Anonymizing server-side addresses
Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a virtual IP (VIP) address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a virtual network of VIP addresses. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.
1. A system associated with a Domain Name System (DNS) service that anonymizes Internet Protocol (IP) addresses of endpoints using groups of virtual IP (VIP) addresses, the system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
mapping an IP address of an endpoint to a group of VIP addresses;
receiving a DNS request to resolve a domain name on behalf of a client device;
converting the domain name into the IP address of the endpoint;
selecting a first VIP address from the group of VIP addresses to provide to the client device; and
providing the first VIP address for use by the client device to contact the endpoint.
2. The system of claim 1 , the operations further comprising:
mapping the first VIP address to a first client identifier (ID) associated with the client device;
receiving another DNS request to resolve the domain name for another client device;
selecting a second VIP address from the group of VIP addresses to provide to the other client device;
providing the second VIP address for use by the other client device to contact the endpoint; and
mapping the second VIP address to a second client ID associated with the other client device.
3. The system of claim 1 , the operations further comprising:
receiving a packet having a destination address that is the first VIP address;
determining that a source address of the packet is a source IP address of the client device sent the packet;
performing Network Address Translation (NAT) by changing the destination address of the packet from the first VIP address to the IP address of the endpoint; and
sending the packet to a next hop associated with the IP address of the endpoint.
4. The system of claim 3 , the operations further comprising, prior to sending the packet:
performing NAT by changing the source address of the packet from the source IP address to a particular system VIP address associated with the system; and
mapping the particular system VIP address to the source IP address of the client device.
5. The system of claim 4 , the operations further comprising:
receiving a return packet from the endpoint;
determining that a destination address of the return packet is the particular system VIP address;
based at least in part on the mapping of the particular system VIP address to the source IP address, performing NAT by changing the destination address of the return packet from the particular system IP address to the source IP address; and
sending the return packet to the client device.
6. The system of claim 1 , the operations further comprising:
receiving a packet from a source device;
determining that a destination address of the packet is the first VIP address;
determining that the source device is not the client device to which the first VIP address was provided; and
dropping the packet.
7. The system of claim 1 , the operations further comprising:
receiving a packet from a source device;
determining that a destination address of the packet is the first VIP address;
determining that the source device is the client device to which the first VIP address was provided; and
forwarding the packet to a next hop associated with the endpoint.
8. The system of claim 1 , wherein the system includes a Network Address Translation (NAT) service and the DNS service.
9. A method performed at least partly by a computing system associated with a Domain Name System (DNS) service that anonymizes Internet Protocol (IP) addresses of endpoints using groups of virtual IP (VIP) addresses, the method comprising:
mapping an IP address of an endpoint to a group of VIP addresses;
receiving a DNS request to resolve a domain name on behalf of a client device;
converting the domain name into the IP address of the endpoint;
selecting a first VIP address from the group of VIP addresses to provide to the client device; and
providing the first VIP address for use by the client device to contact the endpoint.
10. The method of claim 9 , further comprising:
mapping the first VIP address to a first client identifier (ID) associated with the client device;
receiving another DNS request to resolve the domain name for another client device;
selecting a second VIP address from the group of VIP addresses to provide to the other client device;
providing the second VIP address for use by the other client device to contact the endpoint; and
mapping the second VIP address to a second client ID associated with the other client device.
11. The method of claim 9 , further comprising:
receiving a packet having a destination address that is the first VIP address;
determining that a source address of the packet is a source IP address of the client device sent the packet;
performing Network Address Translation (NAT) by changing the destination address of the packet from the first VIP address to the IP address of the endpoint; and
sending the packet to a next hop associated with the IP address of the endpoint.
12. The method of claim 11 , further comprising, prior to sending the packet:
performing NAT by changing the source address of the packet from the source IP address to a particular system VIP address associated with the computing system; and
mapping the particular system VIP address to the source IP address of the client device.
13. The method of claim 12 , further comprising:
receiving a return packet from the endpoint;
determining that a destination address of the return packet is the particular system VIP address;
based at least in part on the mapping of the particular system VIP address to the source IP address, performing NAT by changing the destination address of the return packet from the particular system VIP address to the source IP address; and
sending the return packet to the client device.
14. The method of claim 9 , further comprising:
receiving a packet from a source device;
determining that a destination address of the packet is the first VIP address;
determining that the source device is not the client device to which the first VIP address was provided; and
dropping the packet.
15. The method of claim 9 , further comprising:
receiving a packet from a source device;
determining that a destination address of the packet is the first VIP address;
determining that the source device is the client device to which the first VIP address was provided; and
forwarding the packet to a next hop associated with the endpoint.
16. The method of claim 9 , wherein the computing system includes a Network Address Translation (NAT) service and the DNS service.
17. One or more non-transitory computer-readable media storing computer executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
mapping an Internet Protocol (IP) address of an endpoint to a group of virtual IP (VIP) addresses;
determining that a client device requested the IP address of the endpoint;
selecting a first VIP address from the group of VIP addresses to provide to the client device;
storing a first association between a client identifier (ID) of the client device and the first VIP address;
providing the first VIP address for use by the client device to contact the endpoint;
receiving a first packet having a destination address that is the first VIP address; and
in response to determining that the first packet was sent from the client device, sending the first packet to the endpoint, otherwise dropping the first packet.
18. The one or more non-transitory computer-readable media of claim 17 , in response to determining that the first packet was sent from the client device, the operations further comprising:
performing Network Address Translation (NAT) by changing the destination address of the first packet from the first VIP address to the IP address of the endpoint.
19. The one or more non-transitory computer-readable media of claim 18 , the operations further comprising:
performing NAT by changing a source address of the first packet from a source IP address of the client device to a particular VIP address associated with the one or more non-transitory computer-readable media; and
mapping the particular VIP address to the source IP address of the client device.
20. The one or more non-transitory computer-readable media of claim 19 , the operations further comprising:
receiving a second packet sent from the endpoint;
determining that a destination address of the second packet is the particular VIP address;
based at least in part on the mapping of the particular VIP address to the source IP address, performing NAT by changing the destination address of the second packet from the particular VIP address to the source IP address; and
sending the second packet to the client device.