Multiple GRE tunnels towards single host using anycast IP

Question

I'm trying to build the following network architecture:

Where clients try to connect to a backend server (e.g. SSH) by using a Public Anycast IP adddress (1.2.3.4), that routes the client to the closest entrypoint.

There are 2 entrypoints:

Entrypoint 1 in London, with Public IP 3.3.3.3, which receives the traffic from clients in Europe. Entrypoint 2 in Sao Paulo, with Public IP 2.2.2.2, which receives traffic from clients in America. These 2 entrypoints have an established GRE tunnel to the backend server.

So far this works fine if the backend SSH server binds to a specific GRE tunnel interface IP, but then only clients coming from the associated entrypoint GRE address interface can connect.

How can I make so that clients can connect from both entrypoint, i.e. make the backend SSH server "bind" to both GRE interfaces and route the traffic approprietaly depending from which tunnel it came?

Thank you.

Answer 1

You need to make sure that both GRE tunnels route back client packets (just in case) and that the server-to-client metric is the same as the client-to-server metric (to enable symmetric routing).

In case of asymmetric routing (undesired but possible) you need to disable stateful inspection on any firewalls in the path (which breaks with asymmetric routing).

Since you're tunneling, the outside hop count isn't visible by looking at the tunneled packets - the tunnel is always just one hop. You'd need to find a way to assign a usable metric to the tunnel interfaces, either by outside hop distance, latency, probed throughput or whatever makes sense for your use case.