# US 2021/0243155 A1 · Network address translation for virtual machines > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243155 A1 - Document ID: US20210243155A1 - Status: Published application - Kind: A1 - Application number: 17/092,192 - Filed: 2020-11-06 - Published: 2021-08-05 - Earliest claimed: 2011-01-13 - Assignees: Google Inc. - Applicants: Google LLC - Inventors: Evan K Anderson - Web page: https://patentgrep.com/patent/US20210243155A1 ## CPC - H04L 61/256: NAT traversal - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 49/3009: {Header conversion, routing tables or routing tags} - H04L 61/2503: Translation of Internet protocol [IP] addresses - H04L 61/2517: using port numbers - H04L 61/2535: {Multiple local networks, e.g. resolving potential IP address conflicts} - H04L 61/255: Maintenance or indexing of mapping tables - H04L 67/1001: for accessing one among a plurality of replicated servers - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04L 69/22: Parsing or analysis of headers - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L 2101/604: Address structures or formats - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for receiving a packet from a client, the packet having header information including a destination Internet Protocol (IP) address, a destination port, a source IP address, and a source port, and wherein the source IP address and source port are associated with the client; selecting a destination virtual machine based on the destination port; modifying the packet by replacing the destination IP address in the header information with an IP address of the selected destination virtual machine; and sending the modified packet to the destination virtual machine. ## Claims ### Claim 1 A method comprising: receiving, at data processing hardware of a gateway associated with a virtual private network, a packet from a first virtual machine executing on a host machine of the virtual private network, the packet comprising: a source internet protocol (IP) address assigned to the first virtual machine, a source port of the host machine assigned to the first virtual machine; a destination IP address; and a destination port; determining, by the data processing hardware, that the packet is intended for a client external to the virtual private network, the client associated with the destination IP address and the destination port; based on the determination that the packet is intended for the client external to the virtual private network, modifying, by the data processing hardware, the source IP address of the packet from the source IP address assigned to the first virtual machine to a respective IP address assigned to the gateway; and communicating, by the data processing hardware, the packet to the destination IP address of the client external to the virtual private network. ### Claim 2 (depends on 1) The method of claim 1, further comprising, prior to the data processing hardware of the gateway receiving the packet, encapsulating a data portion of the packet. ### Claim 3 (depends on 2) The method of claim 2, wherein encapsulating the packet comprises encrypting at least a portion of the data portion of the packet using a Diffie-Hellman protocol. ### Claim 4 (depends on 1) The method of claim 1, wherein the client comprises a second virtual machine. ### Claim 5 (depends on 4) The method of claim 4, further comprising, requesting a token from a registry service, the token used to establish a unidirectional virtual network pair from the first virtual machine to the second virtual machine. ### Claim 6 (depends on 5) The method of claim 5, wherein the token comprises a validity period defining a time when the token expires. ### Claim 7 (depends on 6) The method of claim 6, wherein prior to communicating the packet to the destination IP address of the client external to the virtual private network, determining that the validity period for the token is satisfied. ### Claim 8 (depends on 7) The method of claim 7, wherein determining that the validity period for the token is satisfied occurs at the data processing hardware of the gateway. ### Claim 9 (depends on 5) The method of claim 5, wherein the packet is a User Datagram Protocol (UDP) packet comprising a return virtual network pair token for unidirectional communication from the second virtual machine to the first virtual machine. ### Claim 10 (depends on 1) The method of claim 1, further comprising prior to the data processing hardware of the gateway receiving the packet, encapsulating a data portion of the packet; prior to the data processing hardware of the gateway communicating the packet to the destination IP address of the client external to the virtual private network, determining, by the data processing hardware, that a validity period of a token associated with the packet is satisfied, the client comprising a second virtual machine, the token configured to establish a unidirectional virtual network pair from the first virtual machine to the second virtual machine; determining, by the data processing hardware, that the validity period for the token is satisfied; and in response to determining that the validity period for the token is satisfied, de-encapsulating, by the data processing hardware, the encapsulated data portion of the packet. ### Claim 11 A system comprising: data processing hardware; and memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising: receiving, at a gateway associated with a virtual private network, a packet from a first virtual machine executing on a host machine of the virtual private network, the packet comprising: a source internet protocol (IP) address assigned to the first virtual machine, a source port of the host machine assigned to the first virtual machine; a destination IP address; and a destination port; determining that the packet is intended for a client external to the virtual private network, the client associated with the destination IP address and the destination port; based on the determination that the packet is intended for the client external to the virtual private network, modifying the source IP address of the packet from the source IP address assigned to the first virtual machine to a respective IP address assigned to the gateway, and communicating the packet to the destination IP address of the client external to the virtual private network. ### Claim 12 (depends on 11) The system of claim 11, wherein the operations further comprise, prior to the gateway receiving the packet, encapsulating a data portion of the packet. ### Claim 13 (depends on 12) The system of claim 12, wherein encapsulating the packet comprises encrypting at least a portion of the data portion of the packet using a Diffie-Hellman protocol. ### Claim 14 (depends on 11) The system of claim 11, wherein the client comprises a second virtual machine. ### Claim 15 (depends on 14) The system of claim 14, wherein the operations further comprise, requesting a token from a registry service, the token used to establish a unidirectional virtual network pair from the first virtual machine to the second virtual machine. ### Claim 16 (depends on 15) The system of claim 15, wherein the token comprises a validity period defining a time when the token expires. ### Claim 17 (depends on 16) The system of claim 16, wherein prior to communicating the packet to the destination IP address of the client external to the virtual private network, determining that the validity period for the token is satisfied. ### Claim 18 (depends on 17) The system of claim 17, wherein determining that the validity period for the token is satisfied occurs at the data processing hardware of the gateway. ### Claim 19 (depends on 15) The system of claim 15, wherein the packet is a User Datagram Protocol (UDP) packet comprising a return virtual network pair token for unidirectional communication from the second virtual machine to the first virtual machine. ### Claim 20 (depends on 11) The system of claim 11, wherein the operations further comprise: prior to the gateway receiving the packet, encapsulating a data portion of the packet; prior to communicating the packet to the destination IP address of the client external to the virtual private network, determining that a validity period of a token associated with the packet is satisfied, the client comprising a second virtual machine, the token configured to establish a unidirectional virtual network pair from the first virtual machine to the second virtual machine; determining that the validity period for the token is satisfied; and in response to determining that the validity period for the token is satisfied, de-encapsulating the encapsulated data portion of the packet.