Network address translation for virtual machines

A method comprising:

• receiving, at data processing hardware of a gateway associated with a virtual private network, a packet from a first virtual machine executing on a host machine of the virtual private network, the packet comprising:
• a source internet protocol (IP) address assigned to the first virtual machine;
• a source port of the host machine assigned to the first virtual machine;
• a destination IP address;
• and
• a destination port;
• determining, by the data processing hardware, that the packet is intended for a client external to the virtual private network, the client associated with the destination IP address and the destination port;
• based on the determination that the packet is intended for the client external to the virtual private network, modifying, by the data processing hardware, the source IP address of the packet from the source IP address assigned to the first virtual machine to a respective IP address assigned to the gateway;
• and
• communicating, by the data processing hardware, the packet to the destination IP address of the client external to the virtual private network,
• wherein:
• the client comprises a second virtual machine;
• the method further comprises requesting a token from a registry service, the token used to establish a unidirectional virtual network pair from the first virtual machine to the second virtual machine;
• and
• the packet is a User Datagram Protocol (UDP) packet comprising a return virtual network pair token for unidirectional communication from the second virtual machine to the first virtual machine.

A system comprising:

• data processing hardware;
• and
• memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
• receiving, at a gateway associated with a virtual private network, a packet from a first virtual machine executing on a host machine of the virtual private network, the packet comprising:
• a source internet protocol (IP) address assigned to the first virtual machine;
• a source port of the host machine assigned to the first virtual machine;
• a destination IP address;
• and
• a destination port;
• determining that the packet is intended for a client external to the virtual private network, the client associated with the destination IP address and the destination port;
• based on the determination that the packet is intended for the client external to the virtual private network:
• modifying the source IP address of the packet from the source IP address assigned to the first virtual machine to a respective IP address assigned to the gateway;
• and
• modifying the source port of the packet from the source port of the host machine to a different port assigned to the first virtual machine;
• and
• communicating the packet to the destination IP address of the client external to the virtual private network,
• wherein:
• the client comprises a second virtual machine;
• and
• the packet is a User Datagram Protocol (UDP) packet comprising a return virtual network pair token for unidirectional communication from the second virtual machine to the first virtual machine.

A system comprising:

• data processing hardware;
• and
• memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
• receiving, at a gateway associated with a virtual private network, a packet from a first virtual machine executing on a host machine of the virtual private network, the packet comprising:
• a source internet protocol (IP) address assigned to the first virtual machine;
• a source port of the host machine assigned to the first virtual machine;
• a destination IP address;
• and
• a destination port;
• determining that the packet is intended for a client external to the virtual private network, the client associated with the destination IP address and the destination port;
• based on the determination that the packet is intended for the client external to the virtual private network, modifying the source IP address of the packet from the source IP address assigned to the first virtual machine to a respective IP address assigned to the gateway;
• and
• communicating the packet to the destination IP address of the client external to the virtual private network;
• wherein:
• the client comprises a second virtual machine;
• the operations further comprise, requesting a token from a registry service, the token used to establish a unidirectional virtual network pair from the first virtual machine to the second virtual machine;
• and
• the packet is a User Datagram Protocol (UDP) packet comprising a return virtual network pair token for unidirectional communication from the second virtual machine to the first virtual machine.