# US 11,909,712 B2 · Network address translation for virtual machines

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,909,712 B2
- Document ID: US11909712B2
- Status: Granted
- Kind: B2
- Application number: 17/092,192
- Filed: 2020-11-06
- Published: 2021-08-05
- Granted: 2024-02-20
- Earliest claimed: 2011-01-13
- Assignees: Google Inc.
- Applicants: Google LLC
- Inventors: Evan K. Anderson
- Web page: https://patentgrep.com/patent/US11909712B2

## CPC

- H04L 61/256: NAT traversal
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- H04L 49/3009: {Header conversion, routing tables or routing tags}
- H04L 61/2503: Translation of Internet protocol [IP] addresses
- H04L 61/2517: using port numbers
- H04L 61/2535: {Multiple local networks, e.g. resolving potential IP address conflicts}
- H04L 61/255: Maintenance or indexing of mapping tables
- H04L 67/1001: for accessing one among a plurality of replicated servers
- H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L 69/22: Parsing or analysis of headers
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- H04L 2101/604: Address structures or formats
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for receiving a packet from a client, the packet having header information including a destination Internet Protocol (IP) address, a destination port, a source IP address, and a source port, and wherein the source IP address and source port are associated with the client; selecting a destination virtual machine based on the destination port; modifying the packet by replacing the destination IP address in the header information with an IP address of the selected destination virtual machine; and sending the modified packet to the destination virtual machine.

## Claims

### Claim 1

A method comprising:
receiving, at data processing hardware of a gateway associated with a virtual private network, a packet from a first virtual machine executing on a host machine of the virtual private network, the packet comprising:
a source internet protocol (IP) address assigned to the first virtual machine;
a source port of the host machine assigned to the first virtual machine;
a destination IP address; and
a destination port;
determining, by the data processing hardware, that the packet is intended for a client external to the virtual private network, the client associated with the destination IP address and the destination port;
based on the determination that the packet is intended for the client external to the virtual private network, modifying, by the data processing hardware:
the source IP address of the packet from the source IP address assigned to the first virtual machine to a respective IP address assigned to the gateway; and
the source port of the packet from the source port of the host machine to a different port assigned to the first virtual machine; and
communicating, by the data processing hardware, the packet to the destination IP address of the client external to the virtual private network,
wherein:
the client comprises a second virtual machine; and
the packet is a User Datagram Protocol (UDP) packet comprising a return virtual network pair token for unidirectional communication from the second virtual machine to the first virtual machine.

### Claim 2 (depends on 1)

The method of claim 1, further comprising, prior to the data processing hardware of the gateway receiving the packet, encapsulating a data portion of the packet.

### Claim 3 (depends on 2)

The method of claim 2, wherein encapsulating the packet comprises encrypting at least a portion of the data portion of the packet using a Diffie-Hellman protocol.

### Claim 4 (depends on 1)

The method of claim 1, further comprising, requesting a token from a registry service, the token used to establish a unidirectional virtual network pair from the first virtual machine to the second virtual machine.

### Claim 5 (depends on 4)

The method of claim 4, wherein the token comprises a validity period defining a time when the token expires.

### Claim 6 (depends on 5)

The method of claim 5, wherein prior to communicating the packet to the destination IP address of the client external to the virtual private network, determining that the validity period for the token is satisfied.

### Claim 7 (depends on 6)

The method of claim 6, wherein determining that the validity period for the token is satisfied occurs at the data processing hardware of the gateway.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
prior to the data processing hardware of the gateway receiving the packet, encapsulating a data portion of the packet;
prior to the data processing hardware of the gateway communicating the packet to the destination IP address of the client external to the virtual private network, determining, by the data processing hardware, that a validity period of a token associated with the packet is satisfied, the token configured to establish a unidirectional virtual network pair from the first virtual machine to the second virtual machine;
determining, by the data processing hardware, that the validity period for the token is satisfied; and
in response to determining that the validity period for the token is satisfied, de-encapsulating, by the data processing hardware, the encapsulated data portion of the packet.

