Remote access to private network resources from outside the network

At least one computer-readable storage memory encoded with computer-executable instructions that, when executed by a computer, cause the computer to perform a method for enabling remote access to a private network resource connected to a private network from a client computer outside of the private network, wherein the private network comprises an edge resource, the method comprising:

• (A) receiving a Domain Name System (DNS) query according to a DNS protocol from the client computer, the DNS query containing a domain name, associated with the private network resource, that is resolvable on the private network to a first Internet Protocol (IP) address for the private network resource and that is resolvable outside of the private network to a second IP address for the edge resource;
• (B) transmitting a response to the DNS query from the edge resource to the client computer containing the second IP address for the edge resource;
• (C) receiving, at the edge resource, a communication from the client computer, the communication including a header that contains the domain name associated with the private network resource;
• (D) resolving, using the DNS protocol, the domain name to the first IP address for the private network resource, wherein the act (D) of transmitting the communication comprises:
• (D1) applying at least one security policy for the private network to determine whether the communication should be permitted to be transmitted to a private network resource that is the private network resource;
• and
• (D2) if it is determined in act (D1) that the communication should be permitted, transmitting the communication to the private resource;
• (E) receiving, at the edge resource, a second communication from a second client computer, the communication including a second identifier;
• (F) applying the at least one security policy for the private network to determine whether the communication should be transmitted to a second private network resource that is an intended recipient of the second communication;
• and
• (G) if it is determined in act (F) that the second communication should not be permitted, not transmitting the second communication,
• wherein a first Domain Name System (DNS) server is connected to the private network and outside and private DNS entries are stored in a data store that is included in the first DNS server, wherein the outside and private DNS entries are used to resolve identifiers for resources connected to both the private network and the outside network;
• wherein a second DNS server is connected to the outside network and outside DNS entries are stored in a data store that is included in the second DNS server;
• wherein the outside DNS entries are used to resolve identifiers for resources connected to the outside network.

An apparatus for use in a computer system comprising a private network having a private network resource and an edge resource accessible from outside the private network, the apparatus comprising:

• at least one processor programmed to determine an intended recipient within the private network of a communication received by the edge resource from a client outside the private network by:
• examining a header of the communications that contains an identifier associated with the intended recipient of the communication, the identifier being resolvable on the private network to a first Internet Protocol (IP) address for the intended recipient and resolvable outside the private network to a second IP address for the edge resource;
• resolving the identifier, on the private network, to the first IP address of the intended recipient of the communication, the resolving comprising providing the identifier associated with the intended recipient to a first Domain Name System (DNS) server of the private network, and, receiving the first IP address of the intended recipient from the first DNS server of the private network, the first Domain Name System (DNS) server being different from the intended recipient and the edge resource;
• and
• transmitting the communication to the first IP address of the intended recipient, the intended recipient being the private network resource, wherein transmitting the communication to the intended recipient comprises:
• applying at least one security policy for the private network to determine whether the communication should be permitted to be transmitted to a private network resource that is the intended recipient of the communication;
• and
• if it is determined that the communication should be permitted, transmitting the communication,
• wherein the at least one process is further programmed to:
• receive, at the edge resource, a second communication from a second client, the communication including a second identifier;
• apply the at least one security policy for the private network to determine whether the communication should be transmitted to a second private network resource that is an intended recipient of the second communication;
• and
• if it is determined that the second communication should not be permitted, not transmitting the second communication,
• wherein the first DNS server is connected to the private network and outside and private DNS entries are stored in a data store that is included in the first DNS server, wherein the outside and private DNS entries are used to resolve identifiers for resources connected to both the private network and the outside network;
• wherein a second DNS server is connected to the outside network and outside DNS entries are stored in a data store that is included in the second DNS server;
• wherein the outside DNS entries are used to resolve identifiers for resources connected to the outside network.