Saved 35% on Networking: Benchmarking Cloudflare Tunnel vs. AWS Direct Connect vs. GCP Cloud Interconnect

import time
import requests
import statistics
import json
import logging
from typing import List, Dict

# Configure logging for benchmark results
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s - %(levelname)s - %(message)s",
    handlers=[logging.FileHandler("tunnel_benchmark.log"), logging.StreamHandler()]
)

class TunnelBenchmarker:
    """Benchmark Cloudflare Tunnel, Direct Connect, and Cloud Interconnect throughput and latency."""

    def __init__(self, endpoint: str, auth_token: str, payload_size_mb: int = 100):
        self.endpoint = endpoint
        self.auth_token = auth_token
        self.payload_size_mb = payload_size_mb
        self.payload = b"x" * (payload_size_mb * 1024 * 1024)  # Generate test payload
        self.results: List[Dict] = []

    def run_latency_test(self, iterations: int = 100) -> float:
        """Measure p99 latency over specified iterations."""
        latencies = []
        headers = {"Authorization": f"Bearer {self.auth_token}"}

        for i in range(iterations):
            try:
                start = time.perf_counter()
                response = requests.get(
                    f"{self.endpoint}/health",
                    headers=headers,
                    timeout=10
                )
                end = time.perf_counter()

                if response.status_code != 200:
                    logging.error(f"Latency test {i} failed: {response.status_code}")
                    continue

                latencies.append((end - start) * 1000)  # Convert to ms

            except requests.exceptions.RequestException as e:
                logging.error(f"Latency test {i} exception: {str(e)}")
                continue

        if not latencies:
            raise RuntimeError("No valid latency measurements collected")

        latencies.sort()
        p99_index = int(len(latencies) * 0.99)
        return latencies[p99_index]

    def run_throughput_test(self, duration_sec: int = 60) -> float:
        """Measure throughput in Gbps over specified duration."""
        start_time = time.perf_counter()
        total_bytes = 0
        headers = {
            "Authorization": f"Bearer {self.auth_token}",
            "Content-Type": "application/octet-stream"
        }

        while (time.perf_counter() - start_time) < duration_sec:
            try:
                response = requests.post(
                    f"{self.endpoint}/upload",
                    headers=headers,
                    data=self.payload,
                    timeout=30
                )

                if response.status_code == 200:
                    total_bytes += len(self.payload)
                else:
                    logging.error(f"Throughput test failed: {response.status_code}")

            except requests.exceptions.RequestException as e:
                logging.error(f"Throughput test exception: {str(e)}")
                continue

        elapsed = time.perf_counter() - start_time
        if elapsed == 0:
            return 0.0

        # Convert bytes to Gbps: (total_bytes * 8) / (elapsed * 1e9)
        return (total_bytes * 8) / (elapsed * 1e9)

    def save_results(self, filename: str = "benchmark_results.json"):
        """Persist benchmark results to JSON."""
        with open(filename, "w") as f:
            json.dump(self.results, f, indent=2)
        logging.info(f"Results saved to {filename}")

if __name__ == "__main__":
    # Configuration for Cloudflare Tunnel endpoint
    CLOUDFLARE_ENDPOINT = "https://tunnel-benchmark.example.com"
    AUTH_TOKEN = "cf-tunnel-token-2024-09"  # Replace with valid token
    PAYLOAD_SIZE_MB = 100
    ITERATIONS = 100
    DURATION_SEC = 60

    benchmarker = TunnelBenchmarker(
        endpoint=CLOUDFLARE_ENDPOINT,
        auth_token=AUTH_TOKEN,
        payload_size_mb=PAYLOAD_SIZE_MB
    )

    logging.info("Starting Cloudflare Tunnel benchmark...")

    try:
        p99_latency = benchmarker.run_latency_test(iterations=ITERATIONS)
        logging.info(f"Cloudflare Tunnel p99 latency: {p99_latency:.2f}ms")

        throughput = benchmarker.run_throughput_test(duration_sec=DURATION_SEC)
        logging.info(f"Cloudflare Tunnel throughput: {throughput:.2f}Gbps")

        benchmarker.results.append({
            "tool": "Cloudflare Tunnel",
            "version": "2024.9.1",
            "p99_latency_ms": p99_latency,
            "throughput_gbps": throughput,
            "payload_size_mb": PAYLOAD_SIZE_MB
        })

        benchmarker.save_results()

    except RuntimeError as e:
        logging.error(f"Benchmark failed: {str(e)}")
        exit(1)

# Configure AWS Direct Connect connection and virtual interface
# Provider version: AWS 5.72.0, Terraform 1.9.5
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.72.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

