Cloudflare, Inc.

Cloudfare, Inc.

Christopher Philip Branch

Dane Orion Knecht

John Graham-Cumming

Dani Grant

Tom Paseka

Matthew Browning Prince

Rustam Xing Lalkaka

Andrew Taylor Plunk

Oliver Yu

Mohd Irtefa

Naga Sunil Tripirineni

Nick Wondra

Vlad Krasnov

Marek Przemyslaw Majkowski

Gilberto Bertin

An edge server of a distributed edge compute and routing service receives a tunnel connection request from a tunnel client residing on an origin server, that requests a tunnel be established between the edge server and the tunnel client. The request identifies the hostname that is to be tunneled. An IP address is assigned for the tunnel. DNS record(s) are added or changed that associate the hostname with the assigned IP address. Routing rules are installed in the edge servers of the distributed edge compute and routing service to reach the edge server for the tunneled hostname. The edge server receives a request for a resource of the tunneled hostname from another edge server that received the request from a client, where the other edge server is not connected to the origin server. The request is transmitted from the edge server to the origin server over the tunnel.

Establishing and using a tunnel from an origin server in a distributed edge compute and routing service

A request is received from a client device over a Virtual Private Network (VPN) tunnel. The request is received at a first one of a plurality of edge servers of a distributed cloud computing network. A destination of the request is determined and an optimized route for transmitting the request toward an origin server is determined. The optimized route is based at least in part on probe data between edge servers of the distributed cloud computing network. The request is transmitted to a next hop as defined by the optimized route.

Virtual private network (VPN) whose traffic is intelligently routed

A client device establishes a first VPN connection with a VPN server. Traffic is sent from the client device through the first VPN connection that is destined to a different client device that has a second VPN connection with the VPN server. The client device receives a public network address of the different client device and routing metrics from the VPN server. Based at least in part on the routing metrics, the client device determines an optimal route to the different client device, where the optimal route is a connection between the client device and the different client device that does not traverse the VPN server. The client device establishes a VPN connection with the different client device and transmits traffic to that different client device using the VPN connection using the public network address of the different client device.

Method and apparatus of automatic route optimization in a private virtual network for client devices of a local network

A tunnel is established between a first edge server of a distributed edge compute and routing service and a tunnel client residing on an origin server. Routing rules are installed in the edge servers of the distributed edge compute and routing service to reach the first edge server. The routing rules are based at least in part on traffic information gathered from processing other traffic that traverses the distributed edge compute and routing service. A request for content served by the origin server through the tunnel is received at a second edge server of the distributed edge compute and routing service. A path from the second edge server to the first edge server is determined based on the routing rules. The request is transmitted on the determined path. The first edge server receives the request and transmits the request to the origin server over the tunnel.

Traffic optimization in virtual private networks (VPNs) is described. A client device establishes a first VPN connection with a first server according to a first VPN route configuration that specifies a first VPN route to the first server. Flow(s) of traffic is forwarded through the first VPN connection to the first server. The client device receives a second VPN route configuration that specifies a second VPN route to a second server of the plurality of servers for establishing a second VPN connection, where the second VPN connection satisfies a set of traffic optimization criteria. The client device establishes the second VPN connection with the second server according to the second VPN route configuration. Traffic is forwarded through the second VPN connection to the second server.

Method and apparatus for traffic optimization in virtual private networks (VPNs)

A TCP intermediate device receives a SYN packet from a TCP client that is destined for a TCP origin server and indicates support for TCP fast open (TFO). A SYN-ACK packet is transmitted to the TCP client that includes a first TFO cookie set by the TCP intermediate device. An ACK packet is received from the TCP client. A SYN packet is sent to the TCP origin server and a second SYN-ACK packet is received in response that includes a second TFO cookie set by the TCP origin server. An ACK packet to the TCP origin server. Sometime after the TCP connection is completed, a SYN packet from the TCP client is received that includes the first TFO cookie and a payload of data. The TCP intermediate device modifies the SYN packet to include the second TFO cookie and transmits the modified SYN packet to the TCP origin server.

Transparent proxy conversion of transmission control protocol (TCP) fast open connection

Method and apparatus for traffic optimization in virtual private networks (VPNs). A client device establishes a first VPN connection with a first server based on first VPN credentials. Traffic is transmitted and received through the first VPN connection to and from the first server. A second server is identified based on traffic optimization criteria that need to be satisfied by the VPN connection. Upon receipt of the identification of the second server the client device is to use the second server as a destination of a second VPN connection. The second VPN connection satisfies a set of traffic optimization goals for at least one flow from the flows forwarded through the first VPN connection. Based on the identification of the second server, the client device establishes the second VPN connection for the flow between the client device and the second server.

A TCP intermediate device receives a first SYN packet from a TCP client to establish a TCP connection between the TCP client and a TCP origin server. Prior to the TCP connection being fully established, the TCP intermediate device transmits a second SYN packet to the TCP origin server. The TCP intermediate device transmits a first SYN-ACK packet to the TCP client. The TCP intermediate device receives a first ACK packet from the TCP client. The TCP intermediate device receives a second SYN-ACK packet from the TCP origin server. The TCP intermediate device transmits a second ACK packet to the TCP origin server as part of establishing the third TCP connection.

Opportunistic transmission control protocol (TCP) connection establishment

A method and a VPN server for VPN route optimization are described. The VPN server establishes a first VPN connection with a first client device and a second VPN connection with a second client device. The VPN server determines that the first and second client devices are part of a same local network; and responsive to determining that the first and the second client devices are part of the same local network, transmits, to the first client device through the first VPN connection, a second public network address of the second client device, and to the second client device through the second VPN connection, a first public network address of the first client device. The transmission of the first and second public network addresses causes the first client device to determine an optimal route from the first client device to the second client device for the traffic in the VPN.

A TCP intermediate device receives a SYN packet from a TCP client that is destined for a TCP origin server and indicates support for TCP fast open (TFO). A SYN-ACK packet is transmitted to the TCP client that includes a TFO cookie set by the TCP intermediate device. The TCP intermediate device receives a first ACK packet from the TCP client. A SYN packet is sent to the TCP origin server and a second SYN-ACK packet is received in response that does not indicate support for TFO. An ACK packet to the TCP origin server. Sometime after the TCP connection is completed, the TCP intermediate device receives a SYN packet from the TCP client that includes the TFO cookie and a payload of data. The TCP intermediate device establishes a TCP connection with the TCP origin server and transmits the payload of data to the TCP origin server.

Growing community of inventors

Romford, United Kingdom

Christopher Philip Branch