A METHOD AND SYSTEMS FOR ROUTING PACKETS FROM A GATEWAY TO AN ENDPOINT

• US 20060029063A1
• Filed: 07/22/2005
• Published: 02/09/2006
• Est. Priority Date: 07/23/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Rao, Goutham P., Brueggemann, Eric R., Rodriguez, Robert A.
• Granted Patent: US 8,363,650 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2898 Subscriber equipments DSL modems H04M11/062; cable modems H04L12/2801
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/72 Routing based on the source address
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2557 Translation policies or rules
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for routing packets from a gateway to an endpoint includes the step of associating a private internet protocol (IP) address with an endpoint having a public IP address. A packet addressed to the private IP address of the endpoint is captured. A policy is applied to the packet. The packet is transmitted to the public IP address of the endpoint, responsive to the application of the policy to the packet.

Claims

1. A method for routing packets from a gateway to an endpoint, the method comprising:

(a) associating a private internet protocol (IP) address with an endpoint having a public IP address;

(b) capturing a packet addressed to the private IP address of the endpoint;

(c) applying a policy to the packet; and

(d) transmitting the packet to the public IP address of the endpoint, responsive to the application of the policy to the packet.

2. The method of claim 1, wherein step (b) further comprises capturing, by a driver on the gateway, a packet addressed to the private IP address of the endpoint.

3. The method of claim 2, wherein the driver complies with the Network Driver Interface Specification (NDIS).

4. The method of claim 1, wherein step (b) further comprises capturing all Ethernet traffic addressed to the endpoint.

5. The method of claim 1, wherein step (b) further comprises capturing a packet addressed to the private IP address of the endpoint prior to routing the packet to the endpoint.

6. The method of claim 1, wherein step (c) further comprises applying a policy to the packet prior to routing the packet to the endpoint.

7. The method of claim 1, wherein step (c) further comprises applying an access control list to the packet.

8. The method of claim 1, wherein step (d) further comprises performing a network address translation to transform the private IP address of the endpoint to the public IP address of the endpoint.

9. A device for routing packets from a gateway to an endpoint, the device comprising:

an addressing element associating a private IP address with an endpoint having a public IP address;

a receiver in communication with the addressing element intercepting a packet destined for the private IP address of the endpoint;

a policy engine in communication with the receiver receiving the packet and transmitting the packet to the endpoint responsive to a policy applied to the packet; and

a transmitter in communication with the receiver, the policy engine, and the addressing element performing a network address translation on the packet and transmitting the packet to an endpoint.

10. The device of claim 9, wherein the receiver comprises a driver.

11. The device of claim 9, wherein the receiver comprises a driver in compliance with a Network Driver Interface Specification (NDIS).

12. The device of claim 9, wherein the receiver intercepts Ethernet traffic addressed to the endpoint.

13. The device of claim 9, wherein the receiver forwards the intercepted packet to the policy engine.

14. The device of claim 9, wherein the receiver is a process.

15. The device of claim 14, wherein the receiver process executes in kernel mode.

16. The device of claim 9, wherein the policy engine is a process.

17. The device of claim 16, wherein the policy engine process executes in user mode.

18. The device of claim 9, wherein the policy engine applies an access control list to the packet.

19. The device of claim 9, wherein the transmitter further comprises transforming a private internet protocol (IP) address of the packet to the public IP address associated with the endpoint.

20. The device of claim 9, wherein the transmitter transmits the packet to an endpoint over a secure sockets layer (SSL) tunnel.

21. The device of claim 9, wherein the transmitter is a process.

22. The device of claim 21, wherein the transmitter process executes in kernel mode.

23. A system for routing packets from a gateway to an endpoint, the system comprising:

a gateway comprising a kernel and an application space; and

a device, in communication with the gateway, comprising;

an addressing element associating a private IP address with an endpoint having a public IP address;

a receiver in communication with the addressing element intercepting a packet addressed to the private IP address of the endpoint;

a policy engine in communication with the receiver receiving the packet and transmitting the packet responsive to a policy applied to the packet; and

a transmitter in communication with the receiver, the policy engine, and the addressing element performing a network address translation on the packet and transmitting the packet to the endpoint.

24. The system of claim 23, wherein the receiver comprises a driver.

25. The system of claim 23, wherein the receiver comprises a driver in compliance with a Network Driver Interface Specification (NDIS).

26. The system of claim 23, wherein the receiver intercepts Ethernet traffic addressed to the endpoint.

27. The system of claim 23, wherein the receiver forwards the intercepted packet to the policy engine.

28. The system of claim 23, wherein the receiver is a process.

29. The system of claim 28, wherein the receiver process executes in kernel mode.

30. The system of claim 23, wherein the policy engine is a process.

31. The system of claim 30, wherein the policy engine process executes in user mode.

32. The system of claim 23, wherein the policy engine applies an access control list to the packet.

33. The system of claim 23, wherein the transmitter further comprises transforming a private internet protocol (IP) address of the packet to the public IP address associated with the endpoint.

34. The system of claim 23, wherein the transmitter transmits the packet to an endpoint over a secure sockets layer (SSL) tunnel.

35. The system of claim 23, wherein the transmitter is a process.

36. The system of claim 35, wherein the transmitter process executes in kernel mode.