Patent ID: 8259571

Claim:
A system, comprising: a data processing apparatus external to a plurality of logically independent internet protocol (IP) subnets; a memory store in data communication with the data processing apparatus and storing computer-readable instructions executable by the data processing apparatus and that upon execution cause the data processing apparatus to perform operations comprising: for each logically independent IP subnet: hosting a tunnel endpoint, the tunnel endpoint being for a corresponding tunnel connection between the data processing apparatus and the logically independent IP subnet, the tunnel endpoint being identified by a tunnel identifier; receiving tunnel packets through the tunnel, each tunnel packet encapsulating a payload packet, the payload packet including a packet source address and a packet destination address, the packet source address defining a source IP address and a source port number, the source IP address being an IP address assigned to a device in the logically independent subnet with which the corresponding tunnel connection is established, and the packet destination address defining a destination IP address to which the payload packet is addressed; generating a source identifier from the tunnel identifier and packet address; mapping the source identifier to a translated packet source address; and addressing the payload packet to the destination address using the translated packet source address; wherein: generating the source identifier from the tunnel identifier and packet address comprises generating the source identifier from the tunnel identifier, source IP address, and source port number; and mapping the source identifier to the translated packet source address comprises: generating, by the data processing apparatus, a new source IP address and a new port number; and mapping the source identifier to the new source IP address and the new port number.