Application services based on dynamic split tunneling

• US 9,455,909 B2
• Filed: 09/01/2015
• Issued: 09/27/2016
• Est. Priority Date: 05/16/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Champagne, Timothy Steven Jr., Parla, Vincent E., Santau, Vlad, Munz, Kerry Hannigan
• Primary Examiner(s): LEE, JASON T
• Application Number:
  US14/841,919
• Publication Number:
  US 20150372912A1
• Time in Patent Office: 392 Days
• Field of Search: 726/15
• US Class Current: 1/1
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

One embodiment provides selectively routing Domain Name System (DNS) request for sub-domains associated with a first network through a tunnel associated with the first network via the interface. DNS requests for sub-domains associated with a second network are selectively routed through a tunnel associated with the second network via the interface. Embodiments include replacing the destination address for DNS requests for sub-domains associated with the second network to match an address of a DNS server associated with the second network. Data representative of DNS requests for sub-domains associated with the second network is stored. Embodiments forward the DNS requests for sub-domains associated with the second network with the address of the DNS server associated with the second network.

Claims

1. An apparatus, comprising:

an interface;

a virtual private network (VPN) client coupled with the interface, wherein;

the VPN client selectively routes Domain Name System (DNS) requests for sub-domains associated with a first network through a tunnel associated with the first network via the interface;

the VPN client selectively routes DNS requests for sub-domains associated with a second network through a tunnel associated with the second network via the interface;

the VPN client replaces a destination address for DNS requests for sub-domains associated with the second network to match an address of a DNS server associated with the second network;

the VPN client stores data representative of DNS requests for sub-domains associated with the second network; and

the VPN client forwards the DNS requests for sub-domains associated with the second network with the address of the DNS server associated with the second network.

2. The apparatus set forth in claim 1, wherein the VPN client matches DNS responses received from the second network with stored DNS request employing the stored data representative of DNS requests;

the VPN client replaces the source address of the DNS responses with the destination addresses of the DNS requests; and

the VPN client forwards the DNS responses with destination addresses of the DNS requests.

3. The apparatus set forth in claim 1, wherein the VPN client associates service Internet Protocol (IP) addresses for sub-domains associated with the first and second networks to dummy service IP addresses;

and

the VPN client replaces the service IP addresses in DNS responses for sub-domains associated with the first and second networks with dummy service IP addresses in and provides the DNS responses with the dummy service IP addresses.

4. The apparatus set forth in claim 3, wherein the VPN client is responsive to receiving a packet having a dummy service IP address associated with the first network as the destination address to replace the dummy service IP address with an appropriate service IP address;

and

forward the packet with the appropriate IP address to the first network through the first tunnel via the interface.

5. The apparatus set forth in claim 3, wherein the VPN client is responsive to receiving a packet having a source address via the first tunnel from the first network to replace the source address with the appropriate dummy service IP address;

and

the VPN client forwards the packet with the appropriate dummy service IP address.

6. The apparatus set forth in claim 3, wherein the VPN client is responsive to receiving a packet having a dummy service IP address associated with the second network as the destination address to replace the dummy service IP address with an appropriate service IP address;

and

forward the packet with the appropriate IP address to the second network through the second tunnel.

7. The apparatus set forth in claim 3, wherein the VPN client is responsive to receiving a packet having a source address via the second tunnel from the second network to replace the source address with the appropriate dummy service IP address;

and

the VPN client forwards the packet with the appropriate dummy service IP address.

8. The apparatus set forth in claim 3, wherein the dummy service IP addresses allocated for service IP addresses associated with the first network and service IP associated with the second network are contiguous.

9. A method, comprising:

selectively routing Domain Name System (DNS) requests for sub-domains associated with a first network through a tunnel associated with the first network via the interface;

selectively routing DNS requests for sub-domains associated with a second network through a tunnel associated with the second network via the interface;

replacing a destination address for DNS requests for sub-domains associated with the second network to match an address of a DNS server associated with the second network;

storing data representative of DNS requests for sub-domains associated with the second network; and

forwarding the DNS requests for sub-domains associated with the second network with the address of the DNS server associated with the second network.

10. The method set forth in claim 9, further comprising:

matching DNS responses received from the second network with stored DNS request employing the stored data representative of DNS requests;

replacing the source address of the DNS responses with destination addresses of the DNS requests; and

forwarding the DNS responses with the destination addresses of the DNS requests.

11. The method set forth in claim 9, further comprising:

associating service Internet Protocol (IP) addresses for sub-domains associated with the first and second networks to dummy service IP addresses; and

replacing the service IP addresses in DNS responses for sub-domains associated with the first and second networks with dummy service IP addresses in and provides the DNS responses with the dummy service IP addresses.

12. The method set forth in claim 11, further comprising:

responsive to receiving a packet having a dummy service IP address associated with the first network as the destination address, replacing the dummy service IP address with an appropriate service IP address; and

forwarding the packet with the appropriate IP address to the first network through the first tunnel via the interface.

13. The method set forth in claim 11, further comprising:

responsive to receiving a packet having a source address via the first tunnel from the first network, replacing the source address with the appropriate dummy service IP address; and

forwarding the packet with the appropriate dummy service IP address.

14. The method set forth in claim 11, further comprising:

responsive to receiving a packet having a dummy service IP address associated with the second network as the destination address, replacing the dummy service IP address with an appropriate service IP address; and

forwarding the packet with the appropriate IP address to the second network through the second tunnel.

15. The method set forth in claim 11, further comprising:

responsive to receiving a packet having a source address via the second tunnel from the second network, replacing the source address with the appropriate dummy service IP address; and

forwarding the packet with the appropriate dummy service IP address.

16. The method set forth in claim 11, wherein the dummy service IP addresses allocated for service IP addresses associated with the first network and service IP associated with the second network are contiguous.

17. A non-transitory computer-readable medium storing computer program code that, when executed, performs an operation, comprising:

selectively routing Domain Name System (DNS) requests for sub-domains associated with a first network through a tunnel associated with the first network via the interface;

selectively routing DNS requests for sub-domains associated with a second network through a tunnel associated with the second network via the interface;

replacing a destination address for DNS requests for sub-domains associated with the second network to match an address of a DNS server associated with the second network;

storing data representative of DNS requests for sub-domains associated with the second network; and

forwarding the DNS requests for sub-domains associated with the second network with the address of the DNS server associated with the second network.

18. The non-transitory computer-readable medium set forth in claim 17, the operation further comprising:

matching DNS responses received from the second network with stored DNS request employing the stored data representative of DNS requests;

replacing the source address of the DNS responses with destination addresses of the DNS requests; and

forwarding the DNS responses with the destination addresses of the DNS requests.

19. The non-transitory computer-readable medium set forth in claim 17, the operation further comprising:

associating service Internet Protocol (IP) addresses for sub-domains associated with the first and second networks to dummy service IP addresses; and

replacing the service IP addresses in DNS responses for sub-domains associated with the first and second networks with dummy service IP addresses in and provides the DNS responses with the dummy service IP addresses.

20. The non-transitory computer-readable medium set forth in claim 19, the operation further comprising:

responsive to receiving a packet having a dummy service IP address associated with the first network as the destination address, replacing the dummy service IP address with an appropriate service IP address; and

forwarding the packet with the appropriate IP address to the first network through the first tunnel via the interface.