H.323通信穿越NAT防火墙的轻量化方法  

A Lightweight Approach of H.323 Communication over NAT Firewall

作　　者：洪亮[1] 贺斌[1] 罗铁坚[1] 

机构地区：[1]中国科学院研究生院,北京100049

出　　处：《计算机仿真》2008年第4期106-108,168,共4页Computer Simulation

基　　金：国家重点实验室网上合作研究平台(2003DEA5G040);"十一五"国家科技基础条件平台建设子项目高等级生物安全实验室网上协作研究平台(2005DKA64100);"十一五"国家科技基础条件平台建设子项目大型科学仪器中心共享与合作网(2005DKA10201)

摘　　要：针对防火墙阻碍了私网内H.323视频会议终端与公网通信的问题,结合OpenH323软件仿真分析,提出了一种固定动态端口,利用防火墙地址端口映射实现的轻量化方法。先分析H.323通信过程的仿真结果,得到H.323呼叫过程的端口占用情况,然后通过限制终端动态网络端口分配区间的方法固定通信端口,使动态端口通信能够利用NAT端口地址转换穿越防火墙。最后进行仿真实验验证,证明解决了私网中H.323通信穿越防火墙的问题。与现有的其他方法相比,改造成本更低,网络安全性的影响更小,并在国家网络科技环境建设中被广泛采用,收到良好的效果。This paper is concerned with the problem that firewall blocks the H. 323 endpoint making a call from local network to internet. Based on the OpenH323 software emulation analysis, a lightweight approach is proposed which makes the dynamic ports stable and uses the firewall＇s NAT to transmit H. 323 packages. This approach analyzes the H. 323 communication emulating result to get the information about net port assignment. Then, it restricts the dynamic ports＇ rang to fix up these ports, makes it easy to be used by firewall＇s NAT. At last, it is tested by the emulating experiment. The result shows that the H. 323 communication successfully travels through the firewall by this approach. Compared with other existing solutions, it cost less and has less influence on existing network＇s security. Now, it is broadly used in the project of network scientific research environment in China with satisfactory feedbacks.

关 键 词：观频会议 网络地址转换 防火墙 动态端口 

分 类 号：TP393.0[自动化与计算机技术—计算机应用技术]