System for scaling network address translation (NAT) and firewall functions
According to one embodiment, a network device may be adapted to operate within a virtual private cloud where network address translation (NAT) is performed through virtual machines and each network address translation is handled differently by a different NAT control logic unit. The network device features one or more hardware processors, and a memory that stores at least a plurality of network address translation (NAT) control logic unit and demultiplexer logic. The demultiplexer logic, when executed, receives an incoming message and, based at least in part on information within the incoming message, determines a selected NAT control logic unit to receive at least a portion of the information within the incoming message. The selected NAT control logic unit handles address translation for routing of a message based on the incoming message to a public network.
1. A network device adapted for operating within a virtual private cloud, comprising:
one or more hardware processors; and
a memory coupled to the one or more hardware processors, the memory stores:
a plurality of network address translation (NAT) control logic units, each NAT control logic unit corresponding to a virtual machine instance, and
a demultiplexer logic configured as an instance of a virtual machine that, when executed by the one or more hardware processors, receives an incoming message comprising a data section and a header section and, based at least in part on the data section and the header section, determines a selected NAT control logic unit to receive at least the data section, the determination comprising using a hash-type function including a Message Digest based hash operation,
wherein the selected NAT control logic unit handles address translation for routing of a message based on the incoming message to a public network.
2. The network device of claim 1 , wherein the hash-type function is conducted on at least a source private Internet Protocol (IP) address or a source port of a header section of the message to produce a result for use in determining the selected NAT control logic unit.
3. The network device of claim 2 , wherein the one or more hash-type functions includes a modulo operation, being conducted on a source private Internet Protocol (IP) address or a source port within the header section of the message.
4. The network device of claim 1 , wherein the message is received from a source deployed within a virtual private cloud network.
5. The network device of claim 1 , wherein a private source address of the translated message includes a public IP address of the selected NAT control logic unit.
6. The network device of claim 1 , wherein a source port of the translated message includes a selected port from one or more ports managed by the selected NAT control logic unit.
7. The network device of claim 1 , wherein the selected NAT control logic unit is configured to, upon receipt of a return message, substitute a destination IP address of the return message with a source IP address of the source contained in the incoming message.
8. The network device of claim 1 , wherein the selected NAT control logic unit is configured to, upon receipt of a return message, substitute a destination port number with a source port number contained in the incoming message.
9. The network device of claim 1 , wherein the header section comprises a source (private) IP address, a source port number, and a destination public IP address.
10. The network device of claim 1 , wherein each NAT control logic unit performs the network address translation by substituting a source (private) IP address within an incoming message with a public IP address of the NAT control logic unit.
11. The network device of claim 1 , wherein each NAT control logic unit performs the network address translation by substituting a source port within the incoming message with a selected port from one or more ports managed by the NAT control logic unit.
12. The network device of claim 1 , wherein the demultiplexer logic comprises a single ingress port and a plurality of egress ports.