Method and systems for securing remote access to private networks
A method for securing remote access to private networks includes a receiver intercepting from a data link layer a packet in a first plurality of packets destined for a first system on a private network. A filter intercepts from the data link layer a packet in a second plurality of packets transmitted from a second system on the private network, destined for an system on a second network. A transmitter in communication with the receiver and the filter performing a network address translation on at least one intercepted packet and transmitting the at least one intercepted packet to a destination.
1. A method of accessing a server via an intermediary device between a client in a first network and the server in a second network, the method comprising:
(a) establishing a secure application layer tunnel over a first transport layer connection between a client application executing on a client on a first network and a device intermediary between a server of a second network and the client, the device having a second transport layer connection between the device and the server;
(b) receiving, by the device from the client application via the secure application layer tunnel, a request of an application of the client to access the server, the client application receiving the request intercepted from a third transport layer connection of the application by a driver of the client,
(c) forwarding, by the device via the second transport layer connection, the request to the server; and
(d) intercepting, by the device at a data link layer of the device, a response to the request transmitted from the server to the client.
2. The method of claim 1 , wherein step (a) further comprises establishing the secure application layer tunnel comprising one of a secure socket layer (SSL) session or a Secure HypterText Transfer Protocol (HTTPS) session.
3. The method of claim 1 , wherein step (b) further comprises terminating, by the driver, the third transport layer connection of the application, the application transmitting requests to the server via the third transport layer connection.
4. The method of claim 1 , wherein step (a) further comprising transmitting, by the device to the client responsive to a communication of the client to the device, a remote process comprising the client application and the driver, the client automatically installing the client application and the driver of the remote process upon receipt.
5. The method of claim 1 , wherein step (b) further comprising receiving, by the client application, the request from the driver via a port of the client monitored by the client application.
6. The method of claim 1 , wherein step (b) further comprises intercepting, by the driver at a data link layer of the client, network traffic of the application destined for the server and forwards the intercepted network traffic to the client application.
7. The method of claim 1 , wherein step (c) further comprises performing, by the device, network address translation of a public internet protocol address of the request to a private internet protocol address of the client established by the device.
8. The method of claim 1 , wherein step (d) further comprises performing, by the device, network address translation of a private internet protocol address of the response to a public internet protocol address of the client.
9. The method of claim 1 , wherein step (d) further comprises intercepting, by a second driver of the device, the response and providing the response to a policy engine executing at an application layer of the device for applying one or more policies to the response before transmitting the response to the client.
10. The method of claim 9 , further comprising transmitting, by the device, responsive to the policy engine, the response to the client application via the secure application layer tunnel.
11. A system of accessing a server via an intermediary device between a client in a first network and the server in a second network, the system comprising:
a client application executing on a client on a first network;
a device intermediary between a server of a second network and the client
a secure application layer tunnel established over a first transport layer connection between the client and the device, the device having a second transport layer connection between the device and the server;
wherein the device receives from the client application via the secure application layer tunnel a request of an application of the client to access the server, the client application receiving the request intercepted from a third transport layer connection of the application by a driver of the client, and forwards the request to the server via the second transport layer connection; and
wherein the device intercepts, at a data link layer of the device, a response to the request transmitted from the server to the client.
12. The system of claim 11 , wherein the secure application layer tunnel comprises one of a secure socket layer (SSL) session or a Secure HypterText Transfer Protocol (HTTPS) session.
13. The system of claim 11 , wherein the driver of the client terminates the third transport layer connection of the application, the application transmitting requests to the server via the third transport layer connection.
14. The system of claim 11 , wherein the device transmits to the client, responsive to a communication of the client to the device, a remote process comprising the client application and the driver, the client automatically installing the client application and the driver of the remote process upon receipt.
15. The system of claim 11 , wherein the client application receives the request from the driver via a port of the client monitored by the client application.
16. The system of claim 11 , wherein the driver intercepts at a data link layer of the client network traffic of the application destined for the server and forwards the intercepted network traffic to the client application.
17. The system of claim 11 , wherein the device performs network address translation of a public internet protocol address of the request to a private internet protocol address of the client established by the device.
18. The system of claim 11 , wherein the device performs network address translation of a private internet protocol address of the response to a public internet protocol address of the client.
19. The system of claim 11 , wherein a second driver of the device intercepts the response and provides the response to a policy engine executing at an application layer of the device for applying one or more policies to the response before transmitting the response to the client.
20. The system of claim 19 , wherein the device, responsive to the policy engine, transmits the response to the client application via the secure application layer tunnel.