Patent ID: 9723023
Date: 2017-08-01
CPC Classifications: H04L

Claim:
1. A method for protecting a network comprising: receiving, at a name server and from a device in the network, a domain lookup request for a destination outside the network, the domain lookup request including an actual address of the destination; generating a first internal address for the actual address of the destination in response to the domain lookup request, the first internal address is one of a plurality of internal addresses; storing the first internal address and the actual address of the destination as a mapping in a data store within the network and accessible by a network gateway; providing the first internal address to the device in response to the domain lookup request; receiving, at the network gateway, the first internal address and the actual address of the destination from the name server; replacing, at the network gateway based on the mapping, a destination address of an outbound packet having the first internal address with the actual address of the destination; looking up a source address of an inbound packet entering the network in the mapping; replacing, at the network gateway and based on the mapping, the source address of the inbound packet entering the network with the first internal address of the plurality of internal addresses based on the mapping; dropping an outbound packet, at the network gateway, that has at least one of a second internal address of the plurality of internal addresses and a destination address that is not included in the mapping; wherein the name server and the network gateway are coupled by the network and the network gateway operates within the network and between the network and an external network; wherein the actual address comprises an internet protocol (IP) address; wherein, the first internal address is different than the actual address of the destination.