4 ms·

How to Build an Anycast Network

23 points by crcastle 5y ago

zamadatix 5y ago
It's highly unlikely you want to run your own BGP presence on the internet. If you just want to play with anycast services locally to get a feel or testing in before deploying it on someone else's reliable and secured routing infrastructure and worldwide presence then rather than going through the trouble of getting an ASN and peering with the actual internet you can just use a few linux VMs locally and something simple like OSPF (or even static routes depending how you simulate the failures). Or even the same guide without bothering to peer with the internet (if you can trust the packets don't care the address is actually publicly reachable). OTOH if you do actually want to run your own anycast netowrk on the public internet I recommend reading a lot more than the manual on quagga or BIRD, particularly some resources like "Protecting the Integrity of Internet Routing: Border Gateway Protocol (BGP) Route Origin Validation". It's a bit like an email server, easy to set up but hard to set up properly.
- jacobkiers 5y ago
  For playing with this, there is also DN42 (https://dn42.dev/Home https://dn42.dev/Home). No direct experience though, I'd like to try it out some day.
lenovouser 5y ago
How were you handling DDoS attacks at Vultr/EquinixMetal? As far as I understand it they offer zero protection at all
- anurag 5y ago
  Great point and clearly coming from experience! This is partly why we moved on from Vultr and Equinix Metal. We'll blog about our new setup soon.
  - lenovouser 5y ago
    Yeah, we’re currently thinking about using a third provider with BGP and DDoS protection for the announced blocks and only tunneling it through there when we are being DDoSed but said provider only offers servers in three locations (Luxembourg, New York and Las Vegas) and has no API for automated server ordering etc., so we’ll have to see. Looking forward to reading the follow-up blog post!
CaliforniaKarl 5y ago
We’ve had great success with using Anycast for campus DNS. Two IPv4 and two IPv6 addresses map to something like four or six recursive DNS servers. Since that went live, I can’t think of a single instance of a server failure impacting DNS. We’ve had network outages, sure, but nothing specific to DNS or Anycast.
preisschild 5y ago
Does anyone here can link to a good blog post about setting up BGP using Bird correctly (over a tunnelbroker)? Been meaning to announce my v6 address range for a long time now, but can't figure it out on my own apparently.
deleted 5y ago
[deleted]

23 points by crcastle 5y ago

It's highly unlikely you want to run your own BGP presence on the internet. If you just want to play with anycast services locally to get a feel or testing in before deploying it on someone else's reliable and secured routing infrastructure and worldwide presence then rather than going through the trouble of getting an ASN and peering with the actual internet you can just use a few linux VMs locally and something simple like OSPF (or even static routes depending how you simulate the failures). Or even the same guide without bothering to peer with the internet (if you can trust the packets don't care the address is actually publicly reachable). OTOH if you do actually want to run your own anycast netowrk on the public internet I recommend reading a lot more than the manual on quagga or BIRD, particularly some resources like "Protecting the Integrity of Internet Routing: Border Gateway Protocol (BGP) Route Origin Validation". It's a bit like an email server, easy to set up but hard to set up properly.

jacobkiers 5y ago
For playing with this, there is also DN42 (https://dn42.dev/Home https://dn42.dev/Home). No direct experience though, I'd like to try it out some day.

lenovouser 5y ago

How were you handling DDoS attacks at Vultr/EquinixMetal? As far as I understand it they offer zero protection at all

anurag 5y ago
Great point and clearly coming from experience! This is partly why we moved on from Vultr and Equinix Metal. We'll blog about our new setup soon.
- lenovouser 5y ago
  Yeah, we’re currently thinking about using a third provider with BGP and DDoS protection for the announced blocks and only tunneling it through there when we are being DDoSed but said provider only offers servers in three locations (Luxembourg, New York and Las Vegas) and has no API for automated server ordering etc., so we’ll have to see. Looking forward to reading the follow-up blog post!

CaliforniaKarl 5y ago

We’ve had great success with using Anycast for campus DNS. Two IPv4 and two IPv6 addresses map to something like four or six recursive DNS servers. Since that went live, I can’t think of a single instance of a server failure impacting DNS. We’ve had network outages, sure, but nothing specific to DNS or Anycast.

preisschild 5y ago

Does anyone here can link to a good blog post about setting up BGP using Bird correctly (over a tunnelbroker)? Been meaning to announce my v6 address range for a long time now, but can't figure it out on my own apparently.

deleted 5y ago

[deleted]