Modern CDNs employ various software on their edges: web caching and load balancing HTTPS proxies to deliver and cache client content, web application firewalls to block web attacks and typically DPDK- or XDP-based custom solutions to mitigate volumetric DDoS attacks.

In this talk we discuss the open source software typically used to build the data plane even on very powerful CDN edges (e.g. Nginx and ModSecurity). While you can quickly build your own CDN edge using the popular open source software, there are limitations and corner use cases, which lead nearly every CDN at some point to deep modifications of Nginx and writing their own XDP- or DPDK-based software.

Tempesta FW is an open source hybrid of an HTTPS accelerator and firewall, which was designed specifically for the CDN use cases. Tempesta FW is built into the Linux TCP/IP stack, so it perfectly integrates with Linux netfilter to provide multi-layer firewalling rules. SIMD-accelerated HTTP parser and very fast TLS handshakes allow it to process HTTPS transaction with smallest latency. However, it also has its own limitations and it should be integrated with other open source software to to get the most powerful CDN edges.