Systems and methods for providing a VPN solution
A system, apparatus and a method for implementing a secured communications link at a layer other than that at which packets are filtered are disclosed. In one embodiment, a computer system is configured to form a virtual private network (“VPN”) and comprises an address inspection driver to identify initial target packet traffic addressed to a target server. Also, the computer system includes a pseudo server module to receive rerouted initial target packet traffic from the address inspection driver. The pseudo server module is configured to convey packet regeneration instructions to a VPN gateway. The address inspection driver functions to identify additional target packet traffic addressed to the target server and routes the additional target packet traffic to the pseudo server. In one embodiment, the pseudo server is configured to strip header information from the additional target packet traffic to form a payload, and thereafter, to route the payload to the target.
1. A system for securing a private network communications to a server, the system comprising:
an address inspection driver of a device configured to filter packets of an application of the device that are identified as destined for a server on a private network and reroute the filtered packets locally to the device; and
a pseudo server of the device configured to receive the filtered packets and transmit a payload of the filtered packets via a secure communications link to a gateway in communication with the server on the private network.
2. The system of claim 1 , wherein the address inspection driver is configured to reroute the filtered packets locally by communicate the filtered packets to the pseudo server via a local port and internet protocol address of the device.
3. The system of claim 1 , wherein the address inspection driver is configured to filter network packets at a layer of a network stack below a transport layer.
4. The system of claim 1 , wherein the address inspection driver is configured to modify the filtered packets to identify an internet protocol address of the device as a destination address.
5. The system of claim 1 , wherein the pseudo server is configured to remove header information from the filtered packets.
6. The system of claim 1 , wherein the pseudo server is configured to transmit to the gateway instructions on regenerating the removed header information.
7. The system of claim 1 , wherein the pseudo server is configured to encrypt the payload of the filtered packets.
8. A system for securing a private network communications to a server, the system comprising:
a device intermediary to a client and a server, the server in communication with the device via a private network;
a tunnel manager configured on the device to establish a secure communications link with a pseudo server of a client in communication with the device;
wherein the tunnel manager is configured to receive from the pseudo server via the secure communications link payloads of packets with header information removed and instructions on regenerating the removed header information; and
wherein the device is configured to regenerate the removed header information for the packets and transmit the packets to the server.
9. The system of claim 8 , wherein the removed header information comprises one or more of the following: transport control protocol headers, internet protocol headers and link layer headers.
10. The system of claim 8 , wherein the device is further configured to decrypt encrypted payloads of the packets received via the secure communications link.
11. The system of claim 8 , further comprising an address translator further configured to provide a reverse network address translation process to hid assigned address of client from server.
12. The system of claim 8 , wherein the device responsive to the address translator modifies the packet to comprise a source internet protocol address of the device on the private network.
13. The system of claim 8 , wherein the device is further configured to provide configuration information to the client for filtering network traffic from the client to be rerouted via the pseudo server to the device.
14. The system of claim 8 , wherein the configuration information comprises a range of addresses associated with the private network.
15. The system of claim 14 , wherein the tunnel manager is configured to download the pseudo server to the client.
16. The system of claim 8 , wherein the tunnel manager assigns an address on the private network to the client.
17. A system for securing a private network communications to a server, the system comprising:
a device in communication with a server on a private network;
a client comprising:
an address inspection driver, downloadable from the device, configured to filter packets of an application of the device that are identified as destined for the server on and reroute the filtered packets locally to the client; and
a pseudo server, downloadable from the device, configured to receive the filtered packets from the address inspection driver and transmit a payload of the filtered packets via a secure communications link to the device.
18. The system of claim 17 , wherein the address inspection driver is configured to use a filter table based on configuration information provided by the device.
19. The system of claim 17 , wherein the pseudo server is configured to strip header information from the filtered packets and transmit to the device instructions on regenerating the stripped header information.
20. The system of claim 19 , wherein the device is configured to regenerate the stripped header information for the packets and transmit the packets to the server.