JP5103031B2 - Network communication method and system - Google Patents

Description

  The present invention relates to a network communication method and system thereof, and more particularly, between networks having different IP address (Internet Protocol Address) systems connected by a network address translation device (hereinafter referred to as a NAT device (Network Address Translator)). The present invention relates to a tunneling communication system and method for realizing packet communication beyond a NAT device, and a NAT-GW device used in the system.

  Generally, a network used by a company is a local network within the company (hereinafter referred to as an internal segment), an external network such as the Internet (hereinafter referred to as an external segment), and a server device that is open to the external segment. The DMZ segment (Demilitarized Zone) is roughly divided into three, and each segment is separated by a FW (Fire Wall) device.

In such a network configuration, for example, when communication using the SIP (Session Initiation Protocol) is performed between the external segment and the internal segment, the SDP (Session Description Protocol) in the SIP message is analyzed in addition to the normal NAT function. The SIP-NAT technology that converts the IP address in the SDP is used.
The NAT device is disclosed in Non-Patent Document 1, the SIP is disclosed in Non-Patent Documents 2 and 3, and the SDP is disclosed in Non-Patent Document 4 in detail.

K. Egevang, P. Francis, “The IP Network Address Translator (NAT)”, May 1994, URL: http://www.ietf.org/rfc/rfc1631.txt M. Handley, H. Schulzrinne, E. Schooler, J. Rosenberg, “SIP: Session Initiation Protocol”, March 1999, URL: http://www.ietf.org/rfc/rfc2543.txt J. Rosenberg, H. Schulzrinne, G. Camarillo, A. Johnston, J. Peterson, R. Sparks, M. Handley, E. Schooler, “SIP: Session Initiation Protocol”, June 2002, URL: http: // www .ietf.org / rfc / rfc3261.txt M. Handley, V. Jacobson, “SDP: Session Description Protocol”, April 1999, URL: http://www.ietf.org/rfc/rfc2327.txt

  According to the prior art, in a data communication system using an SIP session, there is a problem that communication via an SIP server in an internal segment connected by a NAT device cannot be performed.

  In addition, when data communication using an SIP session is performed with a terminal in an internal segment connected by a NAT device, it is necessary to add a global IP address to the SIP server and disclose it to the external segment. In addition, when there are a plurality of ports used for communication, it is necessary to permit the communication of all the ports, so the security setting for the network must be changed.

  An object of the present invention is to solve the above-described problems of the prior art and to realize a communication between terminal devices in different network systems connected via a NAT-GW device, a tunneling communication method therefor, a system therefor, and a communication used therefor It is to provide a computer program and a NAT-GW apparatus.

The communication method according to the present invention is preferably an external terminal device belonging to an external segment having a certain address system for data communication, and a tunneling communication terminal device and an internal terminal belonging to an internal segment having an address system different from the external segment. A communication method in which packet communication is performed using a session (SIP session) established by a session initiation protocol (SIP) between both terminal devices by connecting the device via a NAT-GW device,
In the tunneling communication termination device that terminates the tunneling communication in the internal segment, the SIP packet is analyzed, the routing of the packet between the external terminal device and the internal terminal device is controlled, and the packet to the internal terminal device is transmitted and received.
In the NAT-GW device, the tunneling packet is relayed and a connection is awaited at one TCP port, a TCP connection (TCP connection) is established between the external terminal device and the NAT-GW device, and between the NAT-GW device A TCP connection corresponding to the destination information included in the tunneling packet is established by establishing another TCP connection between the tunneling communication terminating devices, associating the IP address and port number of each terminal of the external terminal device and the internal terminal device with each TCP connection. A communication method characterized in that packet communication is performed between an external segment and an internal segment using a connection.

In a preferred example, the tunneling communication termination device and the external terminal device inquire about the TCP port number connected to the NAT-GW device, establish a connection to the TCP port returned from the NAT-GW device, and establish the established TCP connection. To perform tunneling communication.
Preferably, the tunneling communication is permitted only between the destinations where the SIP session has established the combination of the destination IP address and the port number that permits the packet relay in the NAT-GW device and the packet forwarding in the tunneling communication termination device.
Preferably, the tunneling communication is performed without depending on the protocol of the application layer of packets transmitted and received between the external terminal device and the internal terminal device.

