Network address translation proxy for enabling access to external systems from a private network

An apparatus implementing a node of a private network to enable access to external systems by nodes in the private network, the apparatus comprising:

• one or more computer-readable storage media;
• one or more processing systems operatively coupled with the one or more computer-readable storage media;
• and
• program instructions stored on the one or more computer-readable storage media that, when read and executed by the one or more processing systems, direct the apparatus to:
• receive a reserved address range in an internal domain of the private network;
• receive a Domain Name System (DNS) request from a requesting node in the internal domain that indicates a domain name corresponding to an external domain;
• allocate a designated address from the reserved address range to communications associated with the DNS request;
• transmit, to the requesting node, a name-resolution response that includes the designated address;
• receive traffic directed to the designated address over the private network;
• and
• relay the traffic to a resource in the external domain.

A system forming a private network to enable access to external systems by nodes in the private network, the system comprising:

• a control plane configured to:
• identify a set of domain names to be mediated by a proxy node operating in an internal domain of the private network;
• configure the proxy node with a reserved address range and with instructions to respond to name-resolution requests for the set of domain names with designated addresses drawn from the reserved address range;
• and
• direct nodes in the internal domain to send the name-resolution requests for the set of domain names to the proxy node;
• and
• the proxy node configured to:
• maintain mappings between designated addresses in the reserved address range, the nodes, and the set of domain names;
• provide name-resolution responses to the nodes in the internal domain that include the designated addresses;
• advertise one or more subnet routes to the reserved address range within the internal domain;
• and
• relay traffic between the nodes in the internal domain and external systems indicated by the domain names using network address translation based on the mappings.