Local interception of traffic to a remote forward proxy
An application using a VPN is programmed to transmit proxy traffic to a remote proxy server. Traffic to the proxy server is intercepted, shifted to user space, and processed according to one or more options. Traffic may be terminated by a local proxy that resolves domain names in traffic and requests referenced content. Intercepted traffic may include plain text data in headers that is encrypted before forwarding to a different proxy server. Traffic may be evaluated, such as a User Agent string in order to determine routing choices, such as blocking, throttling, local termination, transmitting through a VPN, or other options. Multiple VPNs may operate on the same user computer and proxy traffic may be intercepted and processed by transmitting it through a VPN, bypassing all VPNs, or routing through a different VPN.
1. A system comprising one or more processing units and one or more memory units operably coupled to the one or more processing units, the one or more memory units storing executable code effective to cause the one or more processing units to:
receive settings for a first Virtual Private Network (VPN) service and a second VPN service, settings for the first VPN service including a proxy setting comprising a first network identifier;
activate the first VPN service and the second VPN service, the first VPN service being associated with a first Virtual Network Device (VND) and the second VPN service being associated with a second VND;
establish a first tunnel between the second VPN service and a first VPN server;
route network traffic associated with the first network identifier to the first VND; and
route at least some network traffic not associated with the first network identifier to the second VND by:
intercepting, from the first VND, a first request to the first network identifier, the first request being formatted as a request to a remote proxy server, the first request containing a first domain name, the first domain name specifying a destination associated with the first domain name to which the remote proxy server should forward the first request;
determining by a local proxy server that the first request should be routed through the second VPN service according to content of the first request; and
in response to determining that the first request should be routed through the second VPN service according to the content of the first request:
terminating the first request by the local proxy server without sending the first request to a destination associated with the first network identifier;
obtaining the first domain name from the first request;
generating a second request to the destination associated with the first domain name;
sending the second request to a second network identifier different from the first network identifier through the first tunnel between the second VPN service and the first VPN server; and
routing a response to the second request to the second VND.
2. The system of claim 1 , wherein the executable code is further effective to cause the one or more processing units to:
intercept, from the first VND, a third request to the first network identifier, the second request containing a second domain name;
determining by a local proxy server that the first request should be routed in bypass of the first VND and the second VND according to content of the third request; and
in response to determining that the first request should be routed in bypass of the first VND and the second VND according to content of the third request:
terminate the third request using the local proxy server executing on the user's computer without sending the second request to the destination associated with the first network identifier;
issue a fourth request to a destination associated with the second domain name;
send the fourth request to a third network identifier different from the first network identifier; and
route network traffic associated with the fourth request in bypass of both the first VND and the second VND.
3. The system of claim 2 , wherein the executable code is further effective to cause the one or more processing units to send the fourth request to the destination associated with the second domain name in bypass of any VPN tunnel connected to the user's computer.
4. The system of claim 2 , wherein the executable code is further effective to cause the one or more processing units to:
route, by the first VPN service, all traffic to the first VPN service that is not routed through the first tunnel in bypass of any VPN tunnel.
5. The system of claim 2 , wherein the executable code is further effective to cause the one or more processing units to:
establish, by the first VPN service, a second tunnel between itself and a second VPN server; and
send the third request to the destination associated with the second domain through the second tunnel.
6. The system of claim 5 , wherein the first VPN service and the second VPN service use different VPN protocols to establish the first VPN tunnel and the second VPN tunnel.
7. The system of claim 6 , wherein the second VPN service uses IPSEC (Internet Protocol Secure) protocol to establish the first VPN tunnel.
8. The system of claim 1 , wherein the executable code is further effective to cause the one or more processing units to:
permit, by an operating system, the first VPN service to inspect and modify the network traffic routed to the first VND; and
prevent, by the operating system, inspection and modification by the second VPN service of the at least some network traffic routed to the second VND.
9. The system of claim 8 , wherein the second VPN service uses a native VPN client included in the operating system, whereas the first VPN service uses a VPN client not included in the operating system.
10. The system of claim 1 , further comprising routing Domain Name Service (DNS) requests through the first VND.
11. A method comprising:
specifying, on a user's computer, settings for a first Virtual Private Network (VPN) service and a second VPN service, settings for the first VPN service on the user's computer including a proxy setting comprising a first network identifier;
activating, on the user's computer, the first VPN service and the second VPN service, the first VPN service being associated with a first Virtual Network Device (VND) and the second VPN service being associated with a second VND, the second VPN service establishing a first tunnel between itself and a first VPN server;
routing, by the user's computer, network traffic associated with the first network identifier to the first VND;
routing, by the user's computer, at least some network traffic not associated with the first network identifier to the second VND according to an evaluation of content of the at least some network traffic;
intercepting, by the user's computer, from the first VND, a first request to the first network identifier, the first request containing a first domain name;
terminating, by the user's computer, the first request by a local proxy server executing on the user's computer without sending the first request to a destination associated with the first network identifier; and
issuing, by the user's computer, a redirected request to a destination associated with the first domain name, the redirected request being routed to the first VPN server through the first tunnel established by the second VPN service.
12. The method of claim 11 , further comprising:
intercepting, by the user's computer, from the first VND, a second request to the first network identifier, the second request containing a second domain name;
terminating, by the user's computer, the second request using a local proxy server executing on the user's computer without sending the second request to a destination associated with the first network identifier; and
issuing a third request to a content server associated with the second domain name without routing the third request through either of the first VND and the second VND.
13. The method of claim 12 , further comprising: sending the third request to a destination associated with the second domain name in bypass of any VPN tunnel connected to the user's computer.
14. The method of claim 12 , wherein only the second VPN service establishes a tunnel between itself and the first VPN server whereas the first VPN service sends all traffic not routed through the first tunnel in bypass of any VPN tunnel.
15. The method of claim 12 , further comprising:
establishing, by the first VPN service, a second tunnel between itself and a second VPN server; and
sending the third request to the destination associated with the second domain through the second tunnel.
16. The method of claim 15 , wherein the first VPN service and the second VPN service use different VPN protocols to establish the first VPN tunnel and the second VPN tunnel.
17. The method of claim 16 , wherein the second VPN service uses IPSEC (Internet Protocol Secure) protocol to establish the VPN tunnel.
18. The method of claim 11 , further comprising:
permitting, by an operating system on the user's computer, the first VPN service to inspect and modify the network traffic routed to the first VND; and
preventing, by the operating system on the user's computer, inspection and modification by the second VPN service of the at least some network traffic routed to the second VND.
19. The method of claim 18 , wherein the second VPN service uses a native VPN client included in the operating system, whereas the first VPN service uses a VPN client not included in the operating system.
20. The method of claim 11 , further comprising routing Domain Name Service (DNS) requests through the first VND.