The network communication system according to the present invention preferably includes an external terminal device belonging to an external segment having a certain address system for data communication, a tunneling communication terminator belonging to an internal segment having an address system different from the external segment, and an internal A network communication system in which a terminal device is connected by a NAT-GW device and packet communication is performed using a session (SIP session) established by a session start protocol (SIP) between both terminal devices,
A tunneling communication termination device that terminates tunneling communication in an internal segment includes a packet conversion unit that performs conversion related to a tunneling packet, a tunneling packet transmission unit that transmits and receives a tunneling packet, a SIP analysis unit that analyzes a SIP packet, and an external terminal device, A packet routing control unit that controls routing of packets between internal terminal devices, and a function that notifies packets received from the internal terminal devices to the packet routing control unit and transmits packets notified from the packet routing control unit to the internal terminal devices A packet transfer unit having
The NAT-GW device includes a tunneling communication control unit that controls a destination of a tunneling packet, a tunneling packet relay unit that relays a tunneling packet between an external terminal device and a tunneling communication termination device, and the NAT-GW device includes: Waits for connection at one TCP port, establishes a TCP connection (TCP connection) between the external terminal device and the NAT-GW device, and establishes another TCP connection between the NAT-GW device and the tunneling communication terminator. The packet between the external segment and the internal segment using the TCP connection corresponding to the destination information included in the tunneling packet by associating the IP address and port number of each terminal of the external terminal device and the internal terminal device with each TCP connection Network communication system characterized by communication It is a non.

The present invention can also be configured as a program that realizes the above operation or function in the tunneling termination device and the NAT-GW device.
Further, the NAT-GW apparatus according to the present invention has an external segment including an external terminal apparatus having a certain address system for data communication, and an address system different from the external segment, and includes a tunneling termination apparatus and an internal terminal apparatus. In a NAT-GW device that manages packet communication using a session (SIP session) established by a session initiation protocol (SIP) between both terminal devices, intervening between internal segments including
A tunneling communication control unit that controls a destination of the tunneling packet; a tunneling packet relay unit that relays a tunneling packet between the external terminal device and the tunneling communication termination device; Establish a TCP connection (TCP connection) between the NAT-GW device, establish another TCP connection between the NAT-GW device and the tunneling communication terminator, and the IP address of each terminal of the external terminal device and the internal terminal device The NAT-GW apparatus is characterized in that the port number and each TCP connection are associated with each other, and packet communication is performed between the external segment and the internal segment using the TCP connection corresponding to the destination information included in the tunneling packet.

  ADVANTAGE OF THE INVENTION According to this invention, the communication between the terminal devices in a different network system connected via a NAT-GW apparatus is realizable. Further, by adding transmission source and destination information to a tunneling packet, a plurality of terminal devices can communicate with each other through a plurality of connections using one TCP port. Furthermore, the communication path can be controlled by the SIP message.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.
FIG. 1 shows a configuration example of a network communication system.
In this communication system, a DMZ segment (Demilitarized Zone) 11 connecting the external segment 10 and the internal segment 12 having different address systems is interposed. Various terminal devices exist in the external segment 10. In this example, the terminal 102 that does not pass through the NAT-GW device 113 and the external terminal device 103 that passes through the NAT-GW device 113 are included. The external terminal device 103 can be connected to the internal terminal device 13 via the Internet 104 and the DMZ segment 113. This is called NAT traversal communication. The configuration of the external terminal device 103 that passes through the NAT-GW device 113 will be described later.

  The DMZ segment 113 includes a firewall 112 and a NAT-GW device 113. The NAT-GW apparatus 113 performs address conversion on the external terminal apparatus (via the NAT-GW apparatus) 103 in the external segment 10 and relays communication over NAT by communication with the tunneling termination apparatus 105 (tunneling communication). On the other hand, access from the terminal 102 that does not pass through the NAT-GW apparatus 113 is blocked by the firewall 112. The NAT-GW apparatus 113 has a function characteristic of the present invention, and the configuration thereof will be described later.

