Routing traffic across isolation networks

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• instructing, by the apparatus, one or more networking devices in a local area network (LAN) to form a virtual network overlay in the LAN that redirects traffic associated with a particular node in the LAN to a first isolation application instance hosted by the apparatus;
• receiving, at the first isolation application instance hosted by the apparatus, the redirected traffic associated with the particular node;
• determining, by the first isolation application instance hosted by the apparatus, a routing path for the traffic that comprises one or more other isolation application instances hosted by the apparatus;
• tagging, by the first isolation application instance hosted by the apparatus, the traffic to indicate the determined routing path;
• and
• forwarding, by the first isolation application instance hosted by the apparatus, the tagged traffic to a second isolation application instance along the determined routing path.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a service to execute a process comprising:

• instructing, by the, one or more networking devices in a local area network (LAN) to form a virtual network overlay in the LAN that redirects traffic associated with a particular node in the LAN to a first isolation application instance hosted by the service;
• receiving, at the first isolation application instance hosted by the service, the redirected traffic associated with the particular node;
• determining, by the first isolation application instance hosted by the service, a routing path for the traffic that comprises one or more other isolation application instances hosted by the service;
• tagging, by the first isolation application instance hosted by the service, the traffic to indicate the determined routing path;
• and
• forwarding, by the first isolation application instance hosted by the service, the tagged traffic to a second isolation application instance along the determined routing path.