# US 11,115,384 B2 · Walled garden system with cleared IPS list automatically generated from DNS queries > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,384 B2 - Document ID: US11115384B2 - Status: Granted - Kind: B2 - Application number: 15/796,382 - Filed: 2017-10-27 - Published: 2018-05-03 - Granted: 2021-09-07 - Earliest claimed: 2016-10-31 - Assignees: Guest Tek Interactive Entertainment Ltd. - Applicants: Guest Tek Interactive Entertainment Ltd. - Inventors: David T. Ong - Web page: https://patentgrep.com/patent/US11115384B2 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 61/4511: using domain name system [DNS] - H04L 63/0263: {Rule management} - H04L 63/0281: {Proxies} - H04L 63/101: {Access control lists [ACL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A walled garden system includes a firewall controlling access between a first network and a second network at least by allowing connection requests originating from a user device on the first network to a destination IP address on the second network in response to determining that the destination IP address matches a cleared IP address on a cleared IP addresses list. A controller receives a domain name service (DNS) reply from a DNS server on the second network, and determines whether a domain name specified within the DNS reply matches a cleared domain name on a cleared domain names list. In response to determining that the domain name specified within the DNS reply matches the cleared domain name on the cleared domain names list, the controller adds a resolved IP address specified in the DNS reply to the cleared IP addresses list as a new cleared IP address. ## Claims ### Claim 1 A walled garden system comprising: a storage device storing a cleared internet protocol (IP) addresses list and a cleared domain names list; a firewall controlling access between a first network and a second network; and a controller coupled to the storage device and the firewall; wherein the firewall is operable to control access between the first network and the second network at least by receiving one or more connection requests originating from a non-logged in user device on the first network that have a destination IP address on the second network, and directly allowing the connection requests to a pass to the destination IP address on the second network in response to the firewall determining that the destination IP address matches a cleared IP address on the cleared IP addresses list, and by blocking other connection requests originating from the non-logged in user device to an other destination IP address on the second network in response to the firewall determining that the other destination IP address does not match any cleared IP address on the cleared IP address list; the controller is operable to receive a domain name service (DNS) reply from a DNS server on the second network; the controller is operable to determine whether a domain name specified within the DNS reply matches a cleared domain name on the cleared domain names list; and in response to determining that the domain name specified within the DNS reply matches the cleared domain name on the cleared domain names list, the controller is operable to add a resolved IP address specified in the DNS reply to the cleared IP addresses list as a new cleared IP address; whereby, after the controller adds the resolved IP address to the cleared IP addresses list, the firewall is operable to allow connection requests originating from the non-logged in user device to the resolved IP address. ### Claim 2 (depends on 1) The walled garden system of claim 1, wherein the firewall is further operable to determine that the destination IP address matches the cleared IP address on the cleared IP addresses list by taking into account wild cards specified on the cleared IP addresses list. ### Claim 3 (depends on 1) The walled garden system of claim 1, wherein the controller is further operable to determine that the domain name specified within the DNS reply matches the cleared domain name on the cleared domain names list by taking into account wild cards specified on the cleared domain names list. ### Claim 4 (depends on 1) The walled garden system of claim 1, wherein the DNS reply is a reply to a previous DNS request sent by the non-logged in user device. ### Claim 5 (depends on 1) The walled garden system of claim 1, wherein: the controller is further operable to receive a DNS request sent by the non-logged in user device, and proxy the DNS request to the DNS server as a proxied DNS request; and the DNS reply is a reply to the controller in response to the proxied DNS request sent by the controller. ### Claim 6 (depends on 1) The walled garden system of claim 1, further comprising a dynamic host configuration protocol (DHCP) server operable to inform the non-logged in user device of a default DNS server being an IP address utilized by the controller. ### Claim 7 (depends on 1) The walled garden system of claim 1, wherein the controller is integrated within a device acting as a default gateway of the first network. ### Claim 8 (depends on 1) The walled garden system of claim 1, wherein the controller is further operable to add a plurality of resolved IP addresses specified in the DNS reply to the cleared IP addresses list as new cleared IP addresses. ### Claim 9 (depends on 1) The walled garden system of claim 1, wherein the controller is further operable to: track a last seen time for each cleared IP address on the cleared IP addresses list, the last seen time of a particular cleared IP address corresponding to a time the particular cleared IP address was last specified in a DNS reply as a resolved IP address of a cleared domain name on the cleared domain names list; and periodically delete cleared IP addresses on the cleared IP addresses list that have a last seen time older than a predetermined expiry duration. ### Claim 10 (depends on 1) The walled garden system of claim 1, wherein the controller is further operable to: track an expiry time for each cleared IP address on the cleared IP addresses list, the expiry time of a particular cleared IP address being greater than a time-to-live specified in a DNS reply providing the particular cleared IP as a resolved IP address of a cleared domain name on the cleared domain names list; and periodically delete cleared IP addresses on the cleared IP addresses list that have expired. ### Claim 11 (depends on 1) The walled garden system of claim 1, wherein the firewall is further operable to allow connection requests originating from the non-logged in user device to the destination IP address on the second network in response to the