Clientless SSL-VPN URL Rewriting for Zero-Configuration Split Tunneling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional SSL VPN approaches face challenges in split tunneling for clientless environments, particularly in distinguishing intranet traffic from internet traffic without additional plugins, leading to cumbersome configuration requirements and limitations in accessing web-based resources.
Innovation Solution
The system identifies absolute URLs and determines whether they belong to an intranet or internet domain, rewriting URLs using a unique string identifier to enable seamless access to internal resources without client-side plugin installation, allowing zero-configuration split-tunneling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a VPN plug-in is installed on the client to enable split tunneling, then intranet traffic can be distinguished and routed correctly, but the complexity of the system increases and clientless access is no longer possible
Solution Approach 1:
The gateway device acts as an intermediary that performs URL rewriting on server responses. The gateway intercepts HTTP responses, identifies absolute URLs referencing intranet resources, and rewrites them to include the gateway's hostname as a prefix. This intermediary processing at the gateway eliminates the need for client-side VPN plug-ins, as the routing information is embedded directly in the rewritten URLs that the client's browser processes automatically.
Solution Approach 2:
The client's web browser performs self-service by automatically resolving the rewritten URLs through standard DNS lookup. When the browser encounters a rewritten URL containing the gateway's hostname, it independently queries the DNS server, receives the gateway's IP address, and routes the request accordingly. This self-service mechanism eliminates the need for external VPN plug-in software on the client device.
2Reliability
If administrators manually configure IP address ranges and netmasks for each intranet domain, then split tunneling can be implemented, but the configuration becomes cumbersome and difficult to maintain
Solution Approach 1:
The system changes the parameter representation from static IP address ranges and netmasks to dynamic URL rewriting rules. Instead of configuring numerical IP ranges that administrators must manually match against every intranet domain, the gateway uses hostname-based URL rewriting with configurable patterns. This allows administrators to define intranet domains using simple hostname patterns that are automatically matched against URLs in HTTP responses, significantly simplifying configuration and maintenance.
Solution Approach 2:
The gateway performs preliminary URL rewriting on server responses before they reach the client. By pre-processing the HTTP responses and embedding routing information in the rewritten URLs, the system eliminates the need for administrators to configure complex IP range mappings. The rewriting rules are established in advance and automatically applied to all matching URLs, providing a maintainable configuration approach.
3Reliability
If the gateway distinguishes between intranet and internet traffic, then secure access to internal resources is enabled, but the gateway requires additional processing capability
Solution Approach 1:
The gateway applies partial processing only to HTTP response content that contains absolute URLs. Instead of analyzing all traffic or performing deep packet inspection of every protocol, the gateway focuses specifically on rewriting URL patterns in HTTP responses. This selective approach processes only the necessary portion of the traffic data, reducing overall processing power requirements while maintaining security control through URL-based routing.
Solution Approach 2:
The system replaces complex mechanical traffic analysis with pattern-matching URL rewriting. Instead of using resource-intensive methods like deep packet inspection or stateful firewall processing to distinguish intranet from internet traffic, the gateway uses text-based pattern matching on URL strings. This substitution of processing mechanics significantly reduces computational overhead while achieving the same security and routing objectives.
Data Source
AI summary
Described embodiments provide systems and methods for rewriting an URL in a message transmitted via a clientless SSL VPN session. An intermediary device may identify, in a HTTP response transmitted via the session, an absolute URL that includes a hostname of the server. The device may determine that the absolute URL includes an intranet domain name. The device may generate, responsive to the determination, a URL segment by combining a unique string corresponding to the hostname of the server, with a hostname of the device. The device may rewrite, responsive to the determination, the absolute URL by replacing the server hostname in the absolute URL with the generated URL segment. A DNS server for the client may be configured with a DNS entry comprising a wildcard combined with the device hostname, to cause the DNS server to resolve the rewritten absolute URL to an IP address of the device.