Per-application network content filtering
Disclosed are various examples for providing network content filtering to client devices on a per-application basis. A network stack receives a request from an application to connect to a network service. The network stack then determines the identity of the application. Based at least in part on the identity of the application, the network stack initiates a network connection between the application and the network service using or without using a managed network tunnel.
1. A system, comprising:
a computing device comprising a processor and a memory;
machine-readable instructions stored in the memory that, when executed by processor, cause the computing device to at least:
receive a request from an application to initiate a network connection;
determine an identity of the application in response to receipt of the request to initiate the network connection;
based at least in part on the identity of the application, determine that the network connection requires the use of a virtual private network (VPN) connection;
establish the VPN connection; and
route network traffic associated with the application through the VPN connection.
2. The system of claim 1 , wherein the request is a first request, the application is a first application, the network connection is a first network connection, the VPN connection is a first VPN connection, and the machine-readable instructions are further configured to cause the computing device to at least:
receive a second request from a second application to initiate a second network connection;
determine an identity of the second application;
based at least in part on the identity of the second application, determine that the second network connection is to use a second VPN connection, the second VPN connection being separate from the first VPN connection;
establish the second VPN connection; and
route network traffic associated with the second application through the second VPN connection.
3. The system of claim 1 , wherein the machine-readable instructions that cause the computing device to establish the VPN connection further cause the computing device to create the VPN connection between the application and a network content filtering service.
4. The system of claim 1 , wherein the machine-readable instructions further cause the computing device to at least:
request a rule from a management service, the rule specifying that the network traffic from the application must be routed over the VPN; and
wherein a determination that the network connection requires the use of the VPN connection is further based at least in part on the rule.
5. The system of claim 1 , wherein a determination that the network connection requires the use of the VPN is further based at least in part on a destination address for the network connection.
6. The system of claim 1 , wherein the VPN connection is encrypted using a version of the transport layer security (TLS) protocol.
7. The system of claim 1 , wherein the VPN connection is encrypted using a version of the internet protocol security (IPSec) protocol.
8. A method, comprising
receiving a request from an application to initiate a network connection;
determining an identity of the application in response to receipt of the request to initiate the network connection;
based at least in part on the identity of the application, determining that the network connection requires the use of a virtual private network (VPN) connection;
establishing the VPN connection; and
routing network traffic associated with the application through the VPN connection.
9. The method of claim 8 , wherein the request is a first request, the application is a first application, the network connection is a first network connection, the VPN connection is a first VPN connection, and the method further comprises:
receiving a second request from a second application to initiate a second network connection;
determining an identity of the second application;
based at least in part on the identity of the second application, determining that the second network connection is to use a second VPN connection, the second VPN connection being separate from the first VPN connection;
establishing the second VPN connection; and
routing network traffic associated with the second application through the second VPN connection.
10. The method of claim 8 , wherein establishing the VPN connection further comprises creating a VPN tunnel between the application and a network content filtering service.
11. The method of claim 8 , further comprising:
requesting a rule from a management service, the rule specifying that the network traffic from the application must be routed over the VPN; and
wherein determining that the network connection requires the use of the virtual private network (VPN) connection is further based at least in part on the rule.
12. The method of claim 8 , wherein determining that the network connection requires the use of the VPN is further based at least in part on a destination address for the network connection.
13. The method of claim 8 , further comprising encrypting the VPN connection using a version of the transport layer security (TLS) protocol.
14. The method of claim 8 , further comprising encrypting the VPN connection using a version of the internet protocol security (IPSec) protocol.
15. A non-transitory, computer-readable medium comprising machine-readable instructions that, when executed by a processor, cause a computing device to at least:
receive a request from an application to initiate a network connection;
determine an identity of the application in response to receipt of the request to initiate the network connection;
based at least in part on the identity of the application, determine that the network connection requires the use of a virtual private network (VPN) connection;
establish the VPN connection; and
route network traffic associated with the application through the VPN connection.
16. The non-transitory, computer-readable medium of claim 15 , wherein the request is a first request, the application is a first application, the network connection is a first network connection, the VPN connection is a first VPN connection, and the machine-readable instructions are further configured to cause the computing device to at least:
receive a second request from a second application to initiate a second network connection;
determine an identify of the second application;
based at least in part on the identity of the second application, determine that the second network connection is to use a second VPN connection, the second VPN connection being separate from the first VPN connection;
establish the second VPN connection; and
route network traffic associated with the second application through the second VPN connection.
17. The non-transitory, computer-readable medium of claim 15 , wherein the machine-readable instructions that cause the computing device to establish the VPN connection further cause the computing device to create a VPN tunnel between the application and a network content filtering service.
18. The non-transitory, computer-readable medium of claim 15 , wherein the machine-readable instructions further cause the computing device to at least:
request a rule from a management service, the rule specifying that the network traffic from the application must be routed over the VPN; and
where a determination that the network connection requires the use of the virtual private network (VPN) connection is further based at least in part on the rule.
19. The non-transitory, computer-readable medium of claim 15 , wherein a determination that the network connection requires the use of the VPN is further based at least in part on a destination address for the network connection.
20. The non-transitory, computer-readable medium of claim 15 , wherein the VPN connection is encrypted using at least one of a version of the transport layer security (TLS) protocol or a version of the internet protocol security (IPSec) protocol.