Multi-tenant virtual private network address translation

A method implemented by a computing system including one or more processors and storage media storing machine-readable instructions, wherein the method is performed using the one or more processors, the method comprising:

• providing a multi-tenant VPN to a plurality of tenants, wherein tenant VPNs are associated with respective private networks;
• identifying a first subnet that makes up a portion of a first private network associated with a first tenant of the plurality of tenants;
• translating the first subnet into a first MT-NAT subnet that is used as part of a first tenant VPN to extend the first private network across a public network;
• subsequently identifying a second subnet that makes up a portion of the first private network, wherein the second subnet is not contiguous with the first subnet, and has not been translated into the first MT-NAT subnet;
• extracting a proper subnet from the first subnet, wherein the proper subnet comprises less than all of the first subnet such that a remaining portion of the first subnet is excluded from the proper subnet;
• combining the proper subnet and the second subnet into a second MT-NAT subnet that is distinct from the first MT-NAT subnet;
• translating addresses from the proper subnet and the second subnet into addresses within the second MT-NAT subnet;
• and
• maintaining the remaining portion of the first subnet as available for allocation within the first private network to avoid subnet fragmentation of the first private network.

A system comprising:

• a means for providing a multi-tenant VPN to a plurality of tenants, wherein tenant VPNs are associated with respective private networks;
• a means for identifying a first subnet that makes up a portion of a first private network associated with a first tenant of the plurality of tenants;
• a means for translating the first subnet into a first MT-NAT subnet that is used as part of a first tenant VPN to extend the first private network across a public network;
• a means for subsequently identifying a second subnet that makes up a portion of the first private network, wherein the second subnet is not contiguous with the first subnet, and has not been translated into the first MT-NAT subnet;
• a means for extracting a proper subnet from the first subnet, wherein the proper subnet comprises less than all of the first subnet such that a remaining portion of the first subnet is excluded from the proper subnet;
• a means for combining the proper subnet and the second subnet into a second MT-NAT subnet that is distinct from the first MT-NAT subnet;
• a means for translating addresses from the proper subnet and the second subnet into addresses within the second MT-NAT subnet;
• and
• a means for maintaining the remaining portion of the first subnet as available for allocation within the first private network to avoid subnet fragmentation of the first private network.