The internal segment 12 includes a plurality of internal terminal devices 131 and 132 (sometimes collectively referred to as 13), a tunneling communication termination device 14 that terminates tunneling communication and forwards packets to the internal terminal device 13, and relays SIP messages. A SIP server 15 is included.
The configuration of the tunneling termination device 105 will be described later.

FIG. 2 shows the configuration of the external terminal device 103.
The external terminal device 103 is a terminal capable of performing communication over NAT, and has a SIP application 210 that realizes packet communication. The SIP application 201 processes the SIP protocol, communicates with the SIP server 15 to establish a SIP session, and media data such as audio and video on the SIP session established by the SIP unit 202. A media unit 203 that transmits / receives a packet, a packet conversion unit 204 that generates a tunneling packet, a tunneling packet transfer unit 205 that performs tunneling communication with the NAT-GW device 113, and a socket unit 206 that transmits IP packets. Have While a normal communication packet is composed of a header part and a data part, a tunneling packet generated by the packet conversion part 204 has a tunnel packet header part for holding an address for tunnel communication in addition to these parts. .
Note that the various functions in the SIP application 210 are realized by executing predetermined applications on a processing device (CPU) that is a hardware resource.

FIG. 3 shows the configuration of the NAT-GW apparatus 113.
The NAT-GW device 113 acquires a destination from the tunneling packet received from the tunneling communication termination device 14 of the external terminal device 103 or the internal terminal device 13 and relays the tunneling packet to the IP address of the destination. 302, a tunneling communication control unit 301 that manages a destination of tunneling communication by associating a destination IP address, a port number, and a TCP connection, a socket unit 303 that transmits a tunneling packet, and a management for transmission / reception data and communication It has a memory 304 for storing information. Characteristically, the packet relay table 40 (FIG. 4) for managing the relay of the tunneling packet is stored in the memory 304, and the external terminal device 103 and the tunneling communication terminator 14 are referred to with reference to the relay table 40. Relay packets to and from.

  As shown in FIG. 4, the packet relay table 40 registers and manages a destination 401 composed of the IP address and port number of the internal terminal device 13 and a connection 402 formed corresponding thereto.

FIG. 5 shows the configuration of the tunneling communication terminator 14.
The tunneling communication termination device 14 is connected between the SIP analysis unit 501 that acquires or sets the IP address and port number in the received SIP message, the packet conversion unit 502 that generates a tunneling packet, and the NAT-GW device 113. The tunneling packet transmission unit 503 for performing the tunneling communication, the IP address and port number of the external terminal device 103, the port number of the tunneling communication termination device 14, and the IP address and port number of the internal terminal device 13 or SIP server 15 are associated with each other. A packet routing control unit 505 that manages the destination of the packet received by the tunneling communication termination device 14, a packet transfer unit 506 that transmits / receives a packet to / from the internal terminal device 13 or the SIP server 15, and a memory 507. Composed.
Characteristically, the packet transfer table 60 (FIG. 6) for managing the relay of tunneling packets is stored in the memory 507, and the NAT-GW 113, the internal terminal device 13, and the like are referenced by referring to the transfer table 60. Manage the transfer of packets between.

  As shown in FIG. 6, the packet forwarding table 60 corresponds to the connection 61, the IP address and port number 62 of the external terminal device, the opening port number 63 of the tunneling termination device 14, the IP address and port number of the internal terminal device. Register and manage 64 pairs. The packet routing control unit 505 refers to the packet forwarding table 60 to determine the IP address and port number of the external terminal device, the port number of the tunneling communication termination device 14, the IP address of the internal terminal device 13 or the SIP server 15, and Associate the port number and set the route.

Next, the operation of the NAT crossing tunneling communication will be described with reference to FIG.
FIG. 7 shows a procedure from the start of communication from the external terminal device 103 to the disconnection of the route after the NAT traversal communication with the internal terminal device 13 is completed.
As a communication procedure between the external terminal device 103 and the internal terminal device 13, first, a step of establishing a TCP connection (connection) between the external terminal device 103 and the tunneling communication terminator 14 by relaying the NAT-GW device 113. 701 (refer to FIG. 8 for details), and then a step 702 (step 702) of establishing a tunneling communication path between the external terminal device 103, the NAT-GW device 113, the tunneling communication termination device 14, the SIP server 15, and the internal terminal device 13. For details, refer to FIGS. 9 and 10), and transmission / reception of data packets such as media data between the external terminal device 103 and the internal terminal device 13 via the NAT-GW device 113 or the like using the established communication path. Step 703 (refer to FIGS. 13 and 14 for details), and finally, when the data communication is completed, Step 7 for cutting the tunneling communication path. 4 (for details see FIGS. 11 and 12), performs the processing of each step of the.

