Route reply back interface for cloud internal communication
A method, system, and computer-usable medium are disclosed for responsive to a connection from a client to a server for establishing communications between the client and the server, store information regarding state of the connection and responsive to receiving a reply from the server to the client, route the reply to the client based on the information regarding the state of the connection.
1. A computer-implemented method for managing network communication, comprising:
in response to a connection from a client to a server for establishing communications between the client and the server, storing information regarding state of the connection;
translating a client network address of the connection into a trans late d client network address based on identifying characteristics of a network tunnel through which the connection is established so as to distinguish the client from another client with the same client network address connecting to the server through another network tunnel;
in response to receiving a reply from the server to the client, routing the reply to the client via the translated client network address based on the information regarding the state of the connection; and
injecting protocol-independent header information into a datagram of the traffic between the client and the server, the protocol-independent header information including identifying information of the client, wherein the protocol-independent header information within the datagram is encrypted with a user-specific key.
2. The method of claim 1 , wherein the information regarding the state of the connection comprises an indication that a route reply back interface is being used for the connection and a source interface of the connection.
3. The method of claim 2 , wherein the information regarding the state of the connection includes information regarding a protocol, source address, and source port of the connection.
4. The method of claim 1 , further comprising:
storing information regarding the translated client network address as part of the information regarding state of the connection.
5. The method of claim 1 , wherein the user-specific key is defined by user-specific information within the protocol-independent header information, such that the user-specific information may be used to decrypt encrypted protocol-independent header information.
6. The method of claim 5 , wherein encrypting the protocol-independent header information with the user-specific key comprises encrypting the protocol-independent header information with a key selected from a plurality of keys associated with a user, wherein the user-specific key selected from the plurality of keys is defined by a key identifier associated with the user within the protocol-independent header information.
7. A system comprising:
a processor; and
a non-transitory, computer-readable storage medium embodying computer program code comprising instructions executable by the processor and configured for:
responsive to a connection from a client to a server for establishing communications between the client and the server, storing information regarding state of the connection;
translating a client network address of the connection into a translated client network address based on identifying characteristics of a network tunnel through which the connection is established so as to distinguish the client from another client with the same client network address connecting to the server through another network tunnel;
responsive to receiving a reply from the server to the client, routing the reply to the client via the translated client network address based on the information regarding the state of the connection; and
injecting protocol-independent header information into a datagram of the traffic between the client and the server, the protocol-independent header information including identifying information of the client, wherein the protocol-independent header information within the datagram is encrypted with a user-specific key.
8. The system of claim 7 , wherein the information regarding the state of the connection comprises an indication that a route reply back interface is being used for the connection and a source interface of the connection.
9. The system of claim 8 , wherein the information regarding the state of the connection includes information regarding a protocol, source address, and source port of the connection.
10. The system of claim 7 , the instructions for further:
storing information regarding the translated client network address as part of the information regarding state of the connection.
11. The system of claim 7 , wherein the user-specific key is defined by user-specific information within the protocol-independent header information, such that the user-specific information may be used to decrypt encrypted protocol-independent header information.
12. The system of claim 11 , wherein encrypting the protocol-independent header information with the user-specific key comprises encrypting the protocol-independent header information with a key selected from a plurality of keys associated with a user, wherein the user-specific key selected from the plurality of keys is defined by a key identifier associated with the user within the protocol-independent header information.
13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
responsive to a connection from a client to a server for establishing communications between the client and the server, storing information regarding state of the connection;
translating a client network address of the connection into a trans late d client network address based on identifying characteristics of a network tunnel through which the connection is established so as to distinguish the client from another client with the same client network address connecting to the server through another network tunnel;
responsive to receiving a reply from the server to the client, routing the reply to the client via the translated client network address based on the information regarding the state of the connection; and
injecting protocol-independent header information into a datagram of the traffic between the client and the server, the protocol-independent header information including identifying information of the client, wherein the protocol-independent header information within the datagram is encrypted with a user-specific key.
14. The computer-readable storage medium of claim 13 , wherein the information regarding the state of the connection comprises an indication that a route reply back interface is being used for the connection and a source interface of the connection.
15. The computer-readable storage medium of claim 14 , wherein the information regarding the state of the connection includes information regarding a protocol, source address, and source port of the connection.
16. The computer-readable storage medium of claim 13 , the instructions for further:
storing information regarding the translated client network address as part of the information regarding state of the connection.
17. The computer-readable storage medium of claim 13 , wherein the user-specific key is defined by user-specific information within the protocol-independent header information, such that the user-specific information may be used to decrypt encrypted protocol-independent header information.
18. The computer-readable storage medium of claim 17 , wherein encrypting the protocol-independent header information with the user-specific key comprises encrypting the protocol-independent header information with a key selected from a plurality of keys associated with a user, wherein the user-specific key selected from the plurality of keys is defined by a key identifier associated with the user within the protocol-independent header information.