Establishing a secure internet connection between an endpoint agent and a cloud-based security service

A method performed by one or more processing resources of one or more computer systems supporting a secure Internet connection service, the method comprising:

• receiving a domain name service (DNS) request at the secure Internet connection service of a cloud-based security service from an agent running on an endpoint device, wherein the secure Internet connection service includes a plurality of pools of geographically distributed virtual private network (VPN) servers;
• sending a DNS response to the DNS request containing an Internet Protocol (IP) addresses of a particular VPN server within a pool of the plurality of pools to the endpoint device, wherein the pool is selected by the secure Internet connection service based at least in part on a geographic location of the endpoint device inferred by a source IP address of the DNS request, and wherein the particular VPN server is selected from a plurality of VPN servers in the pool based on a status of the particular VPN server;
• and
• establishing a secure Internet connection between the agent and the particular VPN server via a particular logical port.

An endpoint device comprising:

• a processing resource;
• and
• a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to:
• issue a domain name service (DNS) request to a secure Internet connection service of a cloud-based security service, wherein the secure Internet connection service includes a plurality of pools of geographically distributed virtual private network (VPN) servers;
• receive a DNS response to the DNS request containing an Internet Protocol (IP) address of a particular VPN server within a pool of the plurality of pools, wherein the pool is selected by the secure Internet connection service based at least in part on a geographic location of the endpoint device inferred by a source IP address of the DNS request, and wherein the particular VPN server is selected from a plurality of VPN servers in the pool based on a status of the particular VPN server;
• and
• establish a secure Internet connection between the endpoint device and the particular VPN server via a particular logical port.

A system comprising:

• a processing resource;
• and
• a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to:
• receive a domain name service (DNS) request on behalf of a secure Internet connection service of a cloud-based security service from an agent running on an endpoint device, wherein the secure Internet connection service includes a plurality of pools of geographically distributed virtual private network (VPN) servers;
• send a DNS response to the DNS request containing an Internet Protocol (IP) addresses of a particular VPN server within a pool of the plurality of pools to the endpoint device, wherein the pool is selected by the secure Internet connection service based at least in part on a geographic location of the endpoint device inferred by a source IP address of the DNS request, and wherein the particular VPN server is selected from a plurality of VPN servers in the pool based on a status of the particular VPN server;
• and
• establish a secure Internet connection between the agent and the particular VPN server via a particular logical port.