Networking and resilience in the cloud — by Cristian Critelli.https://cloudpunk.blog/https://cloudpunk.blog/post/ipam-delegated-rpki/https://cloudpunk.blog/post/ipam-delegated-rpki/In 2018, a hijacked BGP announcement redirected Amazon's own DNS traffic long enough for real cryptocurrency to change hands, because nothing on the internet could cryptographically ask whether the hijacker was allowed to originate that prefix. Amazon VPC IPAM's new delegated RPKI automates the fix for BYOIP customers: AWS now creates, renews, and monitors Route Origin Authorizations at the Regional Internet Registries so nobody has to remember to.Thu, 13 Aug 2026 00:00:00 GMThttps://cloudpunk.blog/post/network-firewall-explicit-proxy/https://cloudpunk.blog/post/network-firewall-explicit-proxy/AWS launched a standalone egress-proxy preview at re:Invent 2025, then quietly rebuilt it eight months later as a mode inside AWS Network Firewall itself. The redesign isn't cosmetic — no-source-preservation mode is the first documented way to centralise egress filtering across VPCs with overlapping CIDR blocks, a problem plain NAT Gateway and Transit Gateway routing can't solve.Thu, 06 Aug 2026 00:00:00 GMThttps://cloudpunk.blog/post/vpc-route-server-bgp/https://cloudpunk.blog/post/vpc-route-server-bgp/For years, keeping a self-managed NAT instance or firewall appliance highly available inside a VPC meant a health-check script rewriting route tables through the EC2 API. AWS's own case study on how ad-tech firm Magnite pushed Amazon VPC Route Server into production shows what changes once BGP, not a script, is the thing deciding your route tables.Thu, 30 Jul 2026 00:00:00 GMThttps://cloudpunk.blog/post/cloudfront-vpc-origins-outage/https://cloudpunk.blog/post/cloudfront-vpc-origins-outage/On 16 July 2026 a single AWS fleet failed to load a routing-config update and every CloudFront distribution using VPC Origins went dark for three and a half hours — Canvas, Blackboard and Hugging Face included. The lesson isn't 'don't hide your origin'; it's that hiding it moves you onto a control plane you don't operate.Thu, 23 Jul 2026 00:00:00 GMThttps://cloudpunk.blog/post/client-vpn-native-tgw/https://cloudpunk.blog/post/client-vpn-native-tgw/Every mature AWS estate has one: a VPC that exists only to host Client VPN ENIs, quietly rewriting every remote user's source IP on the way in. AWS has made it unnecessary — and given security teams their IPs back.Thu, 16 Jul 2026 00:00:00 GMThttps://cloudpunk.blog/post/when-the-network-breaks-dissecting-the-cascading-failures-that-brought-down-aws-azure-and-cloudfl/https://cloudpunk.blog/post/when-the-network-breaks-dissecting-the-cascading-failures-that-brought-down-aws-azure-and-cloudfl/Between July and October 2025, three of the world's most sophisticated infrastructure providers — AWS, Microsoft Azure, and Cloudflare — experienced significant outages that revealed strikingly similar architectural patterns.Mon, 09 Mar 2026 00:00:00 GMThttps://cloudpunk.blog/post/cloud-networking-and-resilience-the-book/https://cloudpunk.blog/post/cloud-networking-and-resilience-the-book/Published by Apress and available now in print and eBook — a practical guide to designing scalable, fault-tolerant, highly-available cloud network architectures.Sat, 07 Mar 2026 00:00:00 GMThttps://cloudpunk.blog/post/understanding-aws-direct-connect-bgp-communities/https://cloudpunk.blog/post/understanding-aws-direct-connect-bgp-communities/Tue, 16 Jul 2024 00:00:00 GMThttps://cloudpunk.blog/post/efa-ena-eni/https://cloudpunk.blog/post/efa-ena-eni/Wed, 07 Feb 2024 00:00:00 GMThttps://cloudpunk.blog/post/rdmavstcp/https://cloudpunk.blog/post/rdmavstcp/Wed, 06 Dec 2023 00:00:00 GMThttps://cloudpunk.blog/post/advanced-as-path-prepending-strategies-for-aws-direct-connect-resiliency/https://cloudpunk.blog/post/advanced-as-path-prepending-strategies-for-aws-direct-connect-resiliency/Sat, 18 Nov 2023 00:00:00 GMThttps://cloudpunk.blog/post/tgw-segmentation/https://cloudpunk.blog/post/tgw-segmentation/Thu, 19 Oct 2023 00:00:00 GMThttps://cloudpunk.blog/post/networking-agi/https://cloudpunk.blog/post/networking-agi/Thu, 28 Sep 2023 00:00:00 GMThttps://cloudpunk.blog/post/basic-intro-bgp/https://cloudpunk.blog/post/basic-intro-bgp/Mon, 11 Sep 2023 00:00:00 GMThttps://cloudpunk.blog/post/demystifying-tcp-understanding-the-fundamentals-of-reliable-network-communication/https://cloudpunk.blog/post/demystifying-tcp-understanding-the-fundamentals-of-reliable-network-communication/Tue, 11 Jul 2023 00:00:00 GMThttps://cloudpunk.blog/post/introtocloudnetworking/https://cloudpunk.blog/post/introtocloudnetworking/Wed, 05 Jul 2023 00:00:00 GMThttps://cloudpunk.blog/post/exploring-the-tech-universe-join-cristian-critelli-on-an-epic-journey/https://cloudpunk.blog/post/exploring-the-tech-universe-join-cristian-critelli-on-an-epic-journey/Welcome, tech enthusiasts! Prepare for an exhilarating adventure as we embark on a journey through the vast landscape of technology.Tue, 04 Jul 2023 00:00:00 GMThttps://cloudpunk.blog/post/real-world-cloud-talk-an-interview-with-a-microsoft-sr-cloud-solution-architect-march-31st-2022/https://cloudpunk.blog/post/real-world-cloud-talk-an-interview-with-a-microsoft-sr-cloud-solution-architect-march-31st-2022/Thu, 31 Mar 2022 00:00:00 GMT