### Claim 9

A method comprising:
receiving, at data processing hardware of a gateway associated with a virtual private network, a packet from a first virtual machine executing on a host machine of the virtual private network, the packet comprising:
a source internet protocol (IP) address assigned to the first virtual machine;
a source port of the host machine assigned to the first virtual machine;
a destination IP address; and
a destination port;
determining, by the data processing hardware, that the packet is intended for a client external to the virtual private network, the client associated with the destination IP address and the destination port;
based on the determination that the packet is intended for the client external to the virtual private network, modifying, by the data processing hardware, the source IP address of the packet from the source IP address assigned to the first virtual machine to a respective IP address assigned to the gateway; and
communicating, by the data processing hardware, the packet to the destination IP address of the client external to the virtual private network,
wherein:
the client comprises a second virtual machine;
the method further comprises requesting a token from a registry service, the token used to establish a unidirectional virtual network pair from the first virtual machine to the second virtual machine; and
the packet is a User Datagram Protocol (UDP) packet comprising a return virtual network pair token for unidirectional communication from the second virtual machine to the first virtual machine.

### Claim 10

A system comprising:
data processing hardware; and
memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
receiving, at a gateway associated with a virtual private network, a packet from a first virtual machine executing on a host machine of the virtual private network, the packet comprising:
a source internet protocol (IP) address assigned to the first virtual machine;
a source port of the host machine assigned to the first virtual machine;
a destination IP address; and
a destination port;
determining that the packet is intended for a client external to the virtual private network, the client associated with the destination IP address and the destination port;
based on the determination that the packet is intended for the client external to the virtual private network:
modifying the source IP address of the packet from the source IP address assigned to the first virtual machine to a respective IP address assigned to the gateway; and
modifying the source port of the packet from the source port of the host machine to a different port assigned to the first virtual machine; and
communicating the packet to the destination IP address of the client external to the virtual private network,
wherein:
the client comprises a second virtual machine; and
the packet is a User Datagram Protocol (UDP) packet comprising a return virtual network pair token for unidirectional communication from the second virtual machine to the first virtual machine.

### Claim 11 (depends on 10)

The system of claim 10, wherein the operations further comprise, prior to the gateway receiving the packet, encapsulating a data portion of the packet.

### Claim 12 (depends on 11)

The system of claim 11, wherein encapsulating the packet comprises encrypting at least a portion of the data portion of the packet using a Diffie-Hellman protocol.

### Claim 13 (depends on 10)

The system of claim 10, wherein the operations further comprise, requesting a token from a registry service, the token used to establish a unidirectional virtual network pair from the first virtual machine to the second virtual machine.

### Claim 14 (depends on 13)

The system of claim 13, wherein the token comprises a validity period defining a time when the token expires.

### Claim 15 (depends on 14)

The system of claim 14, wherein prior to communicating the packet to the destination IP address of the client external to the virtual private network, determining that the validity period for the token is satisfied.

### Claim 16 (depends on 15)

The system of claim 15, wherein determining that the validity period for the token is satisfied occurs at the data processing hardware of the gateway.

### Claim 17 (depends on 10)

The system of claim 10, wherein the operations further comprise:
prior to the gateway receiving the packet, encapsulating a data portion of the packet;
prior to communicating the packet to the destination IP address of the client external to the virtual private network, determining that a validity period of a token associated with the packet is satisfied, the token configured to establish a unidirectional virtual network pair from the first virtual machine to the second virtual machine;
determining that the validity period for the token is satisfied; and
in response to determining that the validity period for the token is satisfied, de-encapsulating the encapsulated data portion of the packet.

### Claim 18

A system comprising:
data processing hardware; and
memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
receiving, at a gateway associated with a virtual private network, a packet from a first virtual machine executing on a host machine of the virtual private network, the packet comprising:
a source internet protocol (IP) address assigned to the first virtual machine;
a source port of the host machine assigned to the first virtual machine;
a destination IP address; and
a destination port;
determining that the packet is intended for a client external to the virtual private network, the client associated with the destination IP address and the destination port;
based on the determination that the packet is intended for the client external to the virtual private network, modifying the source IP address of the packet from the source IP address assigned to the first virtual machine to a respective IP address assigned to the gateway; and
communicating the packet to the destination IP address of the client external to the virtual private network;
wherein:
the client comprises a second virtual machine;
the operations further comprise, requesting a token from a registry service, the token used to establish a unidirectional virtual network pair from the first virtual machine to the second virtual machine; and
the packet is a User Datagram Protocol (UDP) packet comprising a return virtual network pair token for unidirectional communication from the second virtual machine to the first virtual machine.