Use of network address translation for implementation of stateful routing
AssigneeMicrosoft Corporation
InventorIshai Ben Aroya
Life of this patent
Estimating the term…
Abstract
Systems and methods are described for using network address translation (NAT) for implementation of stateful routing. A firewall (or firewall server) filters communications between a first host and a second host at a firewall socket layer. Destination addresses for data packets coming into the firewall are translated to an internal (socket) address of the firewall. Source addresses for data packets sent from the firewall are translated to an address of the sending host. As a result, the receiving host sees the data packets as coming from the sending host. Translation rules applied during the communications are stores in a rules module and are applied to all packets having a particular source and a particular destination.
Claims28
A method, comprising:
- receiving a data packet from a first host bound for a second host;
- the data packet identifying a source as a first host address and a destination as a second host address;
- re-directing the data packet to a first internal location by modifying the destination address to an address of the first internal location;
- filtering the data packet;
- allocating a second internal location for transmitting the data packet from a second internal location to the second host;
- modifying the source address of the data packet to be the second host address;
- and
- transmitting the data packet to the second host.
A system, comprising:
- a processor;
- an Internet protocol (IP) layer configured to intercept data packets from a first host to a second host, the data packets having a source address that is an address of the first host and a destination address that is an address of the second host;
- a translation component configured to allocate a first socket to receive the data packets and to modify the destination address to an address of the first socket;
- a stateful inspection module configured to filter the data packets;
- wherein:
- the translation component is further configured to allocate a second socket to transmit the data packets to the second host and to modify the source address of the data packets to the address of the first host;
- and
- the Internet protocol layer is further configured to transmit the data packets from the second socket to the second host.
One or more computer-readable media containing computer-executable instructions that, when executed on a computer, perform the following steps:
- receiving a data packet having a source address identifying a first host and a destination address identifying a second host;
- allocating a first socket to receive the data packet;
- translating the destination address to an address of the first socket;
- performing stateful inspection of the data packet;
- if the data packet passes the stateful inspection, allocating a second socket for transmitting the data packet to the second host;
- translating the source address of the data packet to the first host;
- and
- transmitting the data packet to the second host.
A method, comprising:
- receiving a data packet having a source IP address of a first host and a destination address of a second host;
- referencing a rules table to locate a rule in the rules table that applies to data packets having a source address of the first host and a destination address of the second host;
- if a rule is found, applying the rule to the data packet;
- if a rule is not found, allocating a first socket to receive the data packet and modifying the destination address of the data packet to an address of the first socket and entering a rule describing the modification into the rules table;
- performing stateful inspection of the data packet;
- if the data packet does not successfully pass the stateful inspection, dropping the data packet;
- if the data packet successfully passes the stateful inspection, referencing the rules table to locate a rule in the rules table that applies to data packets having a source address of a second socket used to send data packets to the second host and a destination address of the second host;
- if a rule is found, applying the rule to the data packet;
- if a rule is not found, allocating the second socket, modifying the source address to be the address of the first host and entering a rule describing the modification into the rules table;
- and
- transmitting the data packet to the second host.
Dependencies are inferred from the claim text.