Network layer performance and security provided by a distributed cloud computing network
A first computing device of a distributed cloud computing network receives an IP packet that is destined to an origin server of an origin network. The first computing device processes the received IP packet and encapsulates the IP packet inside an outer packet to generate an encapsulated packet, where the outer packet has a source IP address that is advertised as an anycast IP address at the distributed cloud computing network, and a destination IP address of an origin router of the origin network. The encapsulated packet is transmitted to the origin router.
1. A method in a distributed cloud computing network that includes a plurality of computing devices, the method comprising:
receiving a first IP packet at a first one of the plurality of computing devices of the distributed cloud computing network, wherein the received first IP packet is destined to a first origin server of a first origin network;
processing the received first IP packet at the first computing device;
encapsulating the processed first IP packet inside a first outer packet to generate a first encapsulated packet, wherein the first outer packet has a source IP address that is advertised as a first anycast IP address at the distributed cloud computing network, and wherein the first outer packet has a first destination IP address of a first origin router of the first origin network; and
transmitting the first encapsulated packet to the destination IP address of the first origin router.
2. The method of claim 1 , wherein processing the received first IP packet at the first computing device includes performing a distributed denial of service (DDoS) mitigation on the first IP packet.
3. The method of claim 1 , wherein the received first IP packet has a second destination IP address that is a second anycast IP address that is advertised at the distributed cloud computing network.
4. The method of claim 3 , further comprising:
wherein the first IP packet is received from a first client device;
wherein the second anycast IP address is advertised by each of the plurality of computing devices of the distributed cloud computing network;
receiving, at a second one of the plurality of computing devices, a second encapsulated packet from the first origin router in response to the transmitted first encapsulated packet, the second encapsulated packet having been directed to the second anycast IP address;
processing, at the second computing device, the second encapsulated packet including decapsulating the second encapsulated packet to reveal a second IP packet; and
transmitting, by the second computing device, the second IP packet to the first client device.
5. The method of claim 3 , further comprising:
receiving, from a second client device, a second IP packet at the first computing device, wherein the received second IP packet is destined to a second origin server of a second origin network;
processing the received second IP packet at the first computing device;
encapsulating the processed second IP packet inside a second outer packet to generate a second encapsulated packet, wherein the second outer packet has a source IP address that is advertised as a third anycast IP address at the distributed cloud computing network, and wherein the second outer packet has a third destination IP address of a second origin router of the second origin network;
transmitting the second encapsulated packet to the destination IP address of the second origin router for the second origin network;
receiving, at a second one of the plurality of computing devices, a third encapsulated packet from the second origin router in response to the transmitted second encapsulated packet, the third encapsulated packet being directed to the third anycast IP address;
processing, at the second computing device, the third encapsulated packet including decapsulating the third encapsulated packet to reveal a third IP packet; and
determining, using a probability map based on an IP address of the second client device, that an ingress for a packet flow of the third IP packet is the first computing device, and responsive to this determining, transmitting the third IP packet from the second computing device to the first computing device;
processing, at the first computing device, the third IP packet; and
transmitting, by the first computing device, the third IP packet to the second client device.
6. The method of claim 3 , further comprising:
receiving, from a second client device, a second IP packet at the first computing device, wherein the received second IP packet is destined to a second origin server of a second origin network;
processing the received second IP packet at the first computing device;
modifying the processed second IP packet by changing its source IP address to an IP address of the first computing device to create a modified third IP packet;
encapsulating the modified third IP packet inside a second outer packet to generate a second encapsulated packet, wherein the second outer packet has a source IP address that is advertised as a third anycast IP address at the distributed cloud computing network, and wherein the second outer packet has a third destination IP address of a second origin router of the second origin network;
transmitting the second encapsulated packet to the destination IP address of the second origin router for the second origin network;
receiving, at a second one of the plurality of computing devices, a third encapsulated packet from the second origin router in response to the transmitted second encapsulated packet, the third encapsulated packet being directed to the third anycast IP address;
processing, at the second computing device, the third encapsulated packet including decapsulating the third encapsulated packet to reveal a fourth IP packet;
transmitting the fourth IP packet from the second computing device to the first computing device;
processing, at the first computing device, the fourth IP packet; and
transmitting, by the first computing device, the fourth IP packet to the second client device.