Next, the processing steps 701 to 704 will be described in detail with reference to FIG.
The connection establishing operation 701 will be described with reference to FIG.
First, the tunneling communication termination device 14 inquires about the TCP port number to be connected to the NAT-GW device 113 by tunneling communication (S801). The NAT-GW apparatus 113 establishes an unused TCP port “5080” and returns the established port number “5080” to the tunneling communication terminator 14 as the inquiry source (S802). The tunneling terminating device that has received the port number establishes a TCP connection (Connection 1) for communication to the SIP server 15 for the port number “5080” (S803).

  Similarly, the external terminal apparatus 103 also inquires of the NAT-GW apparatus 113 about the TCP port number to be connected by tunneling communication (S811). The NAT-GW apparatus 113 establishes an unused TCP port “5081”, and returns the established port number “5081” to the external terminal apparatus 103 as the inquiry source (S812). The external terminal apparatus 103 that has received the port number establishes a communication TCP connection (Connection 2) for the port number “5081” (S813). When the communication TCP connection (Connection 2) between the external terminal device 103 and the NAT-GW device 113 is established, the destination address, port number, and TCP connection pair are registered in the packet relay table 40.

Next, the tunneling ring communication path establishment operation 702 will be described with reference to FIGS. FIG. 9 shows an operation when communication is started from the external terminal device 103, and FIG. 10 shows an operation when communication is started from the internal terminal device 13.
In FIG. 9, first, the external terminal device 103 sets the IP address and port number of the external terminal device as the source of the INVITE request (SIP session establishment request), and sets the IP address and port number of the SIP server as the destination. The tunneling packet is transmitted to the NAT-GW apparatus 113 (S901).

  The NAT-GW apparatus 113 that has received the tunneling packet recognizes the IP address and port number set as the destination, and relays the packet to the tunneling communication termination apparatus 14 (S902). The tunneling communication terminator 14 that has received the tunneling packet converts the tunneling packet into a normal packet, and changes the IP address and port number of the external terminal device 103 in the SIP message to the IP address and port number of the tunneling communication terminator 14. The packet is rewritten and transferred to the SIP server 15 set as the destination (S903). The SIP server 15 that has received the INVITE request transmits the INVITE request to the internal terminal device 13 from the SIP-URI set as the destination of the SIP message (S904). In addition, when receiving the INVITE request, the SIP server 15 returns 100 TRYING, which means that the SIP session establishment process is continued, to the tunneling communication terminating device 14 (S905). This 100 TRYING is transmitted to the external terminal apparatus 103 via the NAT-GW apparatus 113 (S906, 907).

The internal terminal device 13 that has received the INVITE request transmits a 180 RINGING response (during SIP session establishment processing) and a 200 OK (SIP session establishment permission) response to the SIP server 15 (S911, S921).
The SIP server 15 transmits the received 180RINGING response to the external terminal device 103 via the tunneling communication termination device 14 and the NAT-GW device 113 by tracing the INVITE request transmission path in reverse (S912 to S914).

  Similarly, the SIP server 15 that has received the 200OK response transmits a response packet to the tunneling communication termination device 14 (S922). The tunneling communication termination device 14 that has received the response packet of the 200 OK response acquires the IP address and port number of the internal terminal device 13 from the packet, and the IP address of the external terminal device 103 acquired from the previous INVITE request, The port number, the port number established for the media transfer by the tunneling communication termination device, the IP address of the internal terminal device 13 acquired from the 200 OK response, and the port number are associated with each other and registered in the packet transfer table 60. Then, the 200OK response is converted into a tunneling packet in which the IP address and port number of the internal terminal device 13 are set as the transmission source and the IP address and port number of the external terminal device 103 are set as the destination, and the NAT-GW device 113 is converted. (S923). The NAT-GW apparatus 113 that has received the 200 OK response converted into the tunneling packet transmits the packet to the external terminal apparatus 103 that is the destination (S924). As a result, TCP connection 3 and TCP connection 4 are established (S931, 932). Then, an ACK response is transmitted from the external terminal device 103 to the internal terminal device 13 via the same route (including the previous connections 1 and 2) (S941 to 944).