firewall determining that the destination IP address matches the cleared IP address on the cleared IP addresses list and that a destination port matches a cleared port. ### Claim 12 (depends on 1) The walled garden system of claim 1, wherein: in response to determining that the domain name specified within the DNS reply matches the cleared domain name on the cleared domain names list, the controller is further operable to proxy the DNS reply from the DNS server back to the non-logged in user device; and in response to determining that the domain name specified within the DNS reply does not match any of the cleared domain names on the cleared domain names list, the controller is further operable to reply to the non-logged in user device with a fake DNS reply providing an IP address of a login portal as the resolved IP address, thereby enabling the non-logged in user device to gain access. ### Claim 13 (depends on 1) The walled garden system of claim 1, wherein the controller is further operable to: proxy the DNS reply from the DNS server back to the non-logged in user device after adding the resolved IP address to the cleared IP addresses list; whereby, when the non-logged in user device subsequently makes a connection request to the resolved IP address specified in the DNS reply, the firewall will directly allow the connection request because the resolved IP address has already been added to the cleared IP addresses list by the controller. ### Claim 14 A method of providing a walled garden, the method comprising: storing a cleared internet protocol (IP) addresses list and a cleared domain names list; controlling access between a first network and a second network at least by receiving one or more connection requests originating from a non-logged in user device on the first network that have a destination IP address on the second network, and directly allowing the connection requests to a-pass to the destination IP address on the second network in response to determining that the destination IP address matches a cleared IP address on the cleared IP addresses list, and by blocking other connection requests originating from the non-logged in user device to an other destination IP address on the second network in response to determining that the other destination IP address does not match any cleared IP address on the cleared IP address list; receiving a domain name service (DNS) reply from a DNS server on the second network; determining whether a domain name specified within the DNS reply matches a cleared domain name on the cleared domain names list; and in response to determining that the domain name specified within the DNS reply matches the cleared domain name on the cleared domain names list, adding a resolved IP address specified in the DNS reply to the cleared IP addresses list as a new cleared IP address; whereby, after adding the resolved IP address to the cleared IP addresses list, connection requests originating from the non-logged in user device to the resolved IP address are allowed. ### Claim 15 (depends on 14) The method of claim 14, further comprising determining that the destination IP address matches the cleared IP address on the cleared IP addresses list by taking into account wild cards specified on the cleared IP addresses list. ### Claim 16 (depends on 14) The method of claim 14, further comprising determining that the domain name specified within the DNS reply matches the cleared domain name on the cleared domain names list by taking into account wild cards specified on the cleared domain names list. ### Claim 17 (depends on 14) The method of claim 14, further comprising adding a plurality of resolved IP addresses specified in the DNS reply to the cleared IP addresses list as new cleared IP addresses. ### Claim 18 (depends on 14) The method of claim 14, further comprising: tracking a last seen time for each cleared IP address on the cleared IP addresses list, the last seen time of a particular cleared IP address corresponding to a time the particular cleared IP address was last specified in a DNS reply as a resolved IP address of a cleared domain name on the cleared domain names list; and periodically deleting cleared IP addresses on the cleared IP addresses list that have a last seen time older than a predetermined expiry duration. ### Claim 19 (depends on 14) The method of claim 14, further comprising: tracking an expiry time for each cleared IP address on the cleared IP addresses list, the expiry time of a particular cleared IP address being greater than a time-to-live specified in a DNS reply providing the particular cleared IP as a resolved IP address of a cleared domain name on the cleared domain names list; and periodically deleting cleared IP addresses on the cleared IP addresses list that have expired. ### Claim 20 A walled garden system comprising: one or more storage devices storing a cleared internet protocol (IP) addresses list, a cleared domain names list, and a plurality of software instructions; and one or more processors coupled to the one or more storage devices; wherein, by the one or more processors executing the software instructions loaded from the one or more storage devices, the one or more processors are configured to: control access between a first network and a second network at least by receiving one or more connection requests originating from a non-logged in user device on the first network that have a destination IP address on the second network, and directly allowing the connection requests to pass to the destination IP address on the second network in response to determining that the destination IP address matches a cleared IP address on the cleared IP addresses list, and by blocking other connection requests originating from the non-logged in user device to an other destination IP address on the second network in response to determining that the other destination IP address does not match any cleared IP address on the cleared IP address list; receive a domain name service (DNS) reply from a DNS server on the second network; determine whether a domain name specified within the DNS reply matches a cleared domain name on the cleared domain names list; and in response to determining that the domain name specified within the DNS reply matches the cleared domain name on the cleared domain names list, add a resolved IP address specified in the DNS reply to the cleared IP addresses list as a new cleared IP address; whereby, after the resolved IP address is added to the cleared IP addresses list, the one or more processors are configured to allow connection requests originating from the non-logged in user device to the resolved IP address.