How to Build an Anycast Network
render.com
How to Build an Anycast Network
1–9 of 9 posts
Re: How to Build an Anycast Network
#2It's highly unlikely you want to run your own BGP presence on the internet. If you just want to play with anycast services locally to get a feel or testing in before deploying it on someone else's reliable and secured routing infrastructure and worldwide presence then rather than going through the trouble of getting an ASN and peering with the actual internet you can just use a few linux VMs locally and something simple like OSPF (or even static routes depending how you simulate the failures). Or even the same guide without bothering to peer with the internet (if you can trust the packets don't care the address is actually publicly reachable).
OTOH if you do actually want to run your own anycast netowrk on the public internet I recommend reading a lot more than the manual on quagga or BIRD, particularly some resources like "Protecting the Integrity of Internet Routing: Border Gateway Protocol (BGP) Route Origin Validation". It's a bit like an email server, easy to set up but hard to set up properly.
Re: How to Build an Anycast Network
#3How were you handling DDoS attacks at Vultr/EquinixMetal? As far as I understand it they offer zero protection at all
Re: How to Build an Anycast Network
#4We’ve had great success with using Anycast for campus DNS. Two IPv4 and two IPv6 addresses map to something like four or six recursive DNS servers. Since that went live, I can’t think of a single instance of a server failure impacting DNS. We’ve had network outages, sure, but nothing specific to DNS or Anycast.
Re: How to Build an Anycast Network
#5How were you handling DDoS attacks at Vultr/EquinixMetal? As far as I understand it they offer zero protection at all
Great point and clearly coming from experience! This is partly why we moved on from Vultr and Equinix Metal. We'll blog about our new setup soon.
Re: How to Build an Anycast Network
#6Does anyone here can link to a good blog post about setting up BGP using Bird correctly (over a tunnelbroker)?
Been meaning to announce my v6 address range for a long time now, but can't figure it out on my own apparently.
Re: How to Build an Anycast Network
#7[deleted]
Re: How to Build an Anycast Network
#8It's highly unlikely you want to run your own BGP presence on the internet. If you just want to play with anycast services locally to get a feel or testing in before deploying it on someone else's reliable and secured routing infrastructure and worldwide presence then rather than going through the trouble of getting an ASN and peering with the actual internet you can just use a few linux VMs locally and something sim…
For playing with this, there is also DN42 (https://dn42.dev/Home).
No direct experience though, I'd like to try it out some day.
Re: How to Build an Anycast Network
#9How were you handling DDoS attacks at Vultr/EquinixMetal? As far as I understand it they offer zero protection at all
Great point and clearly coming from experience! This is partly why we moved on from Vultr and Equinix Metal. We'll blog about our new setup soon.
Yeah, we’re currently thinking about using a third provider with BGP and DDoS protection for the announced blocks and only tunneling it through there when we are being DDoSed but said provider only offers servers in three locations (Luxembourg, New York and Las Vegas) and has no API for automated server ordering etc., so we’ll have to see. Looking forward to reading the follow-up blog post!