FIG. 10 shows an operation when communication is started from the internal terminal device 13.
This operation is the reverse of the procedure shown in FIG. 9, but the basic operation principle is the same as the operation of FIG. The operation procedure will be easily understood from the operation procedure of FIG.

  Next, a transmission / reception operation 703 of a packet such as media data will be described with reference to FIGS. Here, FIG. 13 shows a packet transmission procedure from the external terminal device 103 to the internal terminal device 13, and FIG. 14 shows a packet transmission procedure from the internal terminal device 13 to the external terminal device 103.

In FIG. 13, the external terminal device 103 first sets the IP address and port number of the external terminal device 103 as the transmission source, and sets the IP address and port number of the internal terminal device (eg 131) as the destination. Is generated (S1300), and the tunneling packet is transmitted to the NAT-GW apparatus 113 (S1301).
When receiving the tunneling packet transmitted from the external terminal device 103 (1302), the NAT-GW device 113 acquires the corresponding TCP connection from the packet relay table 40 from the destination IP address and port number of the tunneling packet (S1303). Then, it is determined whether or not the destination to be relayed is registered in the relay table 40 (S1304). As a result, if the destination to be relayed is not registered in the relay table 40, the packet is discarded and the next reception is awaited (S1304). On the other hand, if the destination is already registered, the tunneling packet is relayed to the tunneling communication terminator 14 through the corresponding TCP connection (S1305).

  When the tunneling communication termination device 14 receives the tunneling packet transmitted from the NAT-GW device 113 (S1306), the tunneling communication termination device 14 obtains transmission data, a destination IP address, and a port number from the tunneling packet (S1307). With reference to it, it is determined whether there is registration information that matches the IP address and port number of the internal terminal device 131 (S1309). As a result, if there is no matching registration information, the packet is discarded and the next reception is awaited. On the other hand, if there is matching information, the tunneling packet is converted into a normal packet, and the packet is transmitted to the corresponding internal terminal device 131 (S1309).

Next, with reference to FIG. 14, an operation for transmitting a packet from the internal terminal device 13 to the external terminal device 103 will be described.
For example, the internal terminal device 132 transmits a data packet such as media data to the IP address and port number of the tunneling communication termination device 14 acquired from the INVITE request in FIG. 10 (S1400). When the tunneling communication terminator 14 receives the data packet transmitted from the internal terminal device 132 (S1401), the external terminal registered corresponding to the IP address and port number of the transmission source after referring to the packet forwarding table 60 The IP address and port number of the device 103 are acquired, a tunneling packet is generated (S1402), and the tunneling packet is transmitted to the NAT-GW device 113 (S1404).
As a result of searching the packet transfer table 60, if there is no address information related to the corresponding external terminal device 103, the tunneling packet is discarded and the next reception is awaited (S1403).

When receiving the tunneling packet from the tunneling communication termination device 14 (S1405), the NAT-GW device 113 acquires the destination IP address and port number of the tunneling packet (S1406), and stores the IP address of the external terminal device 103 in the packet relay table 40. It is determined whether or not the port number is registered (S1407). If the IP address or the like is registered as a result of the determination, a tunneling packet is transmitted to the external terminal device 103 via the corresponding TCP connection (S1409). On the other hand, if it is not registered, the packet is discarded and the next reception is awaited.
The external terminal device 103 receives the tunneling packet transmitted from the NAT-GW device 113, and acquires the data transmitted by the internal terminal device 132 from the tunneling packet (S1409).

