Application services based on dynamic split tunneling

Patent metadata

Field	Value
Publication number	US-9455909-B2
Application number	US-201514841919-A
Country	US
Kind code	B2
Filing date	Sep 1, 2015
Priority date	May 16, 2013
Publication date	Sep 27, 2016
Grant date	Sep 27, 2016

Abstract

One embodiment provides selectively routing Domain Name System (DNS) request for sub-domains associated with a first network through a tunnel associated with the first network via the interface. DNS requests for sub-domains associated with a second network are selectively routed through a tunnel associated with the second network via the interface. Embodiments include replacing the destination address for DNS requests for sub-domains associated with the second network to match an address of a DNS server associated with the second network. Data representative of DNS requests for sub-domains associated with the second network is stored. Embodiments forward the DNS requests for sub-domains associated with the second network with the address of the DNS server associated with the second network.

First claim

We claim:

1. An apparatus, comprising:
an interface;
a virtual private network (VPN) client coupled with the interface, wherein:
the VPN client selectively routes Domain Name System (DNS) requests for sub-domains associated with a first network through a tunnel associated with the first network via the interface;
the VPN client selectively routes DNS requests for sub-domains associated with a second network through a tunnel associated with the second network via the interface;
the VPN client replaces a destination address for DNS requests for sub-domains associated with the second network to match an address of a DNS server associated with the second network;
the VPN client stores data representative of DNS requests for sub-domains associated with the second network; and
the VPN client forwards the DNS requests for sub-domains associated with the second network with the address of the DNS server associated with the second network.

2. The apparatus set forth in claim 1 , wherein the VPN client matches DNS responses received from the second network with stored DNS request employing the stored data representative of DNS requests;
the VPN client replaces the source address of the DNS responses with the destination addresses of the DNS requests; and
the VPN client forwards the DNS responses with destination addresses of the DNS requests.

3. The apparatus set forth in claim 1 , wherein the VPN client associates service Internet Protocol (IP) addresses for sub-domains associated with the first and second networks to dummy service IP addresses; and
the VPN client replaces the service IP addresses in DNS responses for sub-domains associated with the first and second networks with dummy service IP addresses in and provides the DNS responses with the dummy service IP addresses.

4. The apparatus set forth in claim 3 , wherein the VPN client is responsive to receiving a packet having a dummy service IP address associated with the first network as the destination address to replace the dummy service IP address with an appropriate service IP address; and
forward the packet with the appropriate IP address to the first network through the first tunnel via the interface.

5. The apparatus set forth in claim 3 , wherein the VPN client is responsive to receiving a packet having a source address via the first tunnel from the first network to replace the source address with the appropriate dummy service IP address; and
the VPN client forwards the packet with the appropriate dummy service IP address.

6. The apparatus set forth in claim 3 , wherein the VPN client is responsive to receiving a packet having a dummy service IP address associated with the second network as the destination address to replace the dummy service IP address with an appropriate service IP address; and
forward the packet with the appropriate IP address to the second network through the second tunnel.

7. The apparatus set forth in claim 3 , wherein the VPN client is responsive to receiving a packet having a source address via the second tunnel from the second network to replace the source address with the appropriate dummy service IP address; and
the VPN client forwards the packet with the appropriate dummy service IP address.

8. The apparatus set forth in claim 3 , wherein the dummy service IP addresses allocated for service IP addresses associated with the first network and service IP associated with the second network are contiguous.

9. A method, comprising:
selectively routing Domain Name System (DNS) requests for sub-domains associated with a first network through a tunnel associated with the first network via the interface;
selectively routing DNS requests for sub-domains associated with a second network through a tunnel associated with the second network via the interface;
replacing a destination address for DNS requests for sub-domains associated with the second network to match an address of a DNS server associated with the second network;
storing data representative of DNS requests for sub-domains associated with the second network; and
forwarding the DNS requests for sub-domains associated with the second network with the address of the DNS server associated with the second network.

10. The method set forth in claim 9 , further comprising:
matching DNS responses received from the second network with stored DNS request employing the stored data representative of DNS requests;
replacing the source address of the DNS responses with destination addresses of the DNS requests; and
forwarding the DNS responses with the destination addresses of the DNS requests.

11. The method set forth in claim 9 , further comprising:
associating service Internet Protocol (IP) addresses for sub-domains associated with the first and second networks to dummy service IP addresses; and
replacing the service IP addresses in DNS responses for sub-domains associated with the first and second networks with dummy service IP addresses in and provides the DNS responses with the dummy service IP addresses.

12. The method set forth in claim 11 , further comprising:
responsive to receiving a packet having a dummy service IP address associated with the first network as the destination address, replacing the dummy service IP address with an appropriate service IP address; and
forwarding the packet with the appropriate IP address to the first network through the first tunnel via the interface.

13. The method set forth in claim 11 , further comprising:
responsive to receiving a packet having a source address via the first tunnel from the first network, replacing the source address with the appropriate dummy service IP address; and
forwarding the packet with the appropriate dummy service IP address.

14. The method set forth in claim 11 , further comprising:
responsive to receiving a packet having a dummy service IP address associated with the second network as the destination address, replacing the dummy service IP address with an appropriate service IP address; and
forwarding the packet with the appropriate IP address to the second network through the second tunnel.

15. The method set forth in claim 11 , further comprising:
responsive to receiving a packet having a source address via the second tunnel from the second network, replacing the source address with the appropriate dummy service IP address; and
forwarding the packet with the appropriate dummy service IP address.

16. The method set forth in claim 11 , wherein the dummy service IP addresses allocated for service IP addresses associated with the first network and service IP associated with the second network are contiguous.

17. A non-transitory computer-readable medium storing computer program code that, when executed, performs an operation, comprising:
selectively routing Domain Name System (DNS) requests for sub-domains associated with a first network through a tunnel associated with the first network via the interface;
selectively routing DNS requests for sub-domains associated with a second network through a tunnel associated with the second network via the interface;
replacing a destination address for DNS requests for sub-domains associated with the second network to match an address of a DNS server associated with the second network;
storing data representative of DNS requests for sub-domains associated with the second network; and
forwarding the DNS requests for sub-domains associated with the second network with the address of the DNS server associated with the second network.

18. The non-transitory computer-readable

Assignees

• Cisco Tech Inc

Inventors

• Parla Vincent E
• Santau Vlad
• Champagne Jr Timothy Steven
• Munz Kerry Hannigan

Classifications

• H04L63/0272 Primary

  Virtual private networks · CPC title

• H04L61/1511

  Electricity · mapped topic

• H04L45/74 Primary

  Address processing for routing · CPC title

• H04L61/2007

  Electricity · mapped topic

• H04L61/5007

  Internet protocol [IP] addresses · CPC title