Controller-based distributed remote access with static public IP avoidance

A computing device comprising:

• a processor;
• and
• a non-transitory computer-readable media storing instructions that, when executed by the processor, causes the processor to perform operations comprising:
• connecting a plurality of edge devices to a controller via a network, the plurality of edge devices performing hole punching to traverse a network address translation (NAT) gateway to create a NAT hole and detecting an auto discovery request from the plurality of edge devices via SaaS-based secure-onboarding;
• connecting a client device to the controller comprising:
• pre-provisioning the client device with identification information of the controller;
• and
• authenticating the client device using an identity provider;
• receiving, at the controller and from the client device, a request to connect to an edge device of the plurality of edge devices;
• determining, by the controller and based on the request, at least one of a first attribute of the client device or a second attribute of the edge device;
• and
• based at least in part on the at least one of the first attribute or the second attribute, directly connecting the client device to the edge device via the NAT hole in the network.

A non-transitory computer-readable medium storing instructions that, when executed, causes a processor to perform operations, comprising:

• connecting a plurality of edge devices to a controller via a network, the plurality of edge devices performing hole punching to traverse a network address translation (NAT) gateway to create a NAT hole and detecting an auto discovery request from the plurality of edge devices via SaaS-based secure-onboarding;
• connecting a client device to the controller comprising:
• pre-provisioning the client device with identification information of the controller;
• and
• authenticating the client device using an identity provider;
• receiving, at the controller and from the client device, a request to connect to an edge device of the plurality of edge devices;
• determining, by the controller and based on the request, at least one of a first attribute of the client device or a second attribute of the edge device;
• and
• based at least in part on the at least one of the first attribute or the second attribute, directly connecting the client device to the edge device via the NAT hole in the network.