Method and apparatus of automatic route optimization in a private virtual network for client devices of a local network

1. A method, in a virtual private network (VPN) server, of route optimization in a VPN, the method comprising:

establishing a first VPN connection with a first client device, wherein the VPN server is remote from the first client device;

establishing a second VPN connection with a second client device, wherein the VPN server is remote from the second client device;

receiving, through the first VPN connection, traffic from the first client device that is destined to the second client device;

transmitting the traffic to the second client device through the second VPN connection;

determining, by the VPN server, that the first client device and the second client device are part of a same local network; and

responsive to determining that the first client device and the second client device are part of the same local network, performing the following:

transmitting, to the first client device and through the first VPN connection, a second public network address of the second client device,

transmitting, to the first client device, routing metrics related to the traffic transmitted through the first VPN connection and the second VPN connection,

transmitting, to the second client device and through the second VPN connection, a first public network address of the first client device, and

wherein transmitting the first public network address and the second public network address causes the first client device to determine, based at least in part on the routing metrics, an optimal route from the first client device to the second client device for the traffic in the VPN.

2. The method of claim 1 further comprising:

receiving from the first client device a first local network address identifying the first client device in the local network;

receiving from the second client device a second local network address identifying the second client device in the local network; and

wherein determining that the first client device and the second client device are in the same local network is performed based on the first local network address and the second local network address.

3. The method of claim 1 , further comprising:

receiving from the first client device a first set of one or more local network addresses identifying a first set of one or more client devices located in the local network that the first client device desires to communicate with in the VPN;

receiving from the second client device a second set of one or more local network addresses identifying a second set of one or more client devices located in the local network that the second client device desires to communicate with in the VPN; and

wherein determining that the first client device and the second client device are part of the same local network is performed based on the first set of local network addresses and the second set of local network addresses.

4. The method of claim 1 , wherein the routing metrics include for each one of the first VPN connection and the second VPN connection one or more of a measure of link utilization, an indication of a number of hops, a measure of speed, a measure of packet loss, a measure of latency, a measure of path reliability, a measure of path bandwidth, and a measure of throughput.

5. The method of claim 1 , wherein to determine based at least in part on the routing metrics, the optimal route for the traffic in the VPN includes to determine a route in the local network for a third VPN connection for transmitting traffic between the first client device and the second client device wherein the third VPN connection avoids the VPN server.

6. The method of claim 5 , further comprising:

transmitting, to the second client device, first VPN credentials of the first client device; and

transmitting, to the first client device, second VPN credentials of the second client device; and

wherein the third VPN connection is to be established based on the first VPN credentials and the second VPN credentials.

7. The method of claim 6 , wherein the first VPN credentials include first cryptographic credentials allowing secure communication through the first VPN connection and the second VPN credentials include second cryptographic credentials allowing secure communication through the second VPN connection, and the transmitting of the first VPN credentials and the second VPN credentials allow for communication through the third VPN connection to be cryptographically secured based on the first cryptographic credentials and the second cryptographic credentials.

8. A virtual private network (VPN) server for traffic optimization in a virtual private network (VPN), the VPN server comprising:

one or more processors; and

a non-transitory computer readable storage medium that stores code, which when executed by the one or more processors causes the VPN server to perform the following operations:

establishing a first VPN connection with a first client device, wherein the VPN server is remote from the first client device;

establishing a second VPN connection with a second client device, wherein the VPN server is remote from the second client device;

receiving, through the first VPN connection, traffic from the first client device that is destined to the second client device;

transmitting the traffic to the second client device through the second VPN connection;

determining, by the VPN server, that the first client device and the second client device are part of a same local network; and

responsive to determining that the first client device and the second client device are part of the same local network, performing the following:

transmitting, to the first client device and through the first VPN connection, a second public network address of the second client device,

transmitting, to the first client device, routing metrics related to the traffic transmitted through the first VPN connection and the second VPN connection,

transmitting, to the second client device and through the second VPN connection, a first public network address of the first client device, and

wherein transmitting the first public network address and the second public network address causes the first client device to determine, based at least in part on the routing metrics, an optimal route from the first client device to the second client device for the traffic in the VPN.

9. The VPN server of claim 8 , wherein the operations further comprise:

receiving from the first client device a first local network address identifying the first client device in the local network;

receiving from the second client device a second local network address identifying the second client device in the local network; and

wherein determining that the first client device and the second client device are in the same local network is performed based on the first local network address and the second local network address.

10. The VPN server of claim 8 , wherein the operations further comprise:

receiving from the first client device a first set of one or more local network addresses identifying a first set of one or more client devices located in the local network that the first client device desires to communicate with in the VPN;

receiving from the second client device a second set of one or more local network addresses identifying a second set of one or more client devices located in the local network that the second client device desires to communicate with in the VPN; and

wherein determining that the first client device and the second client device are part of the same local network is performed based on the first set of local network addresses and the second set of local network addresses.

