Multi-cloud network traffic filtering service
In one embodiment, a computing platform featuring a controller and a first virtual private cloud network, which is communicatively coupled to the controller. The first virtual private cloud network includes at least a first gateway including egress filtering logic. The egress filtering logic is configured to (i) filter messages routed from the first gateway in accordance with a first set of filtering rules maintained by the first gateway and (ii) bypass the filtering of messages directed to or originating from one or more subnetworks in accordance with the first set of filtering rules.
1 . A computing platform, comprising:
a controller;
a first virtual private cloud network communicatively coupled to the controller, the first virtual private cloud network includes at least a first gateway including egress filtering logic that conducts Fully Qualified Domain Name (FQDN) filtering that either (i) permits messages with selected destination host names identified in a first set of filtering rules of the first gateway to pass or (ii) precludes messages with a second plurality of destination host names from being output from the gateway and permitting all other messages with destination host names other than the second plurality of destination host names to pass, and
wherein, responsive to the FQDN filtering, the controller is configured to display egress security results associated with the FQDN filtering by the first gateway on a dashboard.
2 . The computing platform of claim 1 , operating as a multi-cloud computing platform that comprises the first virtual private cloud network being deployed within a first public cloud network and the second virtual private cloud network being deployed within a second public cloud network that is different from the first public cloud network.
3 . The computing platform of claim 1 , wherein the controller is configured with access to one or more routing data stores including the first set of filtering rules being used by the egress filtering logic.
4 . The computing platform of claim 1 , further comprising a second virtual private cloud network communicatively coupled to the controller, the second virtual private cloud network comprising a second gateway that include egress filtering logic that conducts Fully Qualified Domain Name (FQDN) filtering that either (i) permits messages with selected destination host names identified in a second set of filtering rules of the second gateway to pass or (ii) precludes messages with a third plurality of destination host names from being output from the gateway and permitting all other messages with destination host names other than the third plurality of destination host names to pass.
5 . The computing platform of claim 4 , wherein the first virtual private cloud network corresponds to a transit virtual private cloud network and the second virtual private cloud network corresponds to a spoke virtual private cloud network to provide a layered, successive egress filtering of a message from a source cloud software instance within a first subnetwork of one or more selected subnetworks to a destination cloud software instance.
6 . A non-transitory storage medium configured to store at least a first gateway that provides communicative coupling between a source and a destination over one or more private cloud networks, the first gateway comprising:
a first set of filtering rules for a first private cloud network and a second set of filtering rules for a second private cloud network included as part of a data store;
egress filtering logic that conducts Fully Qualified Domain Name (FQDN) filtering that either (i) permits messages with selected destination host names identified in a first set of filtering rules of the first gateway to pass or (ii) precludes messages with a second plurality of destination host names from being output from the gateway and permitting all other messages with destination host names other than the second plurality of destination host names to pass, and
wherein, responsive to the FQDN filtering, a controller of the first gateway is configured to display egress security results associated with the FQDN filtering by the first gateway on a dashboard.
7 . The non-transitory storage medium of claim 6 , wherein the egress filtering logic is further configured to determine whether the message is directed to or originated from a first subnetwork, and upon determining that the message is directed to or originated from the first subnetwork, bypassing the filtering of the message.
8 . The non-transitory storage medium of claim 6 , wherein the gateway is software communicatively coupled to a controller configured with access to modify the first set of filtering rules being used by the egress filtering logic.
9 . A computerized method for filtering network traffic within a multi-cloud network, comprising:
determining whether an incoming message is sourced by a software instance located within a first subnetwork or a second subnetwork,
responsive to determining that the incoming message is sourced by a software instance outside of the first subnetwork, filtering the incoming message routed from a first gateway in accordance with a first set of filtering rules maintained by the first gateway;
responsive to determining that the incoming message is sourced by a software instance outside of the second subnetwork, filtering the incoming message routed from a second gateway in accordance with a second set of filtering rules maintained by the second gateway; and
responsive to determining that the incoming message is sourced by the software instance located within the first subnetwork, bypassing the filtering of the incoming message,
wherein egress filtering logic conducts Fully Qualified Domain Name (FQDN) filtering that either (i) permits messages with selected destination host names identified in the first set of filtering rules to pass or (ii) precludes messages with a second plurality of destination host names from being output from the gateway and permitting all other messages with destination host names other than the second plurality of destination host names to pass, and
responsive to the FQDN filtering, displaying on a dashboard egress security results associated with the FQDN filtering.
10 . The computerized method of claim 9 , wherein the software instance comprises a cloud software instance.