[Rasbora]

Whenever I see the name Marek Majkowski come up, I know the blog post is going to be good.

I had to solve this exact problem a year ago when attempting to build an anycast forward proxy, quickly came to the conclusion that it'd be impossible without a massive infrastructure presence. Ironically I was using CF connections to debug how they might go about this problem, when I realized they were just using local unicast routes for egress traffic I stopped digging any deeper.

Maintaining a routing table in unimog to forward lopsided egress connections to the correct DC is brilliant and shows what is possible when you have a global network to play with, however I wonder if this opens up an attack vector where previously distributed connections are now being forwarded & centralized at a single DC, especially if they are all destined for the same port slice...

[deftoast]

I think this is no worse than using unicast IPs - they can probably reuse the same firewall technology to guard against attacks as before.

[jxhdkdhdks]

you wonder about an attack and everyone else wonder if that was the main point of all this.