Abusing Linux's firewall: the hack that allowed us to build Spectrum
Apr 12, 2018Marek Majkowski
Summary
This post introduces Cloudflare Spectrum, a new feature that extends DDoS protection, load balancing, and content acceleration to any TCP-based protocol. It details the technical challenges of accepting connections on any port (1-65535) and IP address on Linux edge servers, and how these were overcome using the 'AnyIP' trick for IP address assignment and the obscure 'TPROXY' iptables module combined with the IP_TRANSPARENT socket option. This allows for binding to any port without relying on conntrack or custom kernel patches, demonstrating a novel application of Linux networking capabilities for enhanced security and flexibility.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack