Network architecture for cloud computing environments

1. A system comprising:

a plurality of first host machines implementing a public-cloud computing environment, wherein at least one of the first host machines comprises at least one public-cloud virtual machine (VM) that performs network address translation (NAT); and

a plurality of second host machines implementing a private-cloud computing environment, wherein at least one of the second host machines comprises at least one private-cloud VM,

wherein the public-cloud VM is configured to:

receive, via a network tunnel from the private-cloud VM, one or more first packets to be sent to a public Internet Protocol (IP) address of a public network host, the one or more first packets when received at the public-cloud VM from the private-cloud VM each comprising a source address that includes a private IP address of the private-cloud VM;

translate, using a NAT mapping, the source address of each first packet received from the private-cloud VM from the private IP address of the private-cloud VM to an IP address of the public-cloud VM so that each first packet to be sent to the public IP address of the public network host appears to be from the public-cloud VM;

send each first packet to the public IP address of the public network host, each first packet sent to the public IP address of the public network host comprising the translated source address that includes the IP address of the public-cloud VM;

receive a second packet to be sent to the private-cloud VM;

translate, using the NAT mapping, a destination address of the second packet from the IP address of the public-cloud VM to the private IP address of the private-cloud VM corresponding to an actual destination of the second packet, the IP address of the public-cloud VM corresponding to the translated source address of each first packet, the private IP address of the private-cloud VM corresponding to the source address of each first packet prior to translation; and

send the second packet to the private IP address of the private-cloud VM.

2. The system of claim 1 , wherein the second packet was sent by an Internet host to the private-cloud VM as a response to the one or more first packets.

3. The system of claim 1 , wherein the public cloud VM is further configured to:

retrieve the private IP address of the private-cloud VM from the NAT mapping,

wherein the private IP address of the private-cloud VM was stored in the NAT mapping when the source address of each first packet was translated from the private IP address of the private-cloud VM to the IP address of the public-cloud VM, and the IP address of the public-cloud VM comprises a private IP address for a private network of the public-cloud computing environment.

4. The system of claim 1 , wherein the network tunnel comprises a VxLAN tunnel.

5. The system of claim 1 , wherein to receive, via the network tunnel, the first packets, the public-cloud VM is further configured to receive the first packets from an internal load balancer that receives the first packets from the private-cloud VM.

6. The system of claim 1 , wherein the public-cloud VM is further configured to de-encapsulate the first packets.

7. The system of claim 1 , further comprising one or more network switches that provide Internet access for the second host machines that implement the private-cloud computing environment, wherein the network switches are configured to route network traffic to the Internet according to one or more switch access rules generated based on one or more firewall table rules, the firewall table rules comprising at least one Internet traffic routing rule configured to route traffic to the Internet.

8. The system of claim 7 , wherein the switch access rules comprise a first switch access rule based on a first firewall rule from the firewall table rules, the first switch access rule having a source address based on an intersection between the source address of a first firewall rule and a subnet associated with the first firewall rule.

9. The system of claim 8 , wherein the switch access rules further comprise a second switch access rule based on a second firewall rule from the firewall table rules, wherein the second firewall rule has a next hop that is in the subnet associated with the first firewall rule, the second switch access rule having as its source an intersection of the source address of the first firewall rule and a subnet associated with the second firewall rule, and as its destination an intersection of the destination address of the first firewall rule with a route prefix of the second firewall rule.

10. The system of claim 9 , wherein the switch access rules further comprise one or more additional switch access rules based on recursively traversing backwards via the next hop of one or more of the firewall table rules, each additional switch access rule having as its source an intersection of the source address of the first firewall rule and a subnet associated with a third firewall rule obtained through the recursive backward traversal of the firewall table rules, and the additional switch access rule having as its destination an intersection of the destination of the first firewall rule and a destination of the third firewall rule.

11. One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

receive, by at least one public-cloud virtual machine (VM) via a network tunnel from a private-cloud VM, one or more first packets to be sent to a public Internet Protocol (IP) address of a public network host, the one or more first packets when received by the public-cloud VM from the private-cloud VM each comprising a source address that includes a private IP address of the private-cloud VM;

wherein a plurality of first host machines implement a public-cloud computing environment, wherein at least one of the first host machines comprises the public-cloud VM, and the public cloud VM performs network address translation (NAT), and

wherein a plurality of second host machines implement a private-cloud computing environment, wherein at least one of the second host machines comprises at least one private-cloud VM;

translate, by the public-cloud VM, using a NAT mapping, the source address of each first packet received from the private-cloud VM from the private IP address of the private-cloud VM to an IP address of the public-cloud VM so that each first packet to be sent to the public IP address of the public network host appears to be from the public-cloud VM;

send, by the public-cloud VM, each first packet to the public IP address of the public network host, each first packet sent to the public IP address of the public network host having as the source address the IP address of the public-cloud VM;

receive, by the public-cloud VM, a second packet to be sent to the private-cloud VM;

translate, by the public-cloud VM, using the NAT mapping, a destination address of the second packet from the IP address of the public-cloud VM to the private IP address of the private-cloud VM corresponding to an actual destination of the second packet, the IP address of the public-cloud VM corresponding to the translated IP address of each first packet, the private IP address of the private-cloud VM corresponding to the source address of each first packet prior to translation; and

send, by the public-cloud VM, the second packet to the private IP address of the private-cloud VM.

12. The media of claim 11 , wherein the second packet was sent by an Internet host to the private-cloud VM as a response to one or more first packets.

13. The media of claim 11 , wherein the software is further operable when executed to:

retrieve, by the public-cloud VM, the private IP address of the private-cloud VM from the NAT mapping,

wherein the private IP address of the private-cloud VM was stored in the NAT mapping when the source address of each first packet was translated from the private IP address of the private-cloud VM to the IP address of the public-cloud VM, and the IP address of the public-cloud VM comprises a private IP address for a private network of the public-cloud computing environment.

14. A method comprising:

receiving, by at least one public-cloud virtual machine (VM) on a first host machine, via a network tunnel from a private-cloud VM, one or more first packets to be sent to a public IP address of a public network host, the one or more first packets when received by the public-cloud VM from the private-cloud VM each comprising a source address that includes a private IP address of the private-cloud VM;

wherein a plurality of first host machines, including the first host machine, implement a public-cloud computing environment, wherein at least one of the first host machines comprises the public-cloud VM, and the public cloud VM performs network address translation (NAT), and

wherein a plurality of second host machines implement a private-cloud computing environment, wherein at least one of the second host machines comprises at least one private-cloud VM;

translating, by the public-cloud VM on the first host machine, using a NAT mapping, the source address of each first packet received from the private-cloud VM from the private IP address of the private-cloud VM to an IP address of the public-cloud VM so that each first packet to be sent to the public IP address of the public network host appears to be from the public-cloud VM;

sending, by the public-cloud VM on the first host machine, each first packet to the public IP address of the public network host, each first packet sent to the public IP address of the public network host having as the source address the IP address of the public-cloud VM;

receiving, by the public-cloud VM on the first host machine, a second packet to be sent to the private-cloud VM;

translating, by the public-cloud VM on the first host machine, using the NAT mapping, a destination address of the second packet from the IP address of the public-cloud VM to the private IP address of the private-cloud VM corresponding to an actual destination of the second packet, the IP address of the public-cloud VM corresponding to the translated IP address of each first packet, the private IP address of the private-cloud VM corresponding to the source address of each first packet prior to translation; and

sending, by the public-cloud VM on the first host machine, the second packet to the private IP address of the private-cloud VM.

15. The method of claim 14 , wherein the second packet was sent by an Internet host to the private-cloud VM as a response to one or more first packets.

16. The method of claim 14 , further comprising:

retrieving, by the public-cloud VM on the first host machine, the private IP address of the private-cloud VM from the NAT mapping,

wherein the private IP address of the private-cloud VM was stored in the NAT mapping when the source address of each first packet was translated from the private IP address of the private-cloud VM to the IP address of the public-cloud VM, and the IP address of the public-cloud VM comprises a private IP address for a private network of the public-cloud computing environment.