I work at Cloudflare. We offer protection for the "complex setups" you describe with BYO ASN, IP packet filtering + forwarding, and GRE (or PNI) for traffic ret

I work at Cloudflare. We offer protection for the "complex setups" you describe with BYO ASN, IP packet filtering + forwarding, and GRE (or PNI) for traffic return. And we're very good at it. https://www.cloudflare.com/case-studies/wikimedia-foundation https://www.cloudflare.com/case-studies/wikimedia-foundation is an example deployment covering Wikimedia's datacenters.