Secure private traffic exchange in a unified network service
Traffic is received at an interface of a compute server. Identity information associated with the traffic is determined including an identifier of a customer to which the traffic is attributable. An egress policy configured for the first customer is used to determine whether the traffic is allowed to be transmitted to a destination where that destination is a resource of a second customer. If the traffic is allowed to be transmitted, the traffic and identity information is transmitted over a cross-customer GRE tunnel to a namespace of the second costumer on the compute server. An ingress policy configured for the second customer is used to determine whether the traffic is allowed to be transmitted to the destination, and if it is, then the traffic is transmitted.
1. A method, comprising:
receiving traffic at a traffic interface of a compute server, wherein the traffic interface is one of a Generic Routing Encapsulation (GRE) tunnel interface, an encrypted tunnel interface, a Virtual Private Network (VPN) server interface, and an Internet Protocol Security (IPsec) tunnel interface;
determining identity information associated with the traffic, wherein the identity information includes at least an identifier of a first customer to which the traffic is attributable, the first customer having a first isolated network stack at the compute server;
determining, using one or more egress policies configured for the first customer and the identity information, whether the traffic is allowed to be transmitted to a target destination of the traffic, wherein the target destination of the traffic is a resource of a second customer having a second isolated network stack at the compute server;
responsive to determining that the traffic is allowed to be transmitted to the target destination, transmitting the traffic and the identity information to the second isolated network stack;
receiving the traffic at the second isolated network stack at the compute server;
determining, using one or more ingress policies configured for the second customer and the identity information, whether the traffic is allowed to be transmitted to the target destination of the traffic; and
responsive to determining that the traffic is allowed to be transmitted to the target destination, transmitting the traffic to the target destination.
2. The method of claim 1 , wherein the traffic interface is the VPN server interface, wherein the traffic is received over a VPN tunnel from a VPN client executing on a client device at the VPN server interface, wherein the traffic has a destination IP address that is associated with an IP address of the target destination, wherein the identity information includes information identifying a user of the client device, and wherein determining, using the one or more egress policies configured for the first customer includes determining whether the user is allowed to access the resource of the second customer.
3. The method of claim 1 , wherein the traffic interface is the GRE tunnel interface, wherein the traffic is received over a GRE tunnel from a router of an office network of the first customer, wherein the traffic has a destination IP address that is associated with an IP address of the target destination, wherein the identity information includes information identifying the first customer based on the GRE tunnel being associated with an account of the first customer, and wherein determining, using the one or more egress policies configured for the first customer includes determining whether traffic received over the GRE tunnel from the router of the office network of the first customer is allowed to access the resource of the second customer.
4. The method of claim 3 , wherein the GRE tunnel interface is assigned an IP address that is an anycast IP address that is shared among a plurality of compute servers of a distributed cloud computing network.
5. The method of claim 1 , wherein the traffic interface is the IPsec tunnel interface, wherein the traffic is received over an IPsec tunnel from a router of a private network of the first customer, wherein the traffic has a destination IP address that is associated with an IP address of the target destination, wherein the identity information includes information identifying the first customer based on the IPsec tunnel being associated with an account of the first customer, and wherein determining, using the one or more egress policies configured for the first customer includes determining whether traffic received over the IPSec tunnel from the router of the private network of the first customer is allowed to access the resource of the second customer.
6. The method of claim 5 , wherein the IPsec tunnel interface is assigned an IP address that is an anycast IP address that is shared among a plurality of compute servers of a distributed cloud computing network.
7. The method of claim 1 , wherein the egress policies configured for the first customer and the ingress policies configured for the second customer define users associated with the first customer allowed to access the resource of the second customer.
8. The method of claim 1 , wherein transmitting the traffic to the second isolated network stack comprises:
sending the traffic and the identity information to a routing service;
determining that the target destination is located in the second isolated network stack; and
determining that a tunnel connecting the first isolated network stack and the second network isolated stack is an outgoing traffic interface for sending the traffic to the second isolated network stack.
9. A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause said processor to perform operations including:
receiving traffic at a traffic interface of a compute server, wherein the traffic interface is one of a Generic Routing Encapsulation (GRE) tunnel interface, an encrypted tunnel interface, a Virtual Private Network (VPN) server interface, and an Internet Protocol Security (IPsec) tunnel interface;
determining identity information associated with the traffic, wherein the identity information includes at least an identifier of a first customer to which the traffic is attributable, the first customer having a first isolated network stack at the compute server;
determining, using one or more egress policies configured for the first customer and the identity information, whether the traffic is allowed to be transmitted to a target destination of the traffic, wherein the target destination of the traffic is a resource of a second customer having a second isolated network stack at the compute server;
responsive to determining that the traffic is allowed to be transmitted to the target destination, transmitting the traffic and the identity information to the second isolated network stack;
receiving the traffic at the second isolated network stack at the compute server;
determining, using one or more ingress policies configured for the second customer and the identity information, whether the traffic is allowed to be transmitted to the target destination of the traffic; and
responsive to determining that the traffic is allowed to be transmitted to the target destination, transmitting the traffic to the target destination.
10. The non-transitory machine-readable storage medium of claim 9 , wherein the traffic interface is the VPN server interface, wherein the traffic is received over a VPN tunnel from a VPN client executing on a client device at the VPN server interface, wherein the traffic has a destination IP address that is associated with an IP address of the target destination, wherein the identity information includes information identifying a user of the client device, and wherein determining, using the one or more egress policies configured for the first customer includes determining whether the user is allowed to access the resource of the second customer.
11. The non-transitory machine-readable storage medium of claim 9 , wherein the traffic interface is the GRE tunnel interface, wherein the traffic is received over a GRE tunnel from a router of an office network of the first customer, wherein the traffic has a destination IP address that is associated with an IP address of the target destination, wherein the identity information includes information identifying the first customer based on the GRE tunnel being associated with an account of the first customer, and wherein determining, using the one or more egress policies configured for the first customer includes determining whether traffic received over the GRE tunnel from the router of the office network of the first customer is allowed to access the resource of the second customer.
12. The non-transitory machine-readable storage medium of claim 11 , wherein the GRE tunnel interface is assigned an IP address that is an anycast IP address that is shared among a plurality of compute servers of a distributed cloud computing network.
13. The non-transitory machine-readable storage medium of claim 9 , wherein the traffic interface is the IPsec tunnel interface, wherein the traffic is received over an IPsec tunnel from a router of a private network of the first customer, wherein the traffic has a destination IP address that is associated with an IP address of the target destination, wherein the identity information includes information identifying the first customer based on the IPsec tunnel being associated with an account of the first customer, and wherein determining, using the one or more egress policies configured for the first customer includes determining whether traffic received over the IPSec tunnel from the router of the private network of the first customer is allowed to access the resource of the second customer.
14. The non-transitory machine-readable storage medium of claim 13 , wherein the IPsec tunnel interface is assigned an IP address that is an anycast IP address that is shared among a plurality of compute servers of a distributed cloud computing network.
15. The non-transitory machine-readable storage medium of claim 9 , wherein the egress policies configured for the first customer and the ingress policies configured for the second customer define users associated with the first customer allowed to access the resource of the second customer.
16. The non-transitory machine-readable storage medium of claim 9 , wherein transmitting the traffic to the second isolated network stack comprises:
sending the traffic and the identity information to a routing service;
determining that the target destination is located in the second isolated network stack; and
determining that a tunnel connecting the first isolated network stack and the second network isolated stack is an outgoing traffic interface for sending the traffic to the second isolated network stack.
17. A compute server, comprising:
a processor; and
a non-transitory machine-readable storage medium that provides instructions that, if executed by the processor, will cause the server to perform operations including:
receiving traffic at a traffic interface of the compute server, wherein the traffic interface is one of a Generic Routing Encapsulation (GRE) tunnel interface, an encrypted tunnel interface, a Virtual Private Network (VPN) server interface, and an Internet Protocol Security (IPsec) tunnel interface;
determining identity information associated with the traffic, wherein the identity information includes at least an identifier of a first customer to which the traffic is attributable, the first customer having a first isolated network stack at the compute server;
determining, using one or more egress policies configured for the first customer and the identity information, whether the traffic is allowed to be transmitted to a target destination of the traffic, wherein the target destination of the traffic is a resource of a second customer having a second isolated network stack at the compute server;
responsive to determining that the traffic is allowed to be transmitted to the target destination, transmitting the traffic and the identity information to the second isolated network stack;
receiving the traffic at the second isolated network stack at the compute server;
determining, using one or more ingress policies configured for the second customer and the identity information, whether the traffic is allowed to be transmitted to the target destination of the traffic; and
responsive to determining that the traffic is allowed to be transmitted to the target destination, transmitting the traffic to the target destination.
18. The server of claim 17 , wherein the traffic interface is the VPN server interface, wherein the traffic is received over a VPN tunnel from a VPN client executing on a client device at the VPN server interface, wherein the traffic has a destination IP address that is associated with an IP address of the target destination, wherein the identity information includes information identifying a user of the client device, and wherein determining, using the one or more egress policies configured for the first customer includes determining whether the user is allowed to access the resource of the second customer.
19. The server of claim 17 , wherein the traffic interface is the GRE tunnel interface, wherein the traffic is received over a GRE tunnel from a router of an office network of the first customer, wherein the traffic has a destination IP address that is associated with an IP address of the target destination, wherein the identity information includes information identifying the first customer based on the GRE tunnel being associated with an account of the first customer, and wherein determining, using the one or more egress policies configured for the first customer includes determining whether traffic received over the GRE tunnel from the router of the office network of the first customer is allowed to access the resource of the second customer.
20. The server of claim 19 , wherein the GRE tunnel interface is assigned an IP address that is an anycast IP address that is shared among a plurality of compute servers of a distributed cloud computing network.
21. The server of claim 19 , wherein the traffic interface is the IPsec tunnel interface, wherein the traffic is received over an IPsec tunnel from a router of a private network of the first customer, wherein the traffic has a destination IP address that is associated with an IP address of the target destination, wherein the identity information includes information identifying the first customer based on the IPsec tunnel being associated with an account of the first customer, and wherein determining, using the one or more egress policies configured for the first customer includes determining whether traffic received over the IPSec tunnel from the router of the private network of the first customer is allowed to access the resource of the second customer.
22. The server of claim 21 , wherein the IPsec tunnel interface is assigned an IP address that is an anycast IP address that is shared among a plurality of compute servers of a distributed cloud computing network.
23. The server of claim 21 , wherein the egress policies configured for the first customer and the ingress policies configured for the second customer define users associated with the first customer allowed to access the resource of the second customer.
24. The server of claim 19 , wherein transmitting the traffic to the second isolated network stack comprises:
sending the traffic and the identity information to a routing service;
determining that the target destination is located in the second isolated network stack; and
determining that a tunnel connecting the first isolated network stack and the second network isolated stack is an outgoing traffic interface for sending the traffic to the second isolated network stack.