Next, the operation 704 for cutting the communication path between the external terminal device and the internal terminal device will be described with reference to FIGS.
FIG. 11 shows a case of disconnecting from the internal terminal device, and FIG. 12 shows a case of disconnecting from the external terminal device 103.
When the communication is disconnected from the internal terminal device 13, a BYE request (SIP session end request) is transmitted from the internal terminal device 13 to the SIP server 14 as shown in FIG. 11 (S1101). The SIP server 14 transmits the received BYE request to the external terminal device 103 through the established communication path (S1102 to S1104).
The external terminal apparatus 103 that has received the BYE request returns a 200 OK (SIP session normal termination) response to the NAT-GW apparatus 113, the tunneling communication termination apparatus 15, and the SIP server 14 through the communication path (S1201 to S1203).

Here, when the tunneling communication terminating device 15 receives 200 OK (SIP session normal end), it transmits a 200 OK (SIP session normal end) response to the SIP server 14 and then the external terminal device registered in the packet forwarding table 60. The IP address and port number of 103, the port number of the tunneling communication terminator 14, and the IP address and port number of the internal terminal device 13 are deleted. Then, the media data transfer TCP connection to the internal terminal device 13 is disconnected, the port opened for the transfer is closed, and the disconnection of the communication path is ended.
The operation of disconnecting from the external terminal device 103 shown in FIG. 12 is opposite to that in FIG. 11, but the substantial principle is the same, so the description thereof is omitted.

  As described above, according to the present embodiment, the NAT-GW apparatus 113 associates the IP address, port number, and TCP connection of the external terminal apparatus 103 with each other and registers them in the relay table 40, thereby allowing one TCP. A plurality of types (corresponding to a plurality of ports) of data communication can be processed at the port. That is, unlike the conventional firewall 112, it is not necessary to open as many ports as necessary, and one TCP port is established by adding transmission source and destination information to the tunneling packet. Thus, a plurality of terminal devices can communicate with each other by a plurality of connections. Since it can be realized with only one TCP port, it contributes to the reduction of the number of open ports.

The figure which shows the structural example of the network communication system in one Embodiment. The figure which shows the structure of the external terminal device 103 in one Embodiment. The figure which shows the structure of the NAT-GW apparatus 113 in one Embodiment. The figure which shows the structure of the packet relay table 40 in one Embodiment. The figure which shows the structure of the tunneling communication termination | terminus apparatus 14 in one Embodiment. The figure which shows the structure of the packet transfer table 60 in one Embodiment. The sequence diagram which shows the tunneling communication path establishment procedure in one Embodiment. The sequence diagram which shows the procedure of the TCP connection establishment which performs the tunneling communication in one Embodiment. The sequence diagram which shows the procedure of the tunneling communication path establishment in one Embodiment. The sequence diagram which shows the procedure of the tunneling communication path establishment in one Embodiment. The sequence diagram which shows the procedure which cut | disconnects the tunneling communication in one Embodiment from an internal terminal device. The sequence diagram which shows the procedure which cut | disconnects the tunneling communication in one Embodiment from an external terminal device. The figure which shows the flow of a process when transmitting a packet from an external terminal device to an internal terminal device in the tunneling communication in one Embodiment. The figure which shows the flow of a process when transmitting a packet from an internal terminal device to an external terminal device in the tunneling communication in one Embodiment.

Explanation of symbols

10: external segment, 11: DMZ segment, 12: internal segment, 102, 103: external terminal device, 113: NAT-GW device, 13, 131, 132, internal terminal device, 14: tunneling communication terminator, 15: SIP server 112: Firewall 201: SIP application 202: SIP unit 203: Media unit 204: Packet conversion unit 205: Tunneling packet transmission unit 206: Socket unit 301: Tunneling communication control unit 302: Tunneling Packet relay part,
400: Packet relay table, 501: SIP analysis unit, 502: Packet conversion unit, 503: Tunneling packet transfer unit, 504: Socket unit, 505: Packet routing control unit, 506: Packet transfer unit, 600: Packet transfer table

Claims (5)

