The invention provides a network management model of a network evidence acquisition device based on the UDT reverse penetration technology. The network evidence acquisition device obtains an IP address of an external network when a target terminal communicates with an external network to establish a UDT connection with a network management server, a remote management terminal establishes a connection with the network management server of the external network at the same time, therefore the network evidence acquisition device has a function of communicating with an external network device without the IP address of the external network, so that the management terminal can remotely manage the network evidence acquisition device without the IP address of the external network, that is to say, one machine can access one device without the IP address of the external network, and the function of remotely managing the present machine together with the network management server without the IP address of the external network, and the network management model has the potential application prospect of contacting with the external network if the network cards are insufficient or the IP is inconvenient to configure.