# US 12,192,094 B2 · Method and apparatus of automatic route optimization in a private virtual network for client devices of a local network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,094 B2 - Document ID: US12192094B2 - Status: Granted - Kind: B2 - Application number: 17/509,904 - Filed: 2021-10-25 - Published: 2022-02-10 - Granted: 2025-01-07 - Earliest claimed: 2019-04-17 - Assignees: Cloudfare, Inc. - Applicants: Cloudflare, Inc. - Inventors: Christopher Philip Branch - Web page: https://patentgrep.com/patent/US12192094B2 ## CPC - H04L 45/02: Topology update or discovery - H04L 45/123: {Evaluation of link metrics (techniques for monitoring network metrics H04L43/08)} - H04L 45/124: {using a combination of metrics} - H04L 45/74: Address processing for routing - H04L 63/0272: {Virtual private networks} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A client device establishes a first VPN connection with a VPN server. Traffic is sent from the client device through the first VPN connection that is destined to a different client device that has a second VPN connection with the VPN server. The client device receives a public network address of the different client device and routing metrics from the VPN server. Based at least in part on the routing metrics, the client device determines an optimal route to the different client device, where the optimal route is a connection between the client device and the different client device that does not traverse the VPN server. The client device establishes a VPN connection with the different client device and transmits traffic to that different client device using the VPN connection using the public network address of the different client device. ## Claims ### Claim 1 A method in a client device, comprising: establishing a first virtual private network (VPN) connection with a VPN server, wherein the VPN server is remote from the client device; transmitting to the VPN server, through the first VPN connection, traffic from the client device that is destined to a different client device that has a second VPN connection with the VPN server; receiving, from the VPN server over the first VPN connection, a public network address of the different client device; receiving, from the VPN server, routing metrics related to traffic transmitted through the first VPN connection and the second VPN connection; determining, based at least in part on the routing metrics, an optimal route from the client device to the different client device, wherein the optimal route is a connection between the client device and the different client device that does not traverse the VPN server; establishing a third VPN connection with the different client device; and transmitting traffic destined for the different client device using the third VPN connection that is encapsulated with packets destined to the public network address of the different client device. ### Claim 2 (depends on 1) The method of claim 1, further comprising: prior to receiving the public network address of the different client device, transmitting a local network address identifying the client device in a local network to the VPN server, wherein the client device and the different client device are part of a same local network. ### Claim 3 (depends on 1) The method of claim 1, further comprising: transmitting a local network address identifying the different client device to the VPN server. ### Claim 4 (depends on 1) The method of claim 1, wherein the routing metrics include for each one of the first VPN connection and the second VPN connection one or more of a measure of link utilization, an indication of a number of hops, a measure of speed, a measure of packet loss, a measure of latency, a measure of path reliability, a measure of path bandwidth, and a measure of throughput. ### Claim 5 (depends on 1) The method of claim 1, wherein determining the optimal route from the client device to the different client device further is based on one or more routing metrics for routes within a local network for which the client device and the different client device are a part. ### Claim 6 (depends on 1) The method of claim 1, wherein establishing the third VPN connection with the different client device is based on cryptographic credentials associated with the client device and the different client device. ### Claim 7 (depends on 1) The method of claim 1, wherein the client device and the different client device are part of a same local network. ### Claim 8 A client device, comprising: one or more processors; and a non-transitory computer readable storage medium that stores code, which when executed by the one or more processors causes the client device to perform operations including: establishing a first virtual private network (VPN) connection with a VPN server, wherein the VPN server is remote from the client device; transmitting to the VPN server, through the first VPN connection, traffic from the client device that is destined to a different client device that has a second VPN connection with the VPN server; receiving, from the VPN server over the first VPN connection, a public network address of the different client device; receiving, from the VPN server, routing metrics related to traffic transmitted through the first VPN connection and the second VPN connection; determining, based at least in part on the routing metrics, an optimal route from the client device to the different client device, wherein the optimal route is a connection between the client device and the different client device that does not traverse the VPN server; establishing a third VPN connection with the different client device; and transmitting traffic destined for the different client device using the third VPN connection that is encapsulated with packets destined to the public network address of the different client device. ### Claim 9 (depends on 8) The client device of claim 8, wherein the operations further comprise: prior to receiving the public network address of the different client device, transmitting a local network address identifying the client device in a local network to the VPN server, wherein the client device and the different client device are part of a same local network. ### Claim 10 (depends on 8) The client device of claim 8, wherein the operations further comprise: transmitting a local network address identifying the different client device to the VPN server. ### Claim 11 (depends on 8) The client device of claim 8, wherein the routing metrics include for each one of the first VPN connection and the second VPN connection one or more of a measure of link utilization, an indication of a number of hops, a measure of speed, a measure of packet loss, a measure of latency, a measure of path reliability, a measure of path bandwidth, and a measure of throughput. ### Claim 12 (depends on 8) The client device of claim 8, wherein determining the optimal route from the client device to the different client device further is based on one or more routing metrics for routes within a local network for which the client device and the different client device are a part. ### Claim 13 (depends on 8) The client device of claim 8, wherein establishing the third VPN connection with the different client device is based on cryptographic credentials associated with the client device and the different client device. ### Claim 14 (depends on 8) The client device of claim 8, wherein the client device and the different client device are part of a same local network. ### Claim 15 A non-transitory computer readable storage medium that stores instructions which when executed by one or more processors of a client device cause said processors to perform operations including: establishing a first virtual private network (VPN) connection with a VPN server, wherein the VPN server is remote from the client device; transmitting to the VPN server, through the first VPN connection, traffic from the client device that is destined to a different client device that has a second VPN connection with the VPN server; receiving, from the VPN server over the first VPN connection, a public network address of the different client device; receiving, from the VPN server, routing metrics related to traffic transmitted through the first VPN connection and the second VPN connection; determining, based at least in part on the routing metrics, an optimal route from the client device to the different client device, wherein the optimal route is a connection between the client device and the different client device that does not traverse the VPN server; establishing a third VPN connection with the different client device; and transmitting traffic destined for the different client device using the third VPN connection that is encapsulated with packets destined to the public network address of the different client device. ### Claim 16 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the operations further comprise: prior to receiving the public network address of the different client device, transmitting a local network address identifying the client device in a local network to the VPN server, wherein the client device and the different client device are part of a same local network. ### Claim 17 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the operations further comprise: transmitting a local network address identifying the different client device to the VPN server. ### Claim 18 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the routing metrics include for each one of the first VPN connection and the second VPN connection one or more of a measure of link utilization, an indication of a number of hops, a measure of speed, a measure of packet loss, a measure of latency, a measure of path reliability, a measure of path bandwidth, and a measure of throughput. ### Claim 19 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein determining the optimal route from the client device to the different client device further is based on one or more routing metrics for routes within a local network for which the client device and the different client device are a part. ### Claim 20 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein establishing the third VPN connection with the different client device is based on cryptographic credentials associated with the client device and the different client device. ### Claim 21 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the client device and the different client device are part of a same local network.