Tell HN: Cloudflare and Scaleway have a peering issue

Issue is solved. The context for anyone interested from one of Scaleway Engineers [1]:

> To give some context, there are a lot of possible path between Cloudflare and Scaleway : France IX in Paris, NL IX in Paris and in Amsterdam, AMS IX in Amsterdam, and the transit in both region (Cogent, Lumen, Arelion). Cloudflare is announcing some prefixes only on some of these links.

> We were trying to find the root cause since Monday morning, but as we did not have any errors visible on our side, it was pretty hard to identify the faulty path.

Another fun fact from Scaleway CTO is that Cloudflare started answering ... just ~30 minutes ago. [2]

[1] https://scaleway-community.slack.com/archives/C7Z76CCUE/p167...

[2] https://scaleway-community.slack.com/archives/C7Z76CCUE/p167...

Hopefully not because of this submission, some more updates started flowing on the Scaleway side [1], but nothing solving the issue.

The are some workarounds (from Marco@ [2])

> moving workload out of scaleway to other datacenters and keeping all cloudflare CDN and features working perfectly (seems to be affecting exclusively scaleway/online.net)

> disabling all cloudflare features (DNS only) (some people can’t do it as cloudflare could be integral part of webapps flow and servings)

But applying those can't be done in all cases (i.e. disables Cloudflare WAF, CDN, etc.).

[1] https://status.scaleway.com/incidents/y19hcz28rkwp

[2] https://scaleway-community.slack.com/archives/C7Z76CCUE/p167...

I had to resolve a similar connectivity issue for a client a couple months ago. The server was in Canada, but for some reason, Cloudflare's Asia-Pacific PoPs didn't want to reach this server and returned 525 SSL Handshake Failed error instead. So, I went ahead to install Cloudflare Tunnel, because I know that instead of waiting for Cloudflare to move through the Internet up to the last mile to the origin, I could establish long-lived connections to them over multiple PoPs so that the traffic from entry PoP(s) would stay in Cloudflare's network perimeter. This is assuming that your Tunnel connections are healthy no matter what. And the problem was gone.

The path basically transitioned from:

Entry PoP <----> Origin

to:

Entry PoP <----> Tunnel PoP <----> Origin

We are also affected by this since Sunday. All our sites hosted in scaleway with Cloudflare are very slow to load (sometimes up to 30 seconds) and we get back 520 errors every now and then.

Traffic to cloudflare seems to be going thru NL-IX for instance...

Even on zones where we have tiered caching and cloudflare report CDG as both main and backup pops