Methods and systems for efficient virtualization of inline transparent computer networking devices
Network devices that are inserted inline into network links and process in-transit packets may significantly improve their packet-throughput performance by not assigning L3 IP addresses and L2 MAC addresses to their network interfaces and thereby process packets through a logical fast path that bypasses the slow path through the operating system kernel. When virtualizing such Bump-In-The-Wire (BITW) devices for deployment into clouds, the network interfaces must have L3 IP and L2 MAC addresses assigned to them. Thus, packets are processed through the slow path of a virtual BITW device, significantly reducing the performance. By adding new logic to the virtual BITW device and/or configuring proxies, addresses, subnets, and/or routing tables, a virtual BITW device can process packets through the fast path and potentially improve performance accordingly. For example, the virtual BITW device may be configured to enforce a virtual path (comprising the fast path) through the virtual BITW device.
1. A cloud computing network configured to send packets between a network address translation (NAT) gateway and a second virtual device, via a virtual bump-in-the-wire (BITW) device, the cloud computing network comprising:
one or more processors;
the NAT gateway, wherein the NAT gateway is configured to interface between a public network and the cloud computing network;
the virtual BITW device, comprising:
a first interface having a private Internet Protocol (IP) address in a first subnet;
a second interface having a private IP address in a second subnet; and
a fast path between the first interface and the second interface and configured to apply packet-filtering logic to traffic received by the virtual BITW device; and
the second virtual device,
wherein the NAT gateway is configured to:
receive first packets indicating a public IP address of the second virtual device as a destination IP address;
modify the destination IP address of the first packets to be the private IP address of the first interface of the virtual BITW device; and
send the first packets to the first interface of the virtual BITW device, and
wherein the virtual BITW device is configured to:
receive, via the first interface, the first packets from the NAT gateway;
modify the destination IP address of the first packets to be a private IP address of the second virtual device; and
apply, using the fast path, the packet-filtering logic to the first packets received via the first interface; and
send, based on the packet-filtering logic and via the second interface, at least a portion of the first packets, and
wherein a cloud routing table of the cloud computing network is configured to cause second packets, sent by the second virtual device and destined for a host outside the cloud computing network, to be received by the second interface of the virtual BITW device.
2. The cloud computing network of claim 1 , wherein the first packets indicate a media access control (MAC) address of the NAT gateway as a source MAC address, and indicate a MAC address of the first interface of the virtual BITW device as a destination MAC address, and wherein the virtual BITW device is further configured to:
modify the source MAC address of the at least a portion of the first packets to be a MAC address of the second interface of the virtual BITW device; and
modify the destination MAC address of the at least a portion of the first packets to be a MAC address of the second virtual device.
3. The cloud computing network of claim 1 , wherein:
the second virtual device is configured to send the second packets, wherein the second packets indicate the private IP address of the second virtual device as a source IP address and indicate a public IP address of the host as a destination IP address; and
the virtual BITW device is configured to:
receive, via the second interface, the second packets;
modify the source IP address of the second packets to be the private IP address of the first interface of the virtual BITW device;
apply, using the fast path, the packet-filtering logic to the second packets; and
send, based on the packet-filtering logic and via the first interface, at least a portion of the second packets to the NAT gateway.
4. The cloud computing network of claim 1 , wherein the virtual BITW device is configured to cache 5-tuple values for each of a plurality of packets received by the second interface.
5. The cloud computing network of claim 1 , wherein the first subnet and the second subnet are non-overlapping.
6. The cloud computing network of claim 1 , wherein a virtual path terminal of the NAT gateway and the first interface of the virtual BITW device are exclusively associated with the first subnet, and wherein a virtual path terminal of the second virtual device and the second interface of the virtual BITW device are exclusively associated with the second subnet.
7. The cloud computing network of claim 1 , wherein the packet-filtering logic comprises packet-filtering rules.
8. The cloud computing network of claim 1 , wherein the packet-filtering logic comprises policy enforcement logic.
9. The cloud computing network of claim 1 , wherein:
the second packets sent by the second virtual device indicate a media access control (MAC) address of the second virtual device as a source MAC address and indicate a MAC address of the second interface of the virtual BITW device as a destination MAC address.
10. The cloud computing network of claim 9 , wherein the virtual BITW device is configured to:
modify the source MAC address of the at least a portion of the second packets to be the MAC address of the first interface of the virtual BITW device; and
modify the destination MAC address of the at least a portion of the second packets to be a MAC address of the NAT gateway.
11. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a cloud computing network, cause the cloud computing network to send packets between a network address translation (NAT) gateway and a second virtual device, via a virtual bump-in-the-wire (BITW) device, by:
receiving, by the NAT gateway, first packets indicating a public IP address of the second virtual device as a destination IP address, wherein the NAT gateway is configured to interface between a public network and the cloud computing network;
modifying, by the NAT gateway, the destination IP address of the first packets to be a private IP address of a first interface of the virtual BITW device, wherein the private IP address of the first interface is in a first subnet;
sending, by the NAT gateway, the first packets to the first interface of the virtual BITW device;
receiving, via the first interface, the first packets from the NAT gateway;
applying, using a fast path of the virtual BITW device, packet-filtering logic to the first packets received via the first interface;
modifying the destination IP address of the first packets to be a private IP address of the second virtual device; and
sending, by the virtual BITW, based on the packet-filtering logic, and via a second interface having a private IP address in a second subnet, at least a portion of the first packets,
wherein a cloud routing table of the cloud computing network is configured to cause second packets, sent by the second virtual device and destined for a host outside the cloud computing network, to be received by the second interface of the virtual BITW device.
12. The non-transitory computer-readable medium of claim 11 , wherein the first packets indicate a media access control (MAC) address of the NAT gateway as a source MAC address, and indicate a MAC address of the first interface of the virtual BITW device as a destination MAC address, and wherein the instructions, when executed by the one or more processors, cause the virtual BITW device to further:
modify the source MAC address of the at least a portion of the first packets to be a MAC address of the second interface of the virtual BITW device; and
modify the destination MAC address of the at least a portion of the first packets to be a MAC address of the second virtual device.
13. The non-transitory computer-readable medium of claim 11 , wherein:
the instructions, when executed by the one or more processors, cause the second virtual device to send the second packets, wherein the second packets indicate the private IP address of the second virtual device as a source IP address and indicate a public IP address of the host as a destination IP address; and
the instructions, when executed by the one or more processors, cause the virtual BITW device to:
receive, via the second interface, the second packets;
modify the source IP address of the second packets to be the private IP address of the first interface of the virtual BITW device;
apply, using the fast path, the packet-filtering logic to the second packets; and
send, based on the packet-filtering logic and via the first interface, at least a portion of the second packets to the NAT gateway.
14. The non-transitory computer-readable medium of claim 11 , wherein the instructions, when executed by the one or more processors, cause the virtual BITW device to cache 5-tuple values for each of a plurality of packets received by the second interface.
15. The non-transitory computer-readable medium of claim 11 , wherein the first subnet and the second subnet are non-overlapping.
16. The non-transitory computer-readable medium of claim 11 , wherein a virtual path terminal of the NAT gateway and the first interface of the virtual BITW device are exclusively associated with the first subnet, and wherein a virtual path terminal of the second virtual device and the second interface of the virtual BITW device are exclusively associated with the second subnet.
17. The non-transitory computer-readable medium of claim 11 , wherein the packet-filtering logic comprises packet-filtering rules.
18. The non-transitory computer-readable medium of claim 11 , wherein the packet-filtering logic comprises policy enforcement logic.
19. The non-transitory computer-readable medium of claim 11 , wherein:
the second packets sent by the second virtual device indicate a media access control (MAC) MAC address of the second virtual device as a source MAC address and indicate a MAC address of the second interface of the virtual BITW device as a destination MAC address.
20. The non-transitory computer-readable medium of claim 19 , wherein the instructions, when executed by the one or more processors, cause the virtual BITW device to:
modify the source MAC address of the at least a portion of the second packets to be the MAC address of the first interface of the virtual BITW device; and
modify the destination MAC address of the at least a portion of the second packets to be a MAC address of the NAT gateway.
21. A method comprising:
deploying a virtual bump-in-the wire (BITW) device in a virtual private cloud network, wherein the virtual BITW device comprises:
a first interface having a private Internet Protocol (IP) address in a first subnet;
a second interface having a private IP address in a second subnet; and
a fast path between the first interface and the second interface and configured to apply packet-filtering logic to traffic received by the virtual BITW device;
configuring a network address translation (NAT) gateway, that interfaces between a public network and the virtual private cloud network, to modify a destination IP address of first packets destined for a second virtual device by configuring the NAT gateway to translate a public IP address of the second virtual device to the private IP address of the first interface of the virtual BITW device;
configuring the virtual BITW device to send, via the fast path and based on the packet-filtering logic, at least a portion of the first packets received via the first interface, to the second virtual device by configuring the virtual BITW device to modify destination IP addresses of packets received by the first interface to be the private IP address of the second virtual device; and
configuring a cloud routing table of the cloud computing network to cause second packets, sent by the second virtual device and destined for a host outside the cloud computing network, to be received by the second interface of the virtual BITW device.
22. The method of claim 21 , wherein the first packets indicate a media access control (MAC) address of the NAT gateway as a source MAC address, and indicate a MAC address of the first interface of the virtual BITW device as a destination MAC address, and wherein the configuring the virtual BITW device to send the at least a portion of the first packets received via the first interface further comprises configuring the virtual BITW device to:
modify the source MAC address of the at least a portion of the first packets to be a MAC address of the second interface of the virtual BITW device; and
modify the destination MAC address of the at least a portion of the first packets to be a MAC address of the second virtual device.
