Routing network traffic using router-terminated virtual private network (VPN) client sessions

Patent metadata

Field	Value
Publication number	US-12470521-B2
Application number	US-202017075394-A
Country	US
Kind code	B2
Filing date	Oct 20, 2020
Priority date	Oct 20, 2020
Publication date	Nov 11, 2025
Grant date	Nov 11, 2025

Abstract

Routing network traffic using router-terminated virtual private network (VPN) client sessions is disclosed herein. In one embodiment, a router computing device receives an indication of an association between a client computing device and VPN configuration data for a VPN, the indication comprising an identifier of the client computing device and the VPN configuration data. The router computing device binds a VPN client session instantiated by the router computing device to a network interface and implements a firewall rule to route network traffic to and from the client computing device via the network interface. The router computing device establishes a connection with the VPN using the VPN client session and the VPN configuration data. Finally, the router computing device receives network traffic for the client computing device and routes the network traffic via the network interface.

First claim

What is claimed is:

1 . A method, comprising:
receiving, by a router computing device, an indication of an association between a client computing device and virtual private network (VPN) configuration data for a VPN, the indication comprising an identifier of the client computing device and the VPN configuration data; binding, by the router computing device, a VPN client session instantiated by the router computing device to a network interface; implementing, by the router computing device, a firewall rule to route network traffic to and from the client computing device via the network interface; establishing, by the router computing device, a connection with the VPN using the VPN client session and the VPN configuration data; receiving, by the router computing device, network traffic for the client computing device; and routing, by the router computing device, the network traffic via the network interface.

2 . The method of claim 1 , further comprising:
obtaining, by a server computing device, the VPN configuration data; associating, by the server computing device, the client computing device with the VPN configuration data; and transmitting, by the server computing device, the indication of the association between the client computing device and the VPN configuration data to the router computing device.

3 . The method of claim 2 , wherein obtaining the VPN configuration data comprises retrieving, by the server computing device, the VPN configuration data from a VPN configuration database.

4 . The method of claim 2 , wherein obtaining the VPN configuration data comprises receiving, by the server computing device, a first user input from a user, the first user input comprising the VPN configuration data.

5 . The method of claim 2 , wherein associating the client computing device with the VPN configuration data comprises receiving, by the server computing device, a second user input from a user indicating the association of the client computing device with the VPN configuration data.

6 . The method of claim 2 , wherein:
associating the client computing device with the VPN configuration data comprises:
defining, by the server computing device, a client computing device group comprising a plurality of client computing devices including the client computing device; and
associating the client computing device group with the VPN configuration data;
the indication of the association between the client computing device and the VPN configuration data comprises an indication of an association between the client computing device group and the VPN configuration data; binding the VPN client session for the client computing device to the network interface comprises binding a VPN client session for the client computing device group to the network interface; and implementing the firewall rule comprises implementing a firewall rule to route network traffic to and from the plurality of client computing devices via the network interface.

7 . The method of claim 6 , wherein defining the client computing device group comprises automatically defining the client computing device group based on one or more common attributes of the plurality of client computing devices.

8 . The method of claim 6 , wherein defining the client computing device group comprises:
receiving, by the server computing device, a third user input identifying the plurality of client computing devices as members of the client computing device group; and defining the client computing device group based on the third user input.

9 . The method of claim 1 , wherein implementing the firewall rule to route the network traffic to and from the client computing device via the network interface comprises defining a firewall rule specified using one of OpenFlow and iptables.

10 . The method of claim 1 , wherein:
the network traffic comprises outbound network traffic from the client computing device and inbound network traffic from the VPN directed to the client computing device; and routing the network traffic via the network interface comprises:
routing the outbound network traffic to the VPN; and
routing the inbound network traffic to the client computing device.

11 . The method of claim 1 wherein the router computing device receives the indication from a server computing device.

12 . A router computing device, comprising:
a system memory; and a processor device communicatively coupled to the system memory and configured to:
receive an indication of an association between a client computing device and virtual private network (VPN) configuration data for a VPN, the indication comprising an identifier of the client computing device and the VPN configuration data;
bind a VPN client session instantiated by the router computing device to a network interface;
implement a firewall rule to route network traffic to and from the client computing device via the network interface;
establish a connection with the VPN using the VPN client session and the VPN configuration data;
receive network traffic for the client computing device; and
route the network traffic via the network interface.

13 . The router computing device of claim 12 , wherein:
the indication of the association between the client computing device and the VPN configuration data comprises an indication of an association between a client computing device group, comprising a plurality of client computing devices including the client computing device, and the VPN configuration data; the processor device is configured to bind the VPN client session for the client computing device to the network interface by being configured to bind a VPN client session for the client computing device group to the network interface; and the processor device is configured to implement the firewall rule by being configured to implement a firewall rule to route network traffic to and from the plurality of client computing devices via the network interface.

14 . The router computing device of claim 12 , wherein:
the network traffic comprises outbound network traffic from the client computing device and inbound network traffic from the VPN directed to the client computing device; and routing the network traffic via the network interface comprises:
routing the outbound network traffic to the VPN; and
routing the inbound network traffic to the client computing device.

15 . A server computing device, comprising:
a system memory; and a processor device communicatively coupled to the system memory and configured to:
obtain virtual private network (VPN) configuration data for a VPN;
associate a client computing device with the VPN configuration data; and
transmit an indication of an association between the client computing device and the VPN configuration data to a router computing device, the indication comprising an identifier of the client computing device and the VPN configuration data.

16 . The server computing device of claim 15 , wherein the processor device is configured to obtain the VPN configuration data by being configured to retrieve the VPN configuration data from a VPN configuration database.

17 . The server computing device of claim 15 , wherein the processor device is configured to obtain the VPN configuration data by being configured to receive the VPN configuration data from a user.

18 . The server computing device of claim 15 , wherein the processor device is configured to associate the client computing device with the VPN configuration data by being configured to receive a second

Assignees

• Charter Communications Operating Llc

Inventors

• Wright Ethan
• Schmidt Wystan
• Labbee Micah

Classifications

• H04L63/0263

  Rule management · CPC title

• H04L63/0272 Primary

  Virtual private networks · CPC title