7. The method of claim 6 , wherein processing the received second IP packet and processing the fourth IP packet include performing layer 4 and/or layer 7 processing.
8. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor, cause the processor to perform operations comprising:
receiving a first IP packet at a first one of a plurality of computing devices of a distributed cloud computing network, wherein the received first IP packet is destined to a first origin server of a first origin network;
processing the received first IP packet at the first computing device;
encapsulating the processed first IP packet inside a first outer packet to generate a first encapsulated packet, wherein the first outer packet has a source IP address that is advertised as a first anycast IP address at the distributed cloud computing network, and wherein the first outer packet has a first destination IP address of a first origin router of the first origin network; and
transmitting the first encapsulated packet to the destination IP address of the first origin router.
9. The non-transitory machine-readable storage medium of claim 8 , wherein processing the received first IP packet at the first computing device includes performing a distributed denial of service (DDoS) mitigation on the first IP packet.
10. The non-transitory machine-readable storage medium of claim 8 , wherein the received first IP packet has a second destination IP address that is a second anycast IP address that is advertised at the distributed cloud computing network.
11. The non-transitory machine-readable storage medium of claim 10 , wherein the operations further comprise:
wherein the first IP packet is received from a first client device;
wherein the second anycast IP address is advertised by each of the plurality of computing devices of the distributed cloud computing network;
receiving, at a second one of the plurality of computing devices, a second encapsulated packet from the first origin router in response to the transmitted first encapsulated packet, the second encapsulated packet having been directed to the second anycast IP address;
processing, at the second computing device, the second encapsulated packet including decapsulating the second encapsulated packet to reveal a second IP packet; and
transmitting, by the second computing device, the second IP packet to the first client device.
12. The non-transitory machine-readable storage medium of claim 10 , wherein the operations further comprise:
receiving, from a second client device, a second IP packet at the first computing device, wherein the received second IP packet is destined to a second origin server of a second origin network;
processing the received second IP packet at the first computing device;
encapsulating the processed second IP packet inside a second outer packet to generate a second encapsulated packet, wherein the second outer packet has a source IP address that is advertised as a third anycast IP address at the distributed cloud computing network, and wherein the second outer packet has a third destination IP address of a second origin router of the second origin network;
transmitting the second encapsulated packet to the destination IP address of the second origin router for the second origin network;
receiving, at a second one of the plurality of computing devices, a third encapsulated packet from the second origin router in response to the transmitted second encapsulated packet, the third encapsulated packet being directed to the third anycast IP address;
processing, at the second computing device, the third encapsulated packet including decapsulating the third encapsulated packet to reveal a third IP packet; and
determining, using a probability map based on an IP address of the second client device, that an ingress for a packet flow of the third IP packet is the first computing device, and responsive to this determining, transmitting the third IP packet from the second computing device to the first computing device;
processing, at the first computing device, the third IP packet; and
transmitting, by the first computing device, the third IP packet to the second client device.
13. The non-transitory machine-readable storage medium of claim 10 , wherein the operations further comprise:
receiving, from a second client device, a second IP packet at the first computing device, wherein the received second IP packet is destined to a second origin server of a second origin network;
processing the received second IP packet at the first computing device;
modifying the processed second IP packet by changing its source IP address to an IP address of the first computing device to create a modified third IP packet;
encapsulating the modified third IP packet inside a second outer packet to generate a second encapsulated packet, wherein the second outer packet has a source IP address that is advertised as a third anycast IP address at the distributed cloud computing network, and wherein the second outer packet has a third destination IP address of a second origin router of the second origin network;
transmitting the second encapsulated packet to the destination IP address of the second origin router for the second origin network;
receiving, at a second one of the plurality of computing devices, a third encapsulated packet from the second origin router in response to the transmitted second encapsulated packet, the third encapsulated packet being directed to the third anycast IP address;
processing, at the second computing device, the third encapsulated packet including decapsulating the third encapsulated packet to reveal a fourth IP packet;
transmitting the fourth IP packet from the second computing device to the first computing device;
processing, at the first computing device, the fourth IP packet; and
transmitting, by the first computing device, the fourth IP packet to the second client device.
