Inspection of network packet traffic for policy control

A system to provide policy-controlled communication over the Internet between a plurality of remote services and a plurality of third party applications executing on a client device, the system comprising one or more processors and one or more memories with code for:

• a client endpoint function that executes on the client device while coupled to a first VPN tunnel, the client endpoint function comprising:
• a first policy component, enforcing a plurality of policies on network packet traffic for a plurality of applications, wherein the plurality of policies specify one or more aspects of processing of network sessions from a third party application to a remote service,
• an first interceptor component that identifies network packet traffic and network sessions compliant with the plurality of policies, and
• a first VPN endpoint component, which provides a connection to a mid-link server using a first VPN tunnel programmed according to the plurality of policies,
• a service endpoint function that operates a remote service of the plurality of remote services, the service endpoint function at a service location, the service endpoint function comprising:
• a second interceptor component that identifies network packet traffic using the plurality of policies, and
• a second VPN endpoint component that connects to the mid-link server using a second VPN tunnel programmed according to the plurality of policies, and
• a mid-link server, coupled to the first VPN tunnel and the second VPN tunnel, the mid-link server comprising:
• a first and second VPN termination point that authenticates and terminates the first and second VPN tunnels at a mid-link server,
• a second policy component, wherein the second policy component uses the plurality of policies to specify at least:
• policy-based routing, packet re-addressing, and content mediation rules on packet traffic arriving from the first VPN tunnel,
• a router component interposed between the first and second VPN tunnels, wherein the router component operates to route network packet traffic between the first and second VPN tunnels via a route specified by the plurality of policies,
• an inspection component that analyzes network packet traffic in accordance with the plurality of policies, and
• a mediation component, effective to mask network addresses of the client device and service devices from each other, wherein the third party application operates with the remote service to provide functionality to the client device,
• wherein the inspection component inspects the network packet traffic for specific content and provides instructions to at least one of the router component or the mediation component, and the instructions are a function of at least one policy of the plurality of policies that applies to the specific content.