23. The method of claim 21 , wherein the second packets indicate the private IP address of the second virtual device as a source IP address and indicate a public IP address of the host as a destination IP address, the method further comprising configuring the virtual BITW device to send at least a portion of the second packets received via the second interface by configuring the virtual BITW device to:
modify the source IP address of the second packets to be the private IP address of the first interface of the virtual BITW device;
apply, using the fast path, the packet-filtering logic to the second packets; and
send, via the first interface of the virtual BITW device, at least a portion of the second packets to the NAT gateway.
24. The method claim 21 , further comprising configuring the virtual BITW device to cache 5-tuple values for each of a plurality of packets received by the second interface.
25. The method claim 21 , wherein the first subnet and the second subnet are non-overlapping.
26. The method claim 21 , wherein a virtual path terminal of the NAT gateway and the first interface of the virtual BITW device are exclusively associated with the first subnet, and wherein a virtual path terminal of the second virtual device and the second interface of the virtual BITW device are exclusively associated with the second subnet.
27. The method claim 21 , wherein the packet-filtering logic comprises packet-filtering rules.
28. The method claim 21 , wherein the packet-filtering logic comprises policy enforcement logic.
29. The method claim 21 , wherein:
the second packets sent by the second virtual device indicate a media access control (MAC) address of the second virtual device as a source MAC address and indicate a MAC address of the second interface of the virtual BITW device as a destination MAC address.
30. The method claim 29 , further comprising configuring the virtual BITW device to:
modify the source MAC address of the at least a portion of the second packets to be the MAC address of the first interface of the virtual BITW device; and
modify the destination MAC address of the at least a portion of the second packets to be a MAC address of the NAT gateway.
31. A method for sending packets in a virtual private cloud network between a network address translation (NAT) gateway and a second virtual device, via a virtual bump-in-the-wire (BITW) device, the method comprising:
receiving, by the NAT gateway, first packets indicating a public IP address of the second virtual device as a destination IP address, wherein the NAT gateway is configured to interface between a public network and the virtual private cloud;
modifying, by the NAT gateway, the destination IP address of the first packets to be a first private IP address of a first interface of the virtual BITW device, wherein the private IP address of the first interface is in a first subnet;
sending, by the NAT gateway, the first packets to the first interface of the virtual BITW device;
receiving, via the first interface, the first packets from the NAT gateway;
applying, using a fast path of the virtual BITW device, packet-filtering logic to the first packets received via the first interface;
modifying the destination IP address of the first packets to be a private IP address of the second virtual device; and
sending, by the virtual BITW, based on the packet-filtering logic, and via a second interface having a private IP address in a second subnet, at least a portion of the first packets,
wherein a cloud routing table of the cloud computing network is configured to cause second packets, sent by the second virtual device and destined for a host outside the cloud computing network, to be received by the second interface of the virtual BITW device.
32. The method of claim 31 , wherein the first packets indicate a media access control (MAC) address of the NAT gateway as a source MAC address, and indicate a MAC address of the first interface of the virtual BITW device as a destination MAC address, and wherein the method further comprises:
modifying, by the virtual BITW device, the source MAC address of the at least a portion of the first packets to be a MAC address of the second interface of the virtual BITW device; and
modifying, by the virtual BITW device, the destination MAC address of the at least a portion of the first packets to be a MAC address of the second virtual device.
33. The method of claim 31 , further comprising:
sending, by the second virtual device, the second packets, wherein the second packets indicate the private IP address of the second virtual device as a source IP address and indicate a public IP address of the host as a destination IP address;
receiving, via the second interface of the virtual BITW device, the second packets;
modifying, by the virtual BITW device, the source IP address of the second packets to be the private IP address of the first interface of the virtual BITW device;
applying, using the fast path, the packet-filtering logic to the second packets; and
sending, via the first interface of the virtual BITW device, at least a portion of the second packets to the NAT gateway.
34. The method claim 31 , wherein the virtual BITW device is configured to cache 5-tuple values for each of a plurality of packets received by the second interface.
35. The method claim 31 , wherein the first subnet and the second subnet are non-overlapping.
36. The method claim 31 , wherein a virtual path terminal of the NAT gateway and the first interface of the virtual BITW device are exclusively associated with the first subnet, and wherein a virtual path terminal of the second virtual device and the second interface of the virtual BITW device are exclusively associated with the second subnet.
37. The method claim 31 , wherein the packet-filtering logic comprises packet-filtering rules.
38. The method claim 31 , wherein the packet-filtering logic comprises policy enforcement logic.
39. The method claim 31 , wherein:
the second packets sent by the second virtual device indicate a media access control (MAC) address of the second virtual device as a source MAC address and indicate a MAC address of the second interface of the virtual BITW device as a destination MAC address.
40. The method claim 39 , wherein the virtual BITW device is configured to:
modify the source MAC address of the at least a portion of the second packets to be the MAC address of the first interface of the virtual BITW device; and
modify the destination MAC address of the at least a portion of the second packets to be a MAC address of the NAT gateway.