14. The non-transitory machine-readable storage medium of claim 13 , wherein processing the received second IP packet and processing the fourth IP packet include performing layer 4 and/or layer 7 processing.
15. A first computing device of a plurality of computing devices of a distributed cloud computing network, the first computing device comprising:
a processor; and
a non-transitory machine-readable storage medium that provides instructions that, when executed by the processor, causes the first computing device to perform operations comprising:
receiving a first IP packet at first computing device, wherein the received first IP packet is destined to a first origin server of a first origin network;
processing the received first IP packet at the first computing device,
encapsulating the processed first IP packet inside a first outer packet to generate a first encapsulated packet, wherein the first outer packet has a source IP address that is advertised as a first anycast IP address at the distributed cloud computing network, and wherein the first outer packet has a first destination IP address of a first origin router of the first origin network, and
transmitting the first encapsulated packet to the destination IP address of the first origin router.
16. The first computing device of claim 15 , wherein processing the received first IP packet at the first computing device includes performing a distributed denial of service (DDoS) mitigation on the first IP packet.
17. The first computing device of claim 15 , wherein the received first IP packet has a second destination IP address that is a second anycast IP address that is advertised at the distributed cloud computing network.
18. The first computing device of claim 17 , wherein the operations further comprise:
wherein the first IP packet is received from a first client device;
wherein the second anycast IP address is advertised by each of the computing devices of the distributed cloud computing network;
receiving, at a second one of the plurality of computing devices, a second encapsulated packet from the first origin router in response to the transmitted first encapsulated packet, the second encapsulated packet having been directed to the second anycast IP address;
processing, at the second computing device, the second encapsulated packet including decapsulating the second encapsulated packet to reveal a second IP packet; and
transmitting, by the second computing device, the second IP packet to the first client device.
19. The first computing device of claim 17 , wherein the operations further comprise:
receiving, from a second client device, a second IP packet at the first computing device, wherein the received second IP packet is destined to a second origin server of a second origin network;
processing the received second IP packet at the first computing device;
encapsulating the processed second IP packet inside a second outer packet to generate a second encapsulated packet, wherein the second outer packet has a source IP address that is advertised as a third anycast IP address at the distributed cloud computing network, and wherein the second outer packet has a third destination IP address of a second origin router of the second origin network;
transmitting the second encapsulated packet to the destination IP address of the second origin router for the second origin network;
receiving, at a second one of the plurality of computing devices, a third encapsulated packet from the second origin router in response to the transmitted second encapsulated packet, the third encapsulated packet being directed to the third anycast IP address;
processing, at the second computing device, the third encapsulated packet including decapsulating the third encapsulated packet to reveal a third IP packet; and
determining, using a probability map based on an IP address of the second client device, that an ingress for a packet flow of the third IP packet is the first computing device, and responsive to this determining, transmitting the third IP packet from the second computing device to the first computing device;
processing, at the first computing device, the third IP packet; and
transmitting, by the first computing device, the third IP packet to the second client device.
20. The first computing device of claim 17 , wherein the operations further comprise:
receiving, from a second client device, a second IP packet at the first computing device, wherein the received second IP packet is destined to a second origin server of a second origin network;
processing the received second IP packet at the first computing device;
modifying the processed second IP packet by changing its source IP address to an IP address of the first computing device to create a modified third IP packet;
encapsulating the modified third IP packet inside a second outer packet to generate a second encapsulated packet, wherein the second outer packet has a source IP address that is advertised as a third anycast IP address at the distributed cloud computing network, and wherein the second outer packet has a third destination IP address of a second origin router of the second origin network;
transmitting the second encapsulated packet to the destination IP address of the second origin router for the second origin network;
receiving, at a second one of the plurality of computing devices, a third encapsulated packet from the second origin router in response to the transmitted second encapsulated packet, the third encapsulated packet being directed to the third anycast IP address;
processing, at the second computing device, the third encapsulated packet including decapsulating the third encapsulated packet to reveal a fourth IP packet;
transmitting the fourth IP packet from the second computing device to the first computing device;
processing, at the first computing device, the fourth IP packet; and
transmitting, by the first computing device, the fourth IP packet to the second client device.
21. The first computing device of claim 20 , wherein processing the received second IP packet and processing the fourth IP packet include performing layer 4 and/or layer 7 processing.