An external terminal device belonging to an external segment having an address system for data communication, and a tunneling communication terminating device and an internal terminal device for terminating tunneling communication belonging to an internal segment having an address system different from the external segment are connected to the NAT- A SIP session is established using a SIP packet for establishing a Session Initiation Protocol (SIP) session between the external terminal device and the internal terminal device by connecting via a GW device, and the external terminal device A communication method for performing tunneling communication with the internal terminal device,
The NAT-GW apparatus establishes a first TCP connection between the NAT-GW apparatus and the tunneling communication termination apparatus using an unused TCP port , and uses an unused TCP port. Establishing a second TCP connection between the external terminal device and the NAT-GW device;
The NAT-GW apparatus adds a tunnel address to a normal packet including the destination IP address and port number transmitted from the external terminal apparatus via the second TCP connection and the first TCP connection. Receiving a tunneling packet to which a tunnel packet header is added, and transmitting the tunneling packet to the tunneling communication terminating device;
The tunneling communication termination device converts the received tunneling packet into a normal packet, and the normal packet is transmitted to the internal terminal device of the destination IP address,
The tunneling communication terminator further obtains the IP address and port number of the internal terminal device to establish a SIP session,
And, the acquired IP address and port number of the external terminal device and the acquired IP address and port number of the internal terminal device are held in association with each other,
The tunneling communication termination device generates a tunneling packet in which the IP address and port number of the internal terminal device are set as a transmission source and the IP address and port number of the external terminal device are set as a destination, and the NAT-GW To the device,
The NAT-GW device transmits the IP address and the port number included in the tunneling packet acquired is transmitted from the tunneling communication terminating device to the external terminal, and said external terminal and said NAT-GW Establishing a third TCP connection with the device, and establishing a fourth TCP connection between the NAT-GW device and the tunneling communication terminator,
A communication method comprising performing tunneling communication between the external terminal device, the NAT-GW device, and the tunneling device using the established third TCP connection and the fourth TCP connection . The tunneling communication terminator and the external terminal device inquire about the TCP port number connected to the NAT-GW device, establish a connection to the TCP port returned from the NAT-GW device, and establish an established TCP connection. The communication method according to claim 1, wherein tunneling communication is performed using the communication method. The tunnel-communication is permitted only between the destinations established by the SIP session for the combination of the destination IP address and the port number that permit the packet relay in the NAT-GW device and the packet forwarding in the tunneling communication termination device. The communication method according to claim 1 or 2. 4. The communication method according to claim 1, wherein tunneling communication is performed without depending on an application layer protocol of a packet transmitted and received between the external terminal device and the internal terminal device. An external terminal device belonging to an external segment having an address system for data communication, and a tunneling communication terminating device and an internal terminal device for terminating tunneling communication belonging to an internal segment having an address system different from the external segment are connected to the NAT- A SIP session is established using a SIP packet for establishing a Session Initiation Protocol (SIP) session between the external terminal device and the internal terminal device by connecting via a GW device, and the external terminal device A network communication system for performing tunneling communication with the internal terminal device,
The NAT-GW apparatus establishes a first TCP connection between the NAT-GW apparatus and the tunneling communication termination apparatus using an unused TCP port , and uses an unused TCP port. Establishing a second TCP connection between the external terminal device and the NAT-GW device;
The NAT-GW apparatus adds a tunnel address to a normal packet including the destination IP address and port number transmitted from the external terminal apparatus via the second TCP connection and the first TCP connection. Receiving a tunneling packet to which a tunnel packet header is added, and transmitting the tunneling packet to the tunneling communication terminating device;
The tunneling communication termination device converts the received tunneling packet into a normal packet, and the normal packet is transmitted to the internal terminal device of the destination IP address,
The tunneling communication terminator further obtains the IP address and port number of the internal terminal device to establish a SIP session,
And, the acquired IP address and port number of the external terminal device and the acquired IP address and port number of the internal terminal device are held in association with each other,
The tunneling communication termination device generates a tunneling packet in which the IP address and port number of the internal terminal device are set as a transmission source and the IP address and port number of the external terminal device are set as a destination, and the NAT-GW To the device,
The NAT-GW device transmits the IP address and the port number included in the tunneling packet acquired is transmitted from the tunneling communication terminating device to the external terminal, and said external terminal and said NAT-GW Establishing a third TCP connection with the device, and establishing a fourth TCP connection between the NAT-GW device and the tunneling communication terminator,
A network communication system characterized by performing tunneling communication between the external terminal device, the NAT-GW device, and the tunneling device using the established third TCP connection and the fourth TCP connection .

Images