Fully qualified domain name-based traffic control for virtual private network access control
A system includes a virtual private network (VPN) gateway and a client device. The VPN gateway receives a domain name system response through a physical coding sublayer. The VPN gateway fetches a fully qualified domain name corresponding to the domain name system response, and fetches one or more access control list rules from an access control list table for a specific user account. The VPN gateway installs an Internet protocol (IP) address in the access control list table for each access control list rule and handles requested data traffic to the IP address. The client device creates a virtual tunnel interface route with a port of a transmission control protocol (TCP) listener device and parses the domain name system response. The client device updates a domain name system cache with the fully qualified domain name and the IP address and sends unencrypted network traffic over the virtual tunnel interface route.
1. A system for controlling network traffic, the system comprising:
an access control table including a list of entries, wherein each entry includes a fully qualified domain name (FQDN), one or more IP addresses corresponding with each FQDN, and permissions and policies associated with the FQDN;
a mobile computing device, including at least one processor and a memory configured to execute a user application and a virtual private network (VPN) handler on the mobile computing device, wherein:
the user application is configured to establish a communications session with a transmission control protocol (TCP) listener device; and
the VPN handler is configured to:
split TCP network traffic and user datagram protocol (UDP) network traffic exiting the mobile computing device between a VPN tunnel and an external socket;
route the TCP network traffic either over the VPN tunnel or over the external socket in response to:
obtaining a FQDN corresponding with an IP address synchronization (SYN) packet used to initiate the communication session; and
determining whether the FQDN is associated with a public or a private network;
identify entries of the access control table that lack the permissions and policies associated with the FQDN;
send the entries to a VPN gateway through which the mobile computing device establishes the VPN tunnel; and
receive new entries the VPN gateway returns that include the permissions and policies associated with the FQDN for updating the identified entries.
2. The system of claim 1 , wherein the VPN handler encrypts and routes the TCP network traffic over the VPN tunnel in response to determining that the FQDN is associated with a private network.
3. The system of claim 1 , wherein the VPN handler routes an unencrypted version of the TCP network traffic over the external socket in response to determining that the FQDN is associated with a public network.
4. The system of claim 1 , wherein the VPN handler:
extracts information from the UDP network traffic including an IP address, a source port, and a destination port,
encrypts and routes the UDP network traffic over the VPN tunnel in response to determining that any of the extracted information is associated with a private network, and
routes an unencrypted version of the UDP network traffic over the external socket in response to determining that any of the extracted information is associated with a public network.
5. The system of claim 1 , further comprising the VPN gateway through which the mobile computing device establishes the VPN tunnel, wherein the access control table is stored on the VPN gateway.
6. The system of claim 1 , wherein the access control table is stored within the mobile computing device.
7. The system of claim 1 , wherein the VPN handler:
determines whether to route the TCP network traffic either over the VPN tunnel or over the external socket by matching an IP address of the SYN packet associated with the TCP network traffic to the entries in the access control table, and
processes data packets of the TCP network traffic according to the permissions and policies of the matched entries.
8. The system of claim 1 , wherein the VPN handler:
determines whether to route the UDP network traffic either over the VPN tunnel or over the external socket by matching any of a source port, a destination port, or an IP address of the UDP network traffic to the entries in the access control table, and
processes data packets of the UDP network traffic according to the permissions and policies of the matched entries.
9. The system of claim 1 , further comprising a domain name service (DNS) cache that maps IP addresses to FQDNs, wherein the VPN handler:
obtains the FQDNs corresponding to the IP addresses using the DNS cache; and
populates the FQDNs in the entries of the access control table when the entries are lacking FQDNs corresponding to the IP addresses.
10. The system of claim 9 , wherein the VPN handler:
issues a reverse DNS query to the DNS cache to reverse resolve the IP addresses to the FQDNs when IP addresses associated with the network traffic are known but no entries for the IP addresses exist in the access control table; and
adds entries to the access control table.