Traffic management of virtual private network traffic

A system comprising:

• one or more processors coupled to a computer-readable medium having stored thereon software instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receiving data traffic at a network device from an endpoint device over a virtual private network (VPN) tunnel established between the endpoint device and the network device, wherein the data traffic includes a source-destination tuple that comprises a source gateway IP address and a destination gateway IP address;
• determining, at a network layer of the network device, whether the source-destination tuple matches a reference source-destination tuple of a plurality of reference source-destination tuples, wherein individual reference source-destination tuples comprise a respective reference source gateway IP address and a respective reference destination gateway IP address;
• based on a determination that the source-destination tuple matches the reference source-destination tuple, accepting the data traffic for onward transmission to a protocol layer of the network device;
• and
• based on a determination that the source-destination tuple does not match any reference source-destination tuple, rejecting the data traffic at the network layer of the network device.

A non-transitory computer-readable medium having stored thereon software instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• receiving data traffic at a network device from an endpoint device over a virtual private network (VPN) tunnel established between the endpoint device and the network device, wherein the data traffic includes a source-destination tuple that comprises a source gateway IP address and a destination gateway IP address;
• determining, at a network layer of the network device, whether the source-destination tuple matches a reference source-destination tuple of a plurality of reference source-destination tuples, wherein individual reference source-destination tuples comprise a respective reference source gateway IP address and a respective reference destination gateway IP address;
• based on a determination that the source-destination tuple matches the reference source-destination tuple, accepting the data traffic for onward transmission to a protocol layer of the network device;
• and
• based on a determination that the source-destination tuple does not match any reference source-destination tuple, rejecting the data traffic at the network layer of the network device.