Multiple network interface DNS query routing

Patent metadata

Field	Value
Publication number	US-12088549-B2
Application number	US-202318164579-A
Country	US
Kind code	B2
Filing date	Feb 4, 2023
Priority date	Feb 5, 2022
Publication date	Sep 10, 2024
Grant date	Sep 10, 2024

Abstract

A method may include obtaining Domain Name System (DNS) configuration policies, that indicate how to direct a DNS query based on various Internet Protocol (IP) addresses or Fully Qualified Domain Names (FQDNs). The method may include obtaining a DNS query request on a first interface adapter in which the DNS query request is obtained from a DNS client and directed toward a particular FQDN. The method may include determining whether the particular FQDN included with the DNS query request is included in the DNS configuration policies and directing the DNS query request to an alternative DNS destination responsive to determining that the particular FQDN is not included in the DNS configuration policies. The method may include generating, at the alternative DNS destination, a DNS response that includes an error code, injecting the DNS response into a Transport Control Protocol (TCP)/IP stack, and sending the DNS response to the DNS client.

First claim

What is claimed is:

1. A method of split domain name server (DNS) tunnelling in a multi-network interface client system, the method comprising:
intercepting a DNS query request from an operating system (OS) component, wherein the DNS query request originates at a DNS client, the DNS query request is directed to a fully qualified domain name (FQDN), and includes a first remote internet protocol (IP) address of a first network interface of a client system;
parsing the DNS query request to identify the FQDN and the first remote IP address;
comparing the identified FQDN to a list of multiple FQDNs designated for either inclusion in a virtual private network (VPN) tunnelling operation or excluded from a VPN tunnelling operation;
responsive to the identified FQDN being included in the list of multiple FQDN, determining whether the first remote IP address matches a preferred remote IP address for the identified FQDN;
responsive to the first remote IP address not matching the preferred remote IP address for the identified FQDN, generating a modified DNS query request in which the first remote IP address is changed to an IP address of an alternative DNS destination;
generating, at the alternative DNS destination, a DNS error response, wherein the DNS error response includes an error code and the first remote IP address of the DNS query request;
communicating the DNS error response to the OS component;
intercepting the DNS error response from the OS component;
determining whether the intercepted DNS error response originated at the alternative DNS destination; and
responsive to the intercepted DNS error response originating at the alternative DNS destination, reinjecting the intercepted DNS error response to the OS component such that the DNS error response is communicated to the DNS client and such that the DNS client generates a subsequent DNS query request directed to the FQDN and including a second remote IP address of a second network interface of the client system.

2. The method of claim 1 , further comprising:
intercepting the subsequent DNS query request from the OS component;
parsing the subsequent DNS query request to identify the FQDN and the second remote IP address;
comparing the identified FQDN to the list of multiple FQDNs designated for either inclusion in the VPN tunnelling operation or excluded from the VPN tunnelling operation;
responsive to the identified FQDN being included in the list of multiple FQDNs, determining whether the second remote IP address matches the preferred remote IP address for the identified FQDN; and
responsive to the second remote IP address matching the preferred remote IP address for the identified FQDN, communicating the subsequent DNS query request to the second remote IP address.

3. The method of claim 1 , further comprising communicating the DNS query request to a default IP address of a default DNS server responsive to the identified FQDN not being included in the list of multiple FQDN.

4. The method of claim 3 , further comprising pushing a configuration policy from a policy configurator responsive to connection of the client system to a network, wherein the configuration policy includes the list of multiple FQDNs designated for either inclusion in the VPN tunnelling operation or excluded from the VPN tunnelling operation, a list of preferred remote IP addresses, a mapping between the multiple FQDNs and preferred remote IP addresses of the list of preferred remote IP addresses, and the default IP address.

5. The method of claim 4 , wherein:
the DNS client and the alternative DNS destination are located in a user mode of the client system;
the DNS query request is intercepted on a first portion of a kernel mode of the client system;
the configuration policy is stored on the first portion of the kernel mode;
the OS component is included a second portion of the kernel mode;
the DNS query request is parsed and compared to the configuration policy on the first portion of the kernel mode; and
the modified DNS query request is generated on the first portion of the kernel mode.

6. The method of claim 1 , further comprising:
responsive to the first remote IP address matching the preferred remote IP address for the identified FQDN, communicating the DNS query request to the first remote IP address.

7. The method of claim 1 , wherein:
the modified DNS query request further includes a transaction identifier; and
the transaction identifier is further included in the DNS error response.

8. The method of claim 1 , wherein:
the preferred remote IP address is the IP address of a preferred network interface;
the preferred network interface is a preferred VPN adapter;
the first network interface is a first VPN adapter; and
the second network interface is a second VPN adapter.

9. The method of claim 1 , wherein:
the error code is included as an answer in the DNS error response; and
the error code includes a format error indicator.

10. The method of claim 1 , wherein the alternative DNS destination is at least a portion of a local User Datagram Protocol (UDP) server.

11. A method of split DNS tunnelling, comprising:
obtaining a plurality of Domain Name System (DNS) configuration policies, each DNS configuration policy of the plurality of DNS configuration policies indicating how to direct a DNS query according to one or more Internet Protocol (IP) addresses or Fully Qualified Domain Names (FQDNs);
obtaining a DNS query request on a first network interface adapter, the DNS query request being obtained from a DNS client and directed toward a particular FQDN;
determining whether the particular FQDN included with the DNS query request is included in the FQDNs or IP addresses associated with the plurality of DNS configuration policies;
responsive to a determination that the particular FQDN is not included in the FQDNs or IP addresses associated with the plurality of DNS configuration policies, directing the DNS query request to an alternative DNS destination;
generating, at the alternative DNS destination, a DNS response that includes an error code;
injecting the DNS response into a Transport Control Protocol (TCP)/IP stack;
sending the DNS response to the DNS client from which the DNS query request was obtained; and
obtaining an updated DNS query request on a second network interface adapter from the DNS client responsive to the DNS client receiving the DNS response.

12. The method of claim 11 , wherein one or more DNS configuration policies of the plurality of DNS configuration policies include:
inclusion policies that specify one or more IP address or FQDNs to which the DNS query is allowed to be directed responsive to the DNS query matching the IP addresses or FQDNs specified in the inclusion policies;
exclusion policies that specify one or more IP address or FQDNs to which the DNS query is not allowed to be directed responsive to the DNS query matching the IP addresses or FQDNs specified in the exclusion policies; and
default policies that specify one or more IP address or FQDNs to which the DNS query is directed responsive to the DNS query not matching the IP addresses or FQDNs specified in the inclusion policies or the exclusion policies.

13. The method of claim 11 , wherein the DNS response further includes at least one of: a FQDN corresponding to the particular FQDN of the DNS query request, a local IP address associated with the first network interface adapter, and a remote IP address associated with a DNS server.

14. One or more non-transitory computer-readable medium having encoded therein programming code executable by one or more processors to perform

Assignees

• Ivanti Inc

Inventors

• Kalligudd Vagish
• Andiyappan Saravana Pandiyan

Classifications

• H04L12/4633 Primary

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• H04L2101/677

  Multiple interfaces, e.g. multihomed nodes · CPC title

• H04L61/4511 Primary

  using domain name system [DNS] · CPC title

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title