DISTRIBUTING OVERLAY NETWORK INGRESS INFORMATION
FIG5 is yet another diagram of the system of FIG1
The client device may receive the response and use the additional data to set up a connection. For example, if the additional data has been encrypted, the client device may decrypt the additional data in order to access the information additional data identifying bastion host 180, the port for the bastion host, and the connection method. As shown in FIG5, client device 110 may then request to connect to resource R-2 via bastion host 180 by way of the connection method identified in the response 410. Bastion host 180 may verify the request based on the connection method used by client device 110. If the request is not verified, the bastion host 180 may deny the client device access to the resource R-2. If the request is verified, the bastion host may establish connection 510 between the bastion host and the client device. In one example, connection 510 may be a tunnel connection though network 150.
diagram
160
network
180
bastion host
190
bastion hosts bastion host
510
connection
110
client device client devices
150
network networks
170
bastion hosts bastion host
120
DNS
['1. A computer-implemented method for providing a resource record for reaching a protected resource of a first network, the method comprising: receiving, over a second network from a client device, a request identifying the protected resource; querying memory to identify a network address of the protected resource; determining, by a processor, whether the protected resource is generally accessible based on the identified network address, wherein a resource is generally accessible if it is not in shared address space; if the protected resource is not generally accessible, identifying reachability information for the protected resource; generating additional information based on the reachability information; and transmitting the additional information and the network address to the client device.', '4. A computer-implemented method for accessing a publically available resource of a first, public network, the method comprising: transmitting, over a second, private network, a request identifying the public resource; receiving, from an authentication server, information identifying a bastion host, a port, and a connection method; generating, by a processor, a request to access the public resource based on the connection method; transmitting the request to the port in order to establish a tunnel connection between the bastion host and the client device; and accessing the public resource via the tunnel connection with the bastion host.', '5. The method of claim 4, wherein the authentication server is a DNS server that provides network addresses in response to queries from client devices associated with network locations within the first, private network.']