11. The VPN server of claim 8 , wherein the routing metrics include for each one of the first VPN connection and the second VPN connection one or more of a measure of link utilization, an indication of a number of hops, a measure of speed, a measure of packet loss, a measure of latency, a measure of path reliability, a measure of path bandwidth, and a measure of throughput.

12. The VPN server of claim 8 , wherein to determine based at least in part on the routing metrics, the optimal route for the traffic in the VPN includes to determine a route in the local network for a third VPN connection for transmitting traffic between the first client device and the second client device wherein the third VPN connection avoids the VPN server.

13. The VPN server of claim 12 , wherein the operations further comprise:

transmitting, to the second client device, first VPN credentials of the first client device; and

transmitting, to the first client device, second VPN credentials of the second client device; and

wherein the third VPN connection is to be established based on the first VPN credentials and the second VPN credentials.

14. The VPN server of claim 13 , wherein the first VPN credentials include first cryptographic credentials allowing secure communication through the first VPN connection and the second VPN credentials include second cryptographic credentials allowing secure communication through the second VPN connection, and the transmitting of the first VPN credentials and the second VPN credentials allow for communication through the third VPN connection to be cryptographically secured based on the first cryptographic credentials and the second cryptographic credentials.

15. A non-transitory computer readable storage medium that stores instructions which when executed by one or more processors of a Virtual Private Network (VPN) server cause said processors to perform the following operations for traffic optimization in a VPN, the operations comprising:

establishing a first VPN connection with a first client device, wherein the VPN server is remote from the first client device;

establishing a second VPN connection with a second client device, wherein the VPN server is remote from the second client device;

receiving, through the first VPN connection, traffic from the first client device that is destined to the second client device;

transmitting the traffic to the second client device through the second VPN connection;

determining, by the VPN server, that the first client device and the second client device are part of a same local network; and

responsive to determining that the first client device and the second client device are part of the same local network, performing the following:

transmitting, to the first client device and through the first VPN connection, a second public network address of the second client device,

transmitting, to the first client device, routing metrics related to the traffic transmitted through the first VPN connection and the second VPN connection,

transmitting, to the second client device and through the second VPN connection, a first public network address of the first client device, and

wherein transmitting the first public network address and the second public network address causes the first client device to determine, based at least in part on the routing metrics, an optimal route from the first client device to the second client device for the traffic in the VPN.

16. The non-transitory computer readable storage medium of claim 15 , wherein the operations further comprise:

receiving from the first client device a first local network address identifying the first client device in the local network;

receiving from the second client device a second local network address identifying the second client device in the local network; and

wherein determining that the first client device and the second client device are in the same local network is performed based on the first local network address and the second local network address.

17. The non-transitory computer readable storage medium of claim 15 , wherein the operations further comprise:

receiving from the first client device a first set of one or more local network addresses identifying a first set of one or more client devices located in the local network that the first client device desires to communicate with in the VPN;

receiving from the second client device a second set of one or more local network addresses identifying a second set of one or more client devices located in the local network that the second client device desires to communicate with in the VPN; and

wherein determining that the first client device and the second client device are part of the same local network is performed based on the first set of local network addresses and the second set of local network addresses.

18. The non-transitory computer readable storage medium of claim 15 , wherein the routing metrics include for each one of the first VPN connection and the second VPN connection one or more of a measure of link utilization, an indication of a number of hops, a measure of speed, a measure of packet loss, a measure of latency, a measure of path reliability, a measure of path bandwidth, and a measure of throughput.

19. The non-transitory computer readable storage medium of claim 15 , wherein to determine based at least in part on the routing metrics, the optimal route for the traffic in the VPN includes to determine a route in the local network for a third VPN connection for transmitting traffic between the first client device and the second client device wherein the third VPN connection avoids the VPN server.

20. The non-transitory computer readable storage medium of claim 19 , wherein the operations further comprise:

transmitting, to the second client device, first VPN credentials of the first client device; and

transmitting, to the first client device, second VPN credentials of the second client device; and

wherein the third VPN connection is to be established based on the first VPN credentials and the second VPN credentials.

21. The non-transitory computer readable storage medium of claim 20 , wherein the first VPN credentials include first cryptographic credentials allowing secure communication through the first VPN connection and the second VPN credentials include second cryptographic credentials allowing secure communication through the second VPN connection, and the transmitting of the first VPN credentials and the second VPN credentials allow for communication through the third VPN connection to be cryptographically secured based on the first cryptographic credentials and the second cryptographic credentials.