Packet transmission method, apparatus, and network system

A packet transmission method, comprising:

• receiving, by a Security Socket Layer Protocol (SSL) Virtual Private Network (VPN) server, an encrypted packet sent by a client device through a VPN tunnel, wherein the encrypted packet is sent by the client device after the client device determines, according to a preset control policy, that a destination Internet Protocol (IP) address and a destination port of a packet to be sent are included in the control policy and encrypts the packet to be sent, and an IP address and a port included in the preset control policy are an IP address and a port of an intranet server that can exchange a packet with the SSL VPN server;
• decrypting, by the SSL VPN server, the encrypted packet;
• sending, by the SSL VPN server, the decrypted packet to a corresponding intranet server, wherein a source IP address of the decrypted packet is an external network IP address;
• storing a mapping relationship between the destination IP address and the destination port of the decrypted packet and the VPN tunnel;
• receiving, by the SSL VPN server, a response packet which is sent from the intranet server and forwarded by a routing device, wherein the response packet is forwarded to the SSL VPN server by the routing device after the routing device determines, according to a preset control policy, that a source IP address and a source port of the response packet are included in the preset control policy;
• and
• according to the source IP address and source port of the response packet and the stored main relationship, sending, by the SSL VPN server, the response packet after encryption to the client device through the VPN tunnel corresponding to the source IP address and source port.

A Security Socket Layer Protocol (SSL) Virtual Private Network (VPN) server, comprising:

• a first receiving unit, configured to receive an encrypted packet sent by a client through a VPN tunnel, wherein the encrypted packet is sent by the client device after the client device determines, according to a preset control policy, that a destination Internet Protocol (IP) address and a destination port of a packet to be sent are included in the preset control policy and encrypts the packet to be sent, and an IP address and a port included in the preset control policy are an IP address and a port of an intranet server that can exchange a packet with the SSL VPN server;
• a decrypting unit, configured to decrypt the encrypted packet;
• a first sending unit, configured to send the decrypted packet to a intranet server, wherein a source IP address of the decrypted packet is an external network IP address;
• a storing unit, configured to store a mapping relationship between the destination IP address and the destination port of the packet, decrypted by the decrypting unit, and the VPN tunnel;
• a second receiving unit, configured to receive a response packet from the intranet server;
• a determining unit, configured to determine whether a source IP address and a source port of the response packet are included in the control policy;
• a first encrypting unit, configured to encrypt the response packet after the determining unit determines that a source IP address and a source port of the response packet are included in the control policy;
• and
• a second sending unit, configured to send the encrypted response packet to the client device through the VPN tunnel corresponding to the source IP address and source port number of the encrypted response packet according to the mapping relationship stored by the storing unit after the determining unit determines that the source IP address and the source port of the response packet are included in the control policy.

A Security Socket Layer Protocol (SSL) Virtual Private Network (VPN) server, comprising:

• a first receiving unit, configured to receive an encrypted packet sent by a client through a VPN tunnel, wherein the encrypted packet is sent by the client device after the client device determines, according to a preset control policy, that a destination Internet Protocol (IP) address and a destination port of a packet to be sent are included in the preset control policy and encrypts the packet to be sent, and an IP address and a port included in the preset control policy are an IP address and a port of an intranet server that can exchange a packet with the SSL VPN server;
• a decrypting unit, configured to decrypt the encrypted packet;
• a first sending unit, configured to send the decrypted packet to a intranet server, wherein a source IP address of the decrypted packet is an external network IP address;
• a third receiving unit, configured to receive a response packet which is sent from the intranet server and is forwarded by a routing device, wherein the response packet is forwarded to the SSL VPN server by the routing device after the routing device determines, according to the preset control policy, that a source IP address and a source port of the response packet are included in the preset control policy;
• a second encrypting unit, configured to encrypt the response packet;
• and
• a third sending unit, configured to send the response packet encrypted by the second encrypting unit to the client device through the VPN tunnel.