Abusing Linux's firewall: the hack that allowed us to build Spectrum

What this post added

This post introduces Cloudflare Spectrum, a new feature that extends DDoS protection, load balancing, and content acceleration to any TCP-based protocol. It details the technical challenges of accepting connections on any port (1-65535) and IP address on Linux edge servers, and how these were overcome using the 'AnyIP' trick for IP address assignment and the obscure 'TPROXY' iptables module combined with the IP_TRANSPARENT socket option. This allows for binding to any port without relying on conntrack or custom kernel patches, demonstrating a novel application of Linux networking capabilities for enhanced security and flexibility.