Managing access to private network resources from external devices via a relay computing element
Described herein are systems, methods, and software that manage the communication between computing elements outside a private network and computing elements inside a private network. In one example, a relay computing element receives a first packet from a first computer outside a private network. The relay computing element determines whether the first packet is permitted for a second computer inside the private network. If the first packet is permitted, the relay computing element generates a second packet with the first packet in the payload and encapsulates the second packet in a third packet. Once encapsulated, the third packet is forwarded to the second computer.
1 . A method of operating a relay computing element comprising:
receiving a first packet, comprising an unencrypted Server Name Indication (SNI), from a first computing element outside of a private network;
communicating a notification, comprising at least the SNI and a destination port number from the first packet, to a second computing element in the private network to determine that the first packet is permitted;
receiving a response from the second computing element to the notification, wherein the response indicates that the first packet is permitted;
in response to the response indicating that the first packet is permitted, generating a second packet that includes the first packet in a payload of the second packet, wherein the second packet comprises a first private IP (Internet Protocol) address associated with the relay computing element and a second private IP address associated with the second computing element;
receiving encryption key information from a coordination service;
encapsulating the second packet in a third packet using the encryption key information, wherein a header of the third packet comprises public addressing information to communicate the third packet over the Internet toward the second computing element; and
communicating the third packet toward the second computing element.
2 . The method of claim 1 , wherein the first packet comprises a transmission control protocol packet.
3 . The method of claim 1 , wherein the first packet uses transmission layer security (TLS) protocol.
4 . The method of claim 1 further comprising:
receiving the first private IP address associated with the relay computing element from the coordination service, wherein the coordination service assigns the first private IP address to the relay computing element; and
receiving the second private IP address associated with the second computing element from the coordination service, wherein the coordination service assigns the second private IP address to the second computing element.
5 . The method of claim 1 further comprising:
receiving a fourth packet from a third computing element outside of the private network;
communicating a second notification to the second computing element in the private network to determine whether the fourth packet is permitted;
receiving a second response from the second computing element to the second notification, wherein the second response indicates that the fourth packet is not permitted; and
blocking the fourth packet based on the second response.
6 . A computing apparatus comprising:
a storage system;
a processing system, including at least one processor, operatively coupled to the storage system; and
program instructions stored on the storage system to operate as a relay computing element that, when executed by the processing system, direct the computing apparatus to:
receive a first packet, comprising an unencrypted Server Name Indication SNI), from a first computing element outside of a private network;
communicate a notification, comprising at least the SNI and a destination port number from the first packet, to a second computing element in the private network to determine that the first packet is permitted;
receive a response from the second computing element to the notification, wherein the response indicates that the first packet is permitted;
in response to the response indicating that the first packet is permitted, generate a second packet that includes the first packet in a payload of the second packet, wherein the second packet comprises a first private IP (Internet Protocol) address associated with the relay computing element and a second private IP address associated with the second computing element;
receive encryption key information from a coordination service;
encapsulate the second packet in a third packet using the encryption key information, wherein a header of the third packet comprises public addressing information to communicate the third packet over the Internet toward the second computing element; and
communicate the third packet toward the second computing element.
7 . The computing apparatus of claim 6 , wherein the first packet comprises a transmission control protocol packet.
8 . The computing apparatus of claim 6 , wherein the first packet uses transmission layer security (TLS) protocol.
9 . The computing apparatus of claim 6 , wherein the program instructions further direct the computing apparatus to:
receive the first private IP address associated with the relay computing element from the coordination service, wherein the coordination service assigns the first private IP address to the relay computing element; and
receive the second private IP address associated with the second computing element from the coordination service, wherein the coordination service assigns the second private IP address to the second computing element.
10 . The computing apparatus of claim 6 , wherein the program instructions further direct the computing apparatus to:
receive a fourth packet from a third computing element outside of the private network;
communicate a second notification to the second computing element in the private network to determine whether the fourth packet is permitted;
receive a second response from the second computing element to the second notification, wherein the second response indicates that the fourth packet is not permitted; and
block the fourth packet based on the second response.
11 . A system comprising:
a first computer; and
a relay computer, including at least one processor, configured to:
receive a first packet, comprising an unencrypted Server Name Indication (SNI), from a second computer outside of a private network;
communicate a notification, comprising at least the SNI and a destination port number from the first packet, to the first computer in the private network to determine whether the first packet is permitted;
receive a response from the computer to the notification, wherein the response indicates that the first packet is permitted;
in response to the response indicating that the first packet is permitted, generate a second packet that includes the first packet in a payload of the second packet, wherein the second packet comprises a first private IP (Internet Protocol) address associated with the relay computer and a second private IP address associated with the first computer;
receive encryption key information from a coordination service;
encapsulate the second packet in a third packet using the encryption key information, wherein a header of the third packet comprises public addressing information to communicate the third packet over the Internet toward the first computer; and
communicate the third packet toward the first computer.
12 . The system of claim 11 , wherein the first packet comprises a transmission control protocol packet.
13 . The system of claim 11 , wherein the notification provides unencrypted information from the first packet, and wherein the first computer is further configured to:
determine whether the first packet is permitted based on an access control list maintained by the first computer and the unencrypted information from the first packet; and
communicate the response based on the determination of whether the first packet is permitted.