2

I've looked into Cloudflare's "Magic Transit" and I do understand the basic concept of it. However, I do not understand why it would ever work that Cloudflare could return traffic to you (via e.g. IPSec) when every traffic should get routed to Cloudflare itself.

So Cloudflare announces your IP via BGP, say 1.2.3.0/24, and so everybody (every AS) would start sending traffic to Cloudflare instead of sending it to your ISP. Now all the magic stuff happens there (DDoS-protection, whatever) and then the "clean" traffic gets sent back to you via some tunnel (e.g. IPSec) - but the route to your IP-range still points to Cloudflare, so it wouldn't work. So I thought it might work if everybody else except your ISP would host that route from Cloudflare, but that means if someone else is having the same ISP as you, he would directly send the traffic to you (within the same ISP network) instead of sending it to Cloudflare.

So what's exactly the "trick" behind it, that Cloudflare can send traffic to you (as 1.2.3.0/24) but everyone else gets routed to Cloudflare?

Cloudflare here is just an example, of course it will work with other providers/solutions too. Thanks very much!

Improve this question

2 Answers 2

Reset to default
0

With that scheme you stop announcing your addresses directly. Instead, Cloudflare announce for you. That pulls all traffic from third parties to Cloudflare.

Then, Cloudflare route that traffic (after doing their things) into a tunnel that you've established with them. (For the tunnel itself you need to use an additional address from your ISP or IX, not from the range announced by Cloudflare.) For you, the ingress interface changes from general WAN to the tunnel interface.

The return traffic you either route back into the tunnel or send directly ("egress via direct server return"). The original requester shouldn't see a difference either way.

Improve this answer
1
  • Aaaah, now it makes sense... Using a seperate IP for the tunnel is what makes it possible at all. But that means that you won't have any protection for the tunnel IP in case it's public...
    – BlackFlag
    Jan 1, 2023 at 14:43
0

Cloudflare will do the BGP advertisment for your subnet. Also it would have the static routes to route traffic destined for your public subnet towards the tunnel after traffic has been scrubbed.

Important thing to note here is only incoming traffic will be handled by cloudflare while egress traffic for internet will pass directly

Improve this answer
1
  • this is more or less what I've mentioned in my question, so your answer doesn't really add something new here...
    – BlackFlag
    Jan 1, 2023 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.