if requests for all the DNS servers 3 are collected, but it is quickly determined at the L3 level whether or not the packets are from DNS servers other than those designated by the relay device, and packets are efficiently transmitted. It is preferable to provide an entry for each DNS server 3 for processing.
In addition, there is often a single request domain. For example, when a different domain is assigned to each service corresponding to the relay device 1, a plurality of types of domains are arranged in the table as addresses indicating the relay device 1 itself. .
Further, when a click is repeatedly generated on the screen display, or when a DNS query packet specifying the relay apparatus 1 itself is transmitted from a plurality of terminals 2 in a short time of about 1 minute or less, When an inquiry passes through the relay apparatus 1 in parallel, a DNS response is received for each DNS query packet. Therefore, each DNS response to the passed DNS query packet can be counted to set and release the lock. Thus, it is preferable to count the number of locks. Further, when a DNS query packet is sent by UDP, there is a case where there is no response from the DNS server 3, so that the lock can be released after a time-out period elapses. For example, the timeout time may be one minute after the last request arrives for one domain name, and the entry is deleted when that time elapses. Alternatively, a method of decrementing a predetermined number of seconds may be used.

  The setting screen domain table 13 is a table for referring to whether or not the requested domain indicates the relay apparatus 1 itself. In addition, when there are a plurality of domains indicating the relay device 1 itself, this is a table for identifying the type of screen that each domain designates. An example of the setting screen domain table 13 is shown in FIG. When there are multiple domains, a service provider operating a large-scale WEB server provides multiple HTTP servers, or when a domain is simply specified by an HTTP client such as a home gateway. For example (indicated by “Native” in the figure), a screen provided by Java (registered trademark) executed by the relay device as a Web server, a domain for a router library, and the like can be given. In FIG. 3, “Native” instructs to call a general screen (page), and “Java” instructs to call a Java dedicated holding screen (page). In order to demonstrate the difference between these locations, for example, the port number that should be specified when notifying the terminal of its own address is set to port 80 for Native, and port 8080 for Java. The Web page to be provided can be changed by changing it in the form of designation. By referring to the setting screen domain table 13 and the settings such as the port number associated therewith, it is possible to determine the address of other Web server functions from the Native side, or conversely, from other Web server functions, It is possible to determine the address of the function. Note that when there is only one domain indicating the relay device 1, a table having only domain values or a variable may be used instead of the table having the section as shown in FIG.

  The switch table 15 is a table that determines whether the L3 bridge unit 11 passes the packet or passes it to the processing of the DNS processing unit 12 when the DNS response is received from the WAN side interface 22. An example is shown in FIG. Basically, there is only one item, and the default is passable (indicated by “OK” in the figure). Alternatively, it may be recorded as a 1-bit variable of 1 or 0. This item corresponds to the number of locks in the address lock table 14, and when the number of locks for recording in all domains is 0, there is no need to process the DNS processing unit 12, so that the item can be passed. If all the tables in the address lock table 14 are scanned, the processing load is too large. If the lock is not applied, the throughput can be maintained by allowing only the values in the switch table 15 to pass. Can do. The DNS processing unit 12 may be changed with reference to the address lock table 14, and only browsing is possible from the L3 bridge unit 11. Or when it is a value which can pass, you may make it pass unconditionally.

A processing flow of the embodiment of the relay device 1 according to the present invention will be described using a flow example of FIG.
First (S101), the L3 bridge unit 11 that has received a packet from the LAN side interface 21 (S102) executes L3 layer confirmation means 116 for confirming the L3 layer of the acquired packet (S103). As this L3 layer confirmation means, the following S104 and S106 are performed. First, it is determined whether the address of the L3 layer is an IP address indicating the relay device 1 itself (S104). If the IP address indicates the relay device 1 itself (S104-Yes), the packet is directly accessed from the terminal 2 after the DNS name is resolved through the following series of procedures. Then, a routing process such as selection of the setting screen and transmission thereof is performed by handing over to each module (S105).

  On the other hand, when the destination address of the L3 layer is not the relay device 1 itself (S104-No), it is further confirmed whether or not the protocol number of the L3 layer is DNS (S106). If it is not DNS (S106-No), since the L3 bridge unit 11 may relay as it is, the packet is transferred to the WAN side interface 22 (S108). On the other hand, if the protocol number of the L3 layer is DNS (S106-Yes), that is, if it is a DNS query packet, the DNS processing unit 12 copies the packet and delivers it to the DNS processing unit 12 (S107). At the same time, the query relay copy unit 111 is transferred to the WAN side interface 22 (S108). Thereby, while the transfer as the relay device 1 is performed without taking time, the DNS query packet can be processed in parallel by the DNS processing unit 12 as described in the next flow.

