Cloud-based multi-function firewall and zero trust private virtual network

A method for providing a cloud-based multi-function firewall, comprising:

• blocking, by a network-enabled device with a security appliance client, one or more network connections provided by the network-enabled device, wherein the one or more network connections include network connections to an external network and to an internal network;
• receiving, from the network-enabled device, device information associated with the network-enabled device and user information associated with the user of the network-enabled device, wherein the device information includes location information of the network-enabled device and the user information includes a user configurable selection policy;
• permitting, by an application program interface (API) server, the network-enabled device to access a plurality of cloud servers within a secure cloud, wherein the plurality of cloud servers are configured to route network traffic among the plurality of cloud servers located in one or more locations;
• selecting, by the API server, a first cloud server from the plurality of cloud servers in the secure cloud based on the user configurable selection policy, the location information of the network-enabled device, and location information of the plurality of cloud servers;
• transmitting cloud information from the first cloud server to the network-enabled device, the cloud information identifying the first cloud server;
• and
• enabling the network-enabled device to establish a virtual private network (VPN) connection to the first cloud server for network services, wherein network traffic to and from the network-enabled device is routed through the VPN connection to the cloud-based multi-function firewall implemented on the first cloud server.

A system for providing a cloud-based multi-function firewall, the system comprising one or more processors, memory, and one or more programs stored in the memory and configured to be executed by the one or more processors, the one or more programs including instructions for:

• blocking, by a network-enabled device with a security appliance client, one or more network connections provided by the network-enabled device, wherein the one or more network connections include network connections to an external network and to an internal network;
• retrieving device information associated with the network-enabled device associated with a user;
• transmitting the user information and the device information from the network-enabled device to an application program interface (API) server in a secure cloud to configure a virtual private network (VPN) connection between the secure cloud and the network-enabled device, wherein the user information includes a user configurable selection policy and the device information includes location information of the network-enabled device;
• permitting, by the API server, the network-enabled device to access a plurality of cloud servers in one or more locations, wherein the plurality of cloud servers are configured to route network traffic among the plurality of cloud servers within the secure cloud;
• selecting, by the API server, a cloud server from the plurality of cloud servers in the secure cloud, wherein the selection is based on the user configurable selection policy, the location information of the network-enabled device, and location information of the plurality of cloud servers;
• receiving cloud information from the API server, the cloud information specifying the selected cloud server in the secure cloud;
• updating domain name service (DNS) and routing functions at the network-enabled device to forward network requests to the selected cloud server specified in the cloud information;
• and
• establishing the VPN connection to the secure cloud for network services based on the cloud information, wherein network traffic to and from the network-enabled device is routed through the VPN connection to the cloud-based multi-function firewall implemented on the selected cloud server.

A system for providing a cloud-based multi-function firewall, the system comprising a first cloud server in a secure cloud, wherein the first cloud server comprises one or more processors, memory, and one or more programs stored in the memory and configured to be executed by the one or more processors, the one or more programs including instructions for:

• receiving, from a network-enabled device, device information associated with the network-enabled device and user information associated with a user of the network-enabled device, wherein the device information includes location information of the network-enabled device and the user information includes a user configurable selection policy;
• selecting the first cloud server from a plurality of cloud servers in the secure cloud based on the user configurable selection policy, the location information of the network-enabled device, and location information of the plurality of cloud servers;
• transmitting cloud information from the secure cloud to the network-enabled device, the cloud information identifying the first cloud server and being generated by an application program interface (API) server in the secure cloud;
• and
• enabling the network-enabled device to establish a virtual private network (VPN) connection to the first cloud server for network services, wherein network traffic to and from the network-enabled device is routed through the VPN connection to the cloud-based multi-function firewall implemented on the first cloud server.

A non-transitory computer-readable storage medium comprising a security appliance client installed on a network-enabled device to provide a cloud-based multi-function firewall, wherein the security appliance client includes instructions that when executed by the network-enabled device having one or more processors cause the one or more processors to perform instructions comprising:

• blocking, by the security appliance client, one or more network connections provided by the network-enabled device, wherein the one or more network connections include network connections to an external network and to an internal network;
• retrieving device information associated with the network-enabled device associated with a user;
• transmitting the user information and the device information from the network-enabled device to an application program interface (API) server in a secure cloud to configure a virtual private network (VPN) connection between the secure cloud and the network-enabled device, wherein the user information includes a user configurable selection policy and the device information includes location information of the network-enabled device;
• permitting, by the API server, the network-enabled device to access a plurality of cloud servers in one or more locations, wherein the plurality of cloud servers are configured to route network traffic among the plurality of cloud servers within the secure cloud;
• receiving cloud information from the secure cloud, the cloud information specifying a cloud server selected from the plurality of cloud servers in the secure cloud and being generated by the API server in the secure cloud based on the user configurable selection policy, the location information of the network-enabled device, and location information of the plurality of cloud servers;
• updating domain name service (DNS) and routing functions at the network-enabled device to forward network requests to the cloud server specified in the cloud information;
• and
• establishing the VPN connection to the secure cloud for network services based on the cloud information, wherein network traffic to and from the network-enabled device is routed through the VPN connection to the cloud-based multi-function firewall implemented on the cloud server.

A non-transitory computer-readable storage medium comprising instructions for providing a cloud-based multi-function firewall, wherein the instructions, when executed by a first cloud server having one or more processors, cause the one or more processors to perform instructions comprising:

• receiving, from a network-enabled device, device information associated with the network-enabled device and user information associated with a user of the network-enabled device, wherein the device information includes location information of the network-enabled device and the user information includes a user configurable selection policy;
• selecting a first cloud server from a plurality of cloud servers in a secure cloud based on the user configurable selection policy, the location information of the network-enabled device, and location information of the plurality of cloud servers;
• transmitting cloud information from the secure cloud to the network-enabled device, the cloud information identifying the first cloud server and being generated by an application program interface (API) server in the secure cloud;
• and
• enabling the network-enabled device to establish a virtual private network (VPN) connection to the first cloud server for network services, wherein network traffic to and from the network-enabled device is routed through the VPN connection to the cloud-based multi-function firewall implemented on the first cloud server.