Randomizing server-side addresses
Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a random IP address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a random IP address that cannot be used to identify the endpoint device or service. The client device may then communicate data packets to the server using the random IP address as the destination address, and a gateway that works in conjunction with DNS can convert the random IP address to the actual IP address of the server using NAT and forward the data packet onto the server.
1. A method performed at least partly by an agent that communicates with a Domain Name System (DNS) service to anonymize Internet Protocol (IP) addresses of endpoints using random IP addresses, the method comprising:
receiving a DNS request to resolve a domain name on behalf of a client device;
providing the DNS request to a DNS resolver of the DNS service;
receiving, from the DNS service, an indication of an actual IP address that corresponds to the domain name and is usable to communicate with an endpoint;
generating a random IP address by:
populating a first set of bits of the random IP address with a gateway IP address of the gateway; and
populating a second set of bits of the random IP address with randomly generated IP address bits;
creating a mapping between the random IP address to the actual IP address of the endpoint; and
providing the mapping to a gateway that manages connections to the endpoint.
2. The method of claim 1 , further comprising providing the random IP address to at least one of the client device or the DNS service to enable the DNS service to provide the random IP address to the client device.
3. The method of claim 1 , wherein the random IP address is a routable IP address that is routed between the client device and the endpoint.
4. The method of claim 1 , further comprising:
receiving, at the gateway, a packet having a destination address that is the random IP address;
performing, at the gateway, Network Address Translation (NAT) by changing the destination address of the packet from the random IP address to the actual IP address of the endpoint; and
sending the packet to a next hop associated with the actual IP address of the endpoint.
5. The method of claim 4 , further comprising:
receiving a return packet from the endpoint;
determining that a destination address of the return packet is a client IP address of the client device;
performing NAT by changing a source address of the return packet from the actual IP address to the random IP address; and
sending the return packet to the client device.
6. The method of claim 1 , wherein the agent is running on the gateway or another device located in a network in which the endpoint is located.
7. The method of claim 1 , wherein the agent is running on the client device or another device associated with a same local area network (LAN) as the client device.
8. The method of claim 1 , wherein the agent is included in the DNS service.
9. A gateway of a private network that communicates with a Domain Name System (DNS) service to anonymize Internet Protocol (IP) addresses of endpoints using random IP addresses, the gateway comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more gateway to perform operations comprising:
receiving a mapping between an actual IP address of an endpoint and a random IP address of generated for the endpoint;
storing an indication of the mapping;
receiving, from a client device, a request for a connection to a particular endpoint associated with the gateway;
identifying the random IP address from the request;
determining, using the mapping, that the random IP address maps to the actual IP address of the endpoint; and
causing the connection to be established between the client device and the endpoint.
10. The gateway of claim 9 , the operations further comprising:
receiving a packet having a destination address that is the random IP address;
performing Network Address Translation (NAT) by changing the destination address of the packet from the random IP address to the actual IP address of the endpoint; and
sending the packet to a next hop associated with the actual IP address of the endpoint.
11. The gateway of claim 10 , the operations further comprising:
receiving a return packet from the endpoint;
determining that a destination address of the return packet is a client IP address of the client device;
performing NAT by changing a source address of the return packet from the actual IP address to the random IP address; and
sending the return packet to the client device.
12. The gateway of claim 9 , wherein:
a first set of bits of the random IP address is populated with a gateway IP address of the gateway; and
a second set of bits of the random IP address is populated with randomly generated IP address bits.
13. The gateway of claim 9 , wherein the mapping is received from an agent that is in communication with a DNS service.
14. A system that supports an agent that communicates with a Domain Name System (DNS) service to anonymize Internet Protocol (IP) addresses of endpoints using random IP addresses, the system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving a DNS request to resolve a domain name on behalf of a client device;
providing the DNS request to a DNS resolver of the DNS service;
receiving, from the DNS service, an indication of an actual IP address that corresponds to the domain name and is usable to communicate with an endpoint;
generating a random IP address by:
populating a first set of bits of the random IP address with a gateway IP address of the gateway; and
populating a second set of bits of the random IP address with randomly generated IP address bits;
creating a mapping between the random IP address to the actual IP address of the endpoint; and
providing the mapping to a gateway that manages connections to the endpoint.
15. The system of claim 14 , the operations further comprising providing the random IP address to at least one of the client device or the DNS service to enable the DNS service to provide the random IP address to the client device.
16. The system of claim 14 , wherein the random IP address is a routable IP address that is routed between the client device and the endpoint.
17. The system of claim 14 , the operations further comprising:
receiving, at the gateway, a packet having a destination address that is the random IP address;
performing, at the gateway, Network Address Translation (NAT) by changing the destination address of the packet from the random IP address to the actual IP address of the endpoint; and
sending the packet to a next hop associated with the actual IP address of the endpoint.
18. The system of claim 14 , the operations further comprising:
receiving a return packet from the endpoint;
determining that a destination address of the return packet is a client IP address of the client device;
performing NAT by changing a source address of the return packet from the actual IP address to the random IP address; and
sending the return packet to the client device.
19. The system of claim 14 , wherein the agent is running on the gateway or another device located in a network in which the endpoint is located.
20. The system of claim 14 , wherein the agent is running on the client device or another device associated with a same local area network (LAN) as the client device.