System and method for isolated virtual image and appliance communication within a cloud environment
Provided herein are systems and methods for providing isolated virtual image communication in a virtual computing environment. Initially, a guest virtual machine that is activated in a virtual computing environment may be isolated into a private network. A service request may then be formulated at the guest virtual machine and addressed to a predetermined non-existent address. The request is then ostensibly sent to the predetermined address, whereupon the service request is actually transmitted to a shared resource with a security appliance machine in the virtual computing environment. The request is then forwarded to the security appliance machine and a reply formulated. The reply is sent back to the guest virtual machine via the shared resource.
1. A method, comprising:
executing, with one or more processors, a network filter on a computing device in a cloud computing environment, wherein:
the cloud computing environment comprises a plurality of computing devices, the plurality including the computing device,
the cloud computing environment provides computing services to a plurality of customers of a provider of the cloud computing environment with the plurality of computing devices,
the computing device executes a hypervisor upon which a guest virtual machine executes,
the guest virtual machine is part of a private virtual network of a given customer of the provider of the cloud computing environment, and
the network filter executes outside of the virtual machine on the computing device;
receiving, with one or more processors, with the network filter, a packet that the guest virtual machine attempted to send onto the private virtual network, wherein:
the packet comprises a header having a source network address and a destination network address,
the source network address is an address of the guest virtual machine on the private virtual network, and
the destination network address is an address to which the guest virtual machine attempted to send the packet on the private virtual network;
determining, with one or more processors, responsive to the network filter receiving the packet, based on the destination network address, to provide the packet to a different destination that has a different destination network address from the destination network address of the header of the packet, wherein:
the determination is made by the computing device executing the guest virtual machine attempting to send the packet,
the determination is made outside of the guest virtual machine, and
the different destination is not within the private virtual network; and
causing, with one or more processors, via the network filter, content of the packet to be provided to the different destination.
2. The method of claim 1 , wherein:
the packet is transported to the network filter by memory of the computing device rather than via a network;
the determination is made before or without routing the packet to the destination address of the packet on the private virtual network;
the received packet has destination address that is a non-existent address on the private virtual network; and
the guest virtual machine is unreachable on the private virtual network to machines that are outside of the private virtual network.
3. The method of claim 1 , wherein:
the different destination is a security application executing on the computing device;
the security application executes outside of the guest virtual machine; and
the security application executes in a host environment that is not on the private virtual network.
4. The method of claim 3 , wherein:
the security application is a security appliance machine executing in another virtual machine on the same hypervisor as the guest virtual machine.
5. The method of claim 1 , wherein:
the hypervisor comprises the network filter; and
the network filter is external to each of a plurality of virtual machines executing on the hypervisor, at least some of which are external to the private virtual network.
6. The method of claim 1 , wherein causing content of the packet to be provided to the different destination comprises:
forming a packet in which the destination address of the header is a network address external to the private virtual network; and
sending the formed packet to the network address external to the private virtual network.
7. The method of claim 1 , comprising:
receiving from a remote computing device, via a network connection external to the private virtual network, a security policy by which network access of the guest virtual machine is managed.
8. The method of claim 1 , comprising:
obtaining a current virtual machine image status of the guest virtual machine; and
validating the current virtual machine image status.
9. The method of claim 1 , comprising:
steps for maintaining network isolation and existing boundaries for isolated virtual images in a virtual environment, while allowing sharing and consumption of data needed from a cloud provider.
10. The method of claim 1 , comprising:
providing the cloud computing environment; or
executing an application within the guest virtual machine.
11. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:
executing, with one or more processors, a network filter on a computing device in a cloud computing environment, wherein:
the cloud computing environment comprises a plurality of computing devices, the plurality including the computing device,
the cloud computing environment provides computing services to a plurality of customers of a provider of the cloud computing environment with the plurality of computing devices,
the computing device executes a hypervisor upon which a guest virtual machine executes,
the guest virtual machine is part of a private virtual network of a given customer of the provider of the cloud computing environment, and
the network filter executes outside of the virtual machine on the computing device;
receiving, with one or more processors, with the network filter, a packet that the guest virtual machine attempted to send onto the private virtual network, wherein:
the packet comprises a header having a source network address and a destination network address,
the source network address is an address of the guest virtual machine on the private virtual network, and
the destination network address is an address to which the guest virtual machine attempted to send the packet on the private virtual network;
determining, with one or more processors, responsive to the network filter receiving the packet, based on the destination network address, to provide the packet to a different destination that has a different destination network address from the destination network address of the header of the packet, wherein:
the determination is made by the computing device executing the guest virtual machine attempting to send the packet,
the determination is made outside of the guest virtual machine, and
the different destination is not within the private virtual network; and
causing, with one or more processors, via the network filter, content of the packet to be provided to the different destination.
12. The medium of claim 11 , wherein:
the different destination is a security application executing on the computing device;
the security application executes outside of the guest virtual machine; and
the security application executes in a host environment that is not on the private virtual network.
13. The medium of claim 12 , wherein:
the security application is a security appliance machine executing in another virtual machine on the same hypervisor as the guest virtual machine.
14. The medium of claim 11 , wherein:
the packet is transported to the network filter by memory of the computing device rather than via a network;
the determination is made before or without routing the packet to the destination address of the packet on the private virtual network;
the received packet has destination address that is a non-existent address on the private virtual network; and
the guest virtual machine is unreachable on the private virtual network to machines that are outside of the private virtual network.
15. The medium of claim 11 , wherein:
the hypervisor comprises the network filter; and
the network filter is external to each of a plurality of virtual machines executing on the hypervisor, at least some of which are external to the private virtual network.
16. The medium of claim 11 , wherein causing content of the packet to be provided to the different destination comprises:
forming a packet in which the destination address of the header is a network address external to the private virtual network; and
sending the formed packet to the network address external to the private virtual network.
17. The medium of claim 11 , the operations comprising:
receiving from a remote computing device, via a network connection external to the private virtual network, a security policy by which network access of the guest virtual machine is managed.
18. The medium of claim 11 , the operations comprising:
obtaining a current virtual machine image status of the guest virtual machine; and
validating the current virtual machine image status.
19. The medium of claim 11 , the operations comprising:
steps for maintaining network isolation and existing boundaries for isolated virtual images in a virtual environment, while allowing sharing and consumption of data needed from a cloud provider.
20. The medium of claim 11 , the operations comprising:
providing the cloud computing environment; or
executing an application within the guest virtual machine.