  Next, processing in the DNS processing unit 12 that has received the DNS query packet in S107 will be described with reference to the flow example of FIG. When the DNS query packet copied from the L3 bridge unit 11 is received (S112), the query determination unit 121 that determines whether the DNS query packet is for resolving the address of the relay device 1 itself is executed. . Specifically, first, the destination IP address and domain of the DNS query packet are extracted (S113). Here, the destination IP address is basically the DNS server 3 used by the terminal 2. The extracted domain is compared with the domain recorded in the setting screen domain table 13 (S114). If there is no setting screen domain table 13, a fixed value storing a domain indicating the relay device 1 is referred to instead. The setting screen domain table 13 will be collectively described. When this domain designates a screen held by the relay device 1 (S115-Yes), the process proceeds to S116 and subsequent steps. If not applicable (S115-No), the DNS name of the other server on the WAN 6 is resolved, and the DNS server 3 can respond, so the processing of the DNS processing unit 12 ends. The steps up to here are the query determination means 121.

If the extracted domain is applicable, the DNS query packet reaches the DNS server 3 and it is necessary to block the DNS response returned by the response. For this purpose, the lock domain recording unit 123 is executed which registers information corresponding to the response from the DNS server 3 that must be blocked. Specifically, first, it is determined whether or not the combination of the destination IP address and domain of the DNS query packet corresponds to an entry registered in the address lock table 14 (S116).
If it has not been registered, then as an interrupt process, it is determined whether or not there is a registered entry in the address lock table 14 (S117). If there is no entry, the value of the switch table 15 that is “OK” that can be passed by default is changed to the passage restriction “NG” (S118), and the switch NG switching means 125 is executed. If the entry already exists, the value of the switch table 15 is already “NG”, and the process proceeds to the next process.

  Note that the switch NG switching means 125, which is a combination of S117 and S118, may be back and forth with S119.

  Next, as a specific procedure of the lock domain recording unit 123, the destination IP address, that is, the address of the DNS server 3 and the requested domain are recorded as new entries in the address lock table 14 (S119). Then, the number of locks of the entry in the address lock table 14 is incremented by 1 and set so that it can be blocked when a DNS response is received (S120). At the same time, the timer value is updated. The value after the update is not particularly limited, but when the DNS query packet is UDP, it is preferable that the time is considered to have been discarded. Specifically, it may be about 60 seconds. As a timer setting, a time-out time may be registered / updated, or a method of decrementing the counted number of seconds every second may be used.

  On the other hand, if an entry with the same IP address and domain combination already exists in S116 (S116-Yes), the same query is sent to the same DNS server 3, and the lock count of the entry is incremented by one. At the same time, the numerical value of the timer is updated (S120). This is the case when there are multiple inquiries in succession. The incrementing process and the timer updating process itself are the same as described above.

  After that, the DNS processing unit 12 executes a self-address specifying unit 122 that generates a DNS response packet to which the IP address of the relay device 1 is assigned as a response to the received DNS query packet. When there are a plurality of locations in the setting screen domain table 13, a packet with other information such as a port number may be generated. When the DNS response packet is transferred to the L3 bridge unit 11, the L3 bridge unit 11 executes the self-address notifying unit 113 that transmits the DNS response packet with the source address of the original DNS query packet as the destination. (S121).

  The terminal 2 that has received the DNS response performs HTTP access to the IP address of the relay device 1. Receiving this, the relay apparatus 1 transmits the data of the web page corresponding to the service defined in the setting screen domain table 13 by the built-in HTTP server function unit (not shown), and changes the setting from the terminal 2. Can be accepted.

  In parallel with this, the DNS query packet relayed by the L3 bridge unit 11 reaches the DNS server 3. If the domain inquired by the DNS query packet is a domain in which the DNS server 3 can resolve the name, a DNS response including the corresponding IP address can be returned. Is a domain name that cannot resolve the DNS name, and returns a DNS response that is a NoSuchName packet after a timeout.

