System and method for client-based traffic control utilizing domain catalog
A system and method for directing network traffic in a client device based on a domain catalog. The method includes generating a virtual network interface having a namespace with a plurality of names, wherein a first name of the namespace is assigned to a client device; assigning a second name of the namespace to a resource accessible to the client device through a zero trust network environment; configuring the client device to communicate only through the virtual network interface; and sending network traffic to the resource, in response to determining that the resource is allowed based on a domain catalog.
1 . A method comprising:
generating a virtual network interface having a namespace comprising a plurality of names, wherein a first name of the namespace is assigned to a client device;
assigning a second name of the namespace to a resource accessible to the client device through a zero trust network environment;
configuring the client device to communicate through the virtual network interface to access the resource;
inspecting network traffic received from the client device through the virtual network interface;
determining a destination of the network traffic; and
sending the network traffic to the destination based on determining that the network traffic is allowable according to a policy of the zero trust network environment, the policy being related to an entry of a domain catalog for the network traffic.
2 . The method of claim 1 , wherein the entry of the domain catalog contains a domain name and an attribute of the domain name, the method comprising:
matching information of the network traffic to the entry in the domain catalog.
3 . The method of claim 2 , comprising:
identifying the policy based on the attribute in the entry matched to the network traffic, wherein the network traffic is allowed or blocked using the policy.
4 . The method of claim 1 , wherein the virtual network interface has a routing table having a first address of the resource that is different from a second address of the resource in a private network, and wherein the virtual network interface exposes the resource through a local network of the virtual network interface, the local network being different from the private network.
5 . The method of claim 1 , wherein the virtual network interface is generated at the client device by agent software provided by a system in the zero trust network environment to the client device.
6 . The method of claim 5 , further comprising:
receiving, at the system, credentials of a user account associated with the client device; and
providing the agent software from the system to the client device based on the system authenticating the credentials.
7 . The method of claim 1 , further comprising:
altering a packet of the network traffic so that a response from the resource is directed to the zero trust network environment instead of the client device.
8 . A non-transitory computer readable medium comprising instructions that upon execution cause a system to:
send, from the system to a client device, agent software that when executed at the client device generates a virtual network interface having a namespace comprising a plurality of names, wherein a first name of the namespace is assigned to the client device, and a second name of the namespace is assigned to a resource accessible to the client device through a zero trust network environment;
receive, at the system from the client device, network traffic sent by the client device to the resource through the virtual network interface;
inspect the network traffic received from the client device;
determine, at the system, a destination of the network traffic; and
send, from the system, the network traffic to the destination based on determining that the network traffic is allowable according to a policy of the zero trust network environment, the policy being related to an entry of a domain catalog for the network traffic.
9 . The non-transitory computer readable medium of claim 8 , wherein the instructions upon execution cause the system to:
receive a credential from the client device;
authenticate the credential; and
send the agent software from the system to the client device based on authenticating the credential.
10 . The non-transitory computer readable medium of claim 8 , wherein the system is part of the zero trust network environment, the resource is part of a private network, and the zero trust network environment is between the client device and the private network.
11 . The non-transitory computer readable medium of claim 10 , wherein the virtual network interface generated at the client device has a routing table having a first address of the resource that is different from a second address of the resource in the private network, and wherein the virtual network interface exposes the resource through a local network of the virtual network interface, the local network being different from the private network.
12 . The non-transitory computer readable medium of claim 8 , wherein the entry of the domain catalog contains a domain name and an attribute of the domain name, and wherein the instructions upon execution cause the system to:
match information of the network traffic to the entry in the domain catalog.
13 . The non-transitory computer readable medium of claim 12 , wherein the instructions upon execution cause the system to:
identify the policy based on the attribute in the entry matched to the network traffic.
14 . A system comprising:
a processor; and
a non-transitory storage medium storing instructions executable on the processor to:
send, from the system to a client device, agent software that when executed at the client device generates a virtual network interface having a namespace comprising a plurality of names, wherein a first name of the namespace is assigned to the client device, and a second name of the namespace is assigned to a resource accessible to the client device through a zero trust network environment;
receive, at the system from the client device, network traffic sent by the client device to the resource through the virtual network interface;
inspect, at the system, the network traffic received from the client device;
determine a destination of the network traffic; and
send, from the system, the network traffic to the destination based on determining that the network traffic is allowable according to a policy of the zero trust network environment, the policy being related to an entry of a domain catalog for the network traffic.
15 . The system of claim 14 , wherein the entry of the domain catalog contains a domain name and an attribute of the domain name, wherein the instructions are executable on the processor to:
match information of the network traffic to the entry in the domain catalog.
16 . The system of claim 15 , wherein the instructions are executable on the processor to:
identify the policy based on the attribute in the entry matched to the network traffic.
17 . The system of claim 14 , wherein the instructions are executable on the processor to:
alter a packet of the network traffic so that a response from the resource is directed to the zero trust network environment instead of the client device.
18 . The system of claim 14 , wherein the instructions are executable on the processor to:
receive a credential from the client device;
authenticate the credential; and
send the agent software from the system to the client device based on authenticating the credential.
19 . The system of claim 14 , wherein the system is part of the zero trust network environment, the resource is part of a private network, and the zero trust network environment is between the client device and the private network.
20 . The system of claim 19 , wherein the virtual network interface generated at the client device has a routing table having a first address of the resource that is different from a second address of the resource in the private network, and wherein the virtual network interface exposes the resource through a local network of the virtual network interface, the local network being different from the private network.