System and method for traversing a NAT device with IPSec AH authentication
View Patent ↗A method for routing IP packets with IPSec AH authentication is disclosed. The method includes locating overlay edge routers between private domains and their associated NAT routers. Outbound packets from a source private domain are modified by its overlay edge router to include IPSec AH authorization data computed using IP source and destination addresses that match a packet's final source and destination IP address upon final NAT translation immediately prior to delivery to a host of a destination private domain.
1. A method for processing an Internet Protocol (IP) packet, the method comprising:
receiving, by a first router within an overlay network, the IP packet from a source host device associated with a source domain, the IP packet bound for a destination host device associated with a destination domain;
determining, by the first router, a private IP address of a second router within the overlay network, the second router being associated with the destination domain;
processing the IP packet by the first router, including:
calculating authentication data using a public IP address of an intermediate router associated with the source domain as a source IP address, and the private IP address of the second router as a destination IP address;
modifying the IP packet to include the authentication data; and
generating an outer header for the modified IP packet, the outer header including a private IP address of the first router as a header source IP address, and the private IP address of the second router as a header destination IP address; and
transmitting, by the first router, the modified IP packet to the intermediate router.
2. The method of claim 1 , further comprising establishing the overlay network including the first router, the second router, and an overlay controller.
3. The method of claim 2 , wherein determining the private IP address of the second router includes receiving a message from the overlay controller over a secure channel that includes the private IP address of the second router.
4. The method of claim 2 , further comprising obtaining the public IP address of the second router via a peer to peer link through the overlay network.
5. The method of claim 2 , further comprising transmitting a private address of the first router to the overlay controller over a secure channel.
6. The method of claim 2 , further comprising receiving private IP addresses for all routers in the overlay network from the overlay controller.
7. The method of claim 1 , wherein the intermediate router includes a Network Address Translation (NAT) router.
8. A non-transitory computer readable medium containing instructions that, in response to being executed by one or more processors, cause a first router in an overlay network to perform operations, the operations comprising:
receive an Internet Protocol (IP) packet from a source host device associated with a source domain, the IP packet bound for a destination host device associated with a destination domain;
determine a private IP address of a second router within the overlay network, the second router being associated with the destination domain;
process the IP packet, including:
calculate authentication data using a public IP address of an intermediate router associated with the source domain as a source IP address, and the private IP address of the second router as a destination IP address;
modify the IP packet to include the authentication data; and
generate an outer header for the modified IP packet, the outer header including a private IP address of the first router as a header source IP address, and the private IP address of the second router as a header destination IP address; and
transmit the modified IP packet to the intermediate router.
9. The computer readable medium of claim 8 , wherein determining the private IP address of the second router includes receiving a message from an overlay controller over a secure channel that includes the private IP address of the second router.
10. The computer readable medium of claim 8 , wherein the operations further comprise obtain the public IP address of the second router via a peer to peer link through the overlay network.
11. The computer readable medium of claim 8 , wherein the operations further comprise transmit a private address of the first router to an overlay controller over a secure channel.
12. The computer readable medium of claim 8 , wherein the operations further comprise receive private IP addresses for all routers in the overlay network from an overlay controller.
13. A system, comprising:
a second router in an overlay network; and
a first router in the overlay network, the first router comprising:
one or more processors; and
one or more non-transitory computer readable media containing instructions that, in response to being executed by the one or more processors, cause the first router to perform operations, the operations comprising:
receive an Internet Protocol (IP) packet from a source host device associated with a source domain, the IP packet bound for a destination host device associated with a destination domain;
determine a private IP address of the second router within the overlay network, the second router being associated with the destination domain;
process the IP packet, including:
calculate authentication data using a public IP address of an intermediate router associated with the source domain as a source IP address, and the private IP address of the second router as a destination IP address;
modify the IP packet to include the authentication data; and
generate an outer header for the modified IP packet, the outer header including a private IP address of the first router as a header source IP address, and the private IP address of the second router as a header destination IP address; and
transmit the modified IP packet to the intermediate router.
14. The system of claim 13 , further comprising an overlay controller, the overlay controller configured to communicate with the first router over a first secure channel and to communicate with the second router over a second secure channel.
15. The system of claim 14 , wherein determining the private IP address of the second router includes receiving a message from the overlay controller over a secure channel that includes the private IP address of the second router.
16. The system of claim 14 , wherein the operations further comprise obtain the public IP address of the second router via a peer to peer link through the overlay network.
17. The system of claim 14 , wherein the operations further comprise transmit a private address of the first router to the overlay controller over the first secure channel.
18. The system of claim 14 , wherein the operations further comprise receive private IP addresses for all routers in the overlay network from the overlay controller.
19. The system of claim 14 , wherein the operations further comprise transmit a private address of the first router to an overlay controller over a secure channel.
20. The system of claim 14 , wherein the first secure channel includes a datagram transport layer security (DTLS) channel.