  The behavior of the relay device 1 when this DNS response is returned from the WAN side interface 22 will be described with reference to the flow example of FIG. First (S201), when a packet is received from the WAN-side interface 22 (S202), the L3 bridge unit 11 executes designation determination means 117 for confirming the L3 layer of the packet (S203). If the address of the L3 layer is destined for the relay device 1 itself (S204-Yes), the routing process is performed without bridging (S205). If the destination is not the relay apparatus 1 itself (S204-No), the process proceeds to the process determination for the bridge.

  Here, the L3 bridge unit 11 executes the switch confirmation unit 114 that refers to the value of the switch table 15 (S206). If the value of the switch table 15 is passable ("OK") (S207-Yes), since the DNS processing unit 12 is not waiting for a DNS response to be blocked at that time, the L3 bridge unit 11 The switch reference transfer means 115 for transferring the packet to the LAN side interface 21 through the L3 bridge as it is is executed (S211). When the value of the switch table 15 is not passable (S207-No), the discard inquiry means 118 is inquired to the DNS processing unit 12 as to whether or not the packet should be discarded (S208). Processing for this inquiry will be described later. Until the processing result is notified from the DNS processing unit 12, the process waits while holding the packet (S209 → S210). If there is no notification from the DNS processing unit 12 after the predetermined set time has elapsed, the corresponding packet discarding means 112 for discarding the DNS response packet is executed (S210 → S212).

  Note that a specific notification that the packet is to be discarded may be transmitted from the DNS processing unit 12 to the L3 bridge unit 11. In this case, the corresponding packet discarding means 112 is executed without waiting in S210 and in the procedure of ending the packet without transferring it when the notification arrives (S212).

  Next, the process of the lock state confirmation unit 126 by the DNS processing unit 12 that has received the DNS response from the discard inquiry unit 118 in S208 will be described with reference to the flow of FIG. The DNS processing unit 12 that has taken over the processing from the L3 bridge unit 11 extracts the transmission source IP address and the domain included in the DNS response packet (S223). Here, the source IP address is the address of the DNS server 3. Then, the address lock table 14 is confirmed (S224), and it is determined whether or not the combination of the extracted DNS server 3 address and domain is in the address lock table 14 (S225).

  If the combination does not exist (S225-No), the DNS response is not a response to the DNS query packet designating the relay device 1 itself, but designates any server in the WAN 6, and is blocked as it is. You can forward without having to. For this reason, a reply notification indicating that it is allowed to pass is transmitted to the L3 bridge unit 11 (S226 → S209—Yes). As described above, the L3 bridge unit 11 that has received this response notification transfers the held packet to the LAN-side interface 21 and a DNS response reaches the terminal 2 (S211).

  On the other hand, if the above combination exists (S225-Yes), the DNS response is a response to the DNS query packet designating the domain of the relay device 1 itself, and is basically a NoSuchName packet. In this case, the L3 bridge unit 11 is not notified that transfer is permitted. However, since the DNS response to be blocked is returned, the unlocking operation for the amount of the blocking role is performed. First, the number of locks of the entry of the combination is decremented by 1 from the address lock table 14 (S227). For the DNS server 3 and domain of the entry, if the number of waiting DNS responses, that is, if there is only one remaining DNS query packet that has passed through the L3 bridge portion, the number of locks is decremented by -1. The lock releasing means 124 for releasing the locked state is executed.

  Then, the DNS processing unit 12 executes the release entry confirmation unit 127 for confirming whether or not there is an entry whose lock count is 0 in the address lock table 14 (S228). If there is an entry (S228-Yes), the entry is deleted (S229).

  Further, (S228-No), if there is a method of recording the end time among the entries of the address lock table 14, whether or not there is an elapse of the time, or in the case of a method of decrementing the remaining time The timer confirmation means 128 for confirming whether there is a timer whose timer is 0 second is executed (S230). If there is a corresponding entry (S230-Yes), the entry is deleted (S231). ).

  After the arrangement of these tables (S230-No), if there are still entries in the address lock table 14, the L3 bridge unit 11 continues to determine whether or not to block packets received from the WAN side interface. Since it must be present (S232-Yes), the process ends as it is (S234). On the other hand, if all entries in the address lock table 14 have been deleted (S232-No), it is no longer necessary to block the DNS response, so the pass / fail value of the switch table 15 is changed to “OK” that can be passed. The switch permission means 129 is executed (S233). Accordingly, thereafter, until a new entry is added to the address lock table 14, the L3 bridge unit 11 bridges the packets other than the one specifying the relay device 1 received from the WAN side interface 22 as it is and performs the LAN side interface 21. The switch reference transfer means 115 for transferring the data to the network is executed, and the throughput can be maintained as a bridge.

