This application provides a communication connection establishing method and apparatus. A first terminal in a first local area network obtains a specified address and a public network address of the second terminal, and sends the public network address of the second terminal to an address conversion device; the address conversion device receives a packet that is sent by a terminal outside the first local area network to the specified address, wherein the packet carries a verification address, and the verification address is an address of a packet sender, and the address conversion device uses that the verification address is the same as an address of the second terminal as one of conditions for establishing communication connection between the first terminal and the second terminal, because the second terminal is a terminal to be connected by the first terminal. In view of the above, only when the packet sender is a terminal to be connected by the first terminal, can the packet sender establish communication connection with the first terminal, thereby preventing all internal network terminals from being open to an outer network. Therefore, communication connection between an outer network device and an internal network may be established without reducing internal network security.