Infrastructure distributed denial of service protection

A system comprising:

• a memory;
• and
• a processor operatively coupled to the memory, the processor to:
• announce, as an interne protocol (IP) address associated with a server of a plurality of servers, a first anycast IP address, the first anycast IP address being one of a plurality of anycast IP addresses that each serve as an anycast address for a network of edge servers, the first anycast IP address allocated specifically to the server, and wherein each of the plurality of anycast IP addresses is allocated to a respective server of the plurality of servers by the network of edge servers;
• receive, at the network of edge servers, an incoming network packet intended for the server, the incoming network packet identified using the first anycast IP address;
• determine, by the network of edge servers, whether the incoming network packet is legitimate;
• and
• in response to determining that the incoming network packet is legitimate, route the incoming network packet to the server using a generic routing encapsulation (GRE) tunnel.

A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processor, cause the processor to:

• announce, as an interne protocol (IP) address associated with a server of a plurality of servers, a first anycast IP address, the first anycast IP address being one of a plurality of anycast IP addresses that each serve as an anycast address for a network of edge servers, the first anycast IP address allocated specifically to the server, and wherein each of the plurality of anycast IP addresses is allocated to a respective server of the plurality of servers by the network of edge servers;
• receive, at the network of edge servers, an incoming network packet intended for the server, the incoming network packet identified using the first anycast IP address;
• determine, by the network of edge servers, whether the incoming network packet is legitimate;
• and
• in response to determining that the incoming network packet is legitimate, route, by the processor, the incoming network packet to the server using a generic routing encapsulation (GRE) tunnel.