  In any case, if the L3 bridge unit 11 is not notified that the packet is allowed to pass, the L3 bridge unit 11 waits for a predetermined time-out (S210) and is suspended. The corresponding packet discarding means 112 for discarding the DNS response packet is executed.

  Note that the DNS processing unit 12 may notify the L3 bridge unit 11 that the packet is discarded without passing through the packet before and after S227. In this case, the L3 bridge unit 11 executes the corresponding packet discarding unit 112 that discards the retained DNS response packet without waiting for a timeout.

The above series of flows will be described with reference to the sequence diagrams shown in FIGS.
First, the terminal 2 transmits an RS (Router Solicitation) to the edge router 7 constituting the LAN 5 (S301), and receives an RA (Router Advertisement) from the edge router 7 (S302). Next, an information request is transmitted, and a response including the address of the DNS server 3 is received from the edge router. Up to this point, the relay device 1 simply acts as an L3 bridge and passes packets.

  Next, the terminal 2 transmits a DNS query packet to designate the relay device 1 (S311). Here, when the L3 bridge unit 11 confirms the DNS query packet with the L3 layer confirmation unit 116, the query relay passes the packet to both the WAN side interface 22 (S312 and S108) and the DNS processing unit 12 (S313 and S107). The copy unit 111 is executed. In response to the DNS query packet designating the relay device 1, the DNS processing unit 12 generates a DNS response including the IP address of the relay device 1 itself and passes it to the L3 bridge unit 11 (S314, S121). Run. The L3 bridge unit 11 that has received the DNS response executes the self-address notifying unit 113 that transmits the DNS response to the terminal 2 (S316, S121). At the same time, the lock domain recording means 123 that registers the address of the DNS server 3 and the requested domain in the address lock table 14 and puts them into a locked state is executed (S315, S119, S120). At the same time, the switch NG switching means 125 for setting the passage to “NG” in the switch table 15 is executed (S317, S118).

  The terminal that has obtained the IP address of the relay device 1 transmits a request specifying the IP address from the HTTP client in order to call the setting screen of the relay device 1 (S321). Since this packet directly designates the relay device 1 by an IP address, the L3 bridge unit 11 does not bridge, but delivers the request to the HTTP server 18 inside the relay device 1 (S322). The HTTP server 18 generates the corresponding web page data according to the service defined in the setting screen domain table 13 and passes it to the L3 bridge unit 11 (S325), and the L3 bridge unit 11 transmits the data to the terminal 2 ( S326). Although not shown below, the setting of the relay device 1 can be changed using the form of the web page.

  On the other hand, with respect to the DNS query packet sent to the DNS server 3 in S312, the DNS server 3 naturally cannot resolve the DNS name and times out and returns a DNS response that becomes NoSuchName (S331). When the L3 bridge unit 11 receives this, the L3 bridge unit 11 refers to the switch table 15 to hold it, and executes the packet discard unit 112 when a predetermined time elapses or a discard instruction is received.

  For the DNS query packet (S351) for obtaining an IP address other than the relay device 1, the query relay copy unit 111 is executed (S352, S353), but the DNS processing unit 12 confirms the domain and relays it. If it is confirmed that the device 1 is not itself, the address lock table 14 and the switch table 15 are not updated. On the other hand, a DNS response is returned from the DNS server 3 (S354). At this time, if the switch confirmation unit 114 is executed and the switch table 15 is “OK”, the L3 bridge unit 11 remains in the LAN. The switch reference transfer means 115 for transferring to the side interface is executed. As a result, the DNS name is resolved, and the terminal 2 can access the external HTTP server (S355, S356). At this time, the relay apparatus 1 does not become an obstacle.

1 Relay device 2 Terminal 3 DNS server 5 LAN
6 WAN
7 Edge router 11 L3 bridge unit 12 DNS processing unit 13 Setting screen domain table 14 Address lock table 15 Switch table 17 Storage unit 18 HTTP server 21 LAN side interface 22 WAN side interface 111 Query relay copy unit 112 Corresponding packet discard unit 113 Self address Notification means 114 Switch confirmation means 115 Switch reference transfer means 116 L3 layer confirmation means 117 Specification determination means 118 Discard inquiry means 121 Query determination means 122 Self address designation means 123 Lock domain recording means 124 Lock release means 125 Switch NG switching means 126 Lock Status confirmation means 127 Release entry confirmation means 128 Timer confirmation means 129 Switch permission means

Claims (4)

A relay device having a LAN side interface, a WAN side interface, and an L3 bridge unit that relays between them,
In parallel with transferring the DNS query packet received from the LAN side interface to the WAN side interface, the DNS query packet is analyzed, and if the DNS query packet that designates the relay device itself is analyzed, A DNS response including the IP address of the device itself is returned to the transmission source address of the DNS query packet, and before and after the return, the DNS response to the DNS query packet returned from the external DNS server received from the WAN side interface Relay device that shuts off. A DNS processing unit for processing a DNS query packet;
An address lock table for recording a domain of a packet specifying the relay device itself among DNS query packets passing through the relay device, and holding information in a locked state for blocking a DNS response to the DNS query packet;
A switch table having a value that allows passage if there is no record of the domain in the locked state in the address lock table, and a value that restricts passage if there is one or more records of the domain in the locked state; ,
Have
The L3 bridge is
In parallel with transferring the DNS query packet received from the LAN side interface to the WAN side interface, a query relay copy unit that copies the DNS query packet and delivers it to the DNS processing unit;
Corresponding packet discarding means for discarding the DNS response packet when the DNS response is received from the WAN side interface and the domain included in the DNS response corresponds to the information recorded in the address lock table and in the locked state. When,
Self-address notifying means for transmitting a DNS response including the address of the relay device itself to a source address of a DNS query packet requesting resolution of the name of the relay device itself;
Switch confirmation means for referring to the switch table when a DNS response is received from the WAN side interface;
If the switch table is a value that allows passage, a switch reference transfer means for transferring the DNS response to the LAN side interface via L3 bridge;
Have
The DNS processing unit
Query determination means for determining whether the received DNS query packet is for resolving the address of the relay device itself;
Self that generates a DNS response that resolves the DNS name including the IP address of the relay device itself to the source address of the DNS query packet determined by the query determination means to resolve the address of the relay device itself Addressing means;
Lock domain recording means for recording the domain of the DNS query packet determined to be for address resolution of the relay device itself by the query determining means in the address lock table and setting the locked state;
Of the records in the address lock table, the domain that no longer needs to be blocked has unlocking means for releasing the locked state,
The relay device according to claim 1. For a relay device having a LAN side interface, a WAN side interface, and an L3 bridge that relays between them,
In parallel with transferring the DNS query packet received from the LAN side interface to the WAN side interface, the DNS query packet is copied and analyzed, and if the DNS query packet designates the relay device itself, the relay device A method for operating a relay device, which returns a DNS response including its own IP address to the source address of the DNS query packet and blocks the corresponding DNS response received from the WAN side interface. For a relay device having a LAN side interface and a WAN side interface, an L3 bridge unit that connects between them, a DNS processing unit that processes a DNS query packet, and a storage unit that can record a table,
An address lock table that records the domain of a packet that specifies the relay device itself among DNS query packets that pass through the relay device in the storage unit, and holds information in a locked state that blocks a DNS response to the packet domain; ,
A switch table having a value that allows passage if there is no record of the domain in the locked state in the address lock table, and a value that restricts passage if there is one or more records of the domain in the locked state; ,
Provided,
In parallel with transferring the DNS query packet received from the LAN side interface to the WAN side interface, the L3 bridge unit copies the DNS query packet and passes it to the DNS processing unit;
When a DNS response is received from the WAN side interface, if the domain included in the DNS response is recorded in the address lock table and is in a locked state, a corresponding packet discarding unit for discarding the DNS response packet;
A self-address notifying means for transmitting a DNS response including the address of the relay device itself to a source of a DNS query packet requesting resolution of the name of the relay device itself;
Switch confirmation means for referring to the switch table when a DNS response is received from the WAN side interface;
If the switch table is a value that allows passage, switch reference transfer means for quickly transferring the DNS response to the LAN side interface by L3 bridging,
To function,
The DNS processing unit is
Query determination means for determining whether the received DNS query packet is for resolving the address of the relay device itself;
A self-addressing means for generating a DNS response for resolving the DNS name to the source address of the DNS query packet determined by the query determination means to resolve the address of the relay device itself;
Lock domain recording means for recording the domain of the DNS query packet determined to be for address resolution of the relay device itself by the query determining means in the address lock table and setting the locked state;
A program for functioning as a lock release means for releasing the lock state for a domain that is no longer required to be blocked in the record of the address lock table.

Images