# Data source to fetch existing Direct Connect connection (pre-provisioned via AWS Console)
data "aws_dx_connection" "existing" {
  name = "prod-direct-connect-1"
}

# Create BGP authentication key for Direct Connect
resource "aws_dx_bgp_peer" "main" {
  connection_id               = data.aws_dx_connection.existing.id
  address_family              = "ipv4"
  bgp_asn                     = 65000  # Customer-side ASN
  bgp_auth_key                = var.bgp_auth_key
  customer_address            = "169.254.1.1/30"
  amazon_address              = "169.254.1.2/30"
  virtual_interface_id        = aws_dx_private_virtual_interface.main.id

  lifecycle {
    create_before_destroy = true
  }
}

# Create private virtual interface for VPC access
resource "aws_dx_private_virtual_interface" "main" {
  connection_id               = data.aws_dx_connection.existing.id
  name                        = "prod-vpc-interface"
  vlan                        = 100
  address_family              = "ipv4"
  bgp_asn                     = 65000
  customer_address            = "169.254.1.1/30"
  amazon_address              = "169.254.1.2/30"
  vpn_gateway_id              = aws_vpn_gateway.main.id

  # Enable jumbo frames for higher throughput
  mtu = 9001

  lifecycle {
    create_before_destroy = true
  }
}

# Create VPN gateway to attach to VPC
resource "aws_vpn_gateway" "main" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name = "prod-direct-connect-vgw"
  }
}

# Main VPC for workload hosting
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name = "prod-workload-vpc"
  }
}

# Route table to direct traffic via Direct Connect
resource "aws_route_table" "dx_routes" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block                = "0.0.0.0/0"
    gateway_id                = aws_vpn_gateway.main.id
    # Only route cross-region traffic via Direct Connect
    # Local VPC traffic uses default routes
  }

  tags = {
    Name = "dx-route-table"
  }
}

# Variables for BGP authentication
variable "bgp_auth_key" {
  type        = string
  description = "BGP MD5 authentication key for Direct Connect"
  sensitive   = true
}

# Output Direct Connect connection details
output "dx_connection_id" {
  value = data.aws_dx_connection.existing.id
}

output "virtual_interface_id" {
  value = aws_dx_private_virtual_interface.main.id
}

output "bgp_peer_ip" {
  value = aws_dx_bgp_peer.main.amazon_address
}

package main

import (
    "context"
    "fmt"
    "log"
    "os"
    "time"

    compute "cloud.google.com/go/compute/apiv1"
    computepb "cloud.google.com/go/compute/apiv1/computepb"
    "github.com/google/uuid"
    "google.golang.org/api/option"
)

// GCP Cloud Interconnect provisioning client
type InterconnectClient struct {
    projectID    string
    region       string
    client       *compute.InterconnectAttachmentsClient
    ctx          context.Context
}

// NewInterconnectClient initializes a new GCP Cloud Interconnect client
func NewInterconnectClient(projectID, region string) (*InterconnectClient, error) {
    ctx := context.Background()

    // Initialize Compute client with default credentials (GOOGLE_APPLICATION_CREDENTIALS)
    client, err := compute.NewInterconnectAttachmentsClient(ctx, option.WithCredentialsFile(os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")))
    if err != nil {
        return nil, fmt.Errorf("failed to create interconnect client: %w", err)
    }

    return &InterconnectClient{
        projectID: projectID,
        region:    region,
        client:    client,
        ctx:       ctx,
    }, nil
}

// CreateInterconnectAttachment provisions a new Cloud Interconnect attachment
func (ic *InterconnectClient) CreateInterconnectAttachment(name, interconnectName, vpcName string) (*computepb.InterconnectAttachment, error) {
    attachmentName := name
    if attachmentName == "" {
        attachmentName = fmt.Sprintf("ica-%s", uuid.New().String()[:8])
    }

    // Configure attachment for Dedicated Interconnect
    attachment := &computepb.InterconnectAttachment{
        Name:                &attachmentName,
        Interconnect:        &interconnectName,
        Vpc:                 &vpcName,
        Type:                computepb.InterconnectAttachment_Dedicated.Enum(),
        Mtu:                 new(int32),
    }
    *attachment.Mtu = 9001 // Jumbo frames
    *attachment.AdminEnabled = true

    // Create attachment request
    req := &computepb.InsertInterconnectAttachmentRequest{
        Project:                ic.projectID,
        Region:                 ic.region,
        InterconnectAttachment: attachment,
    }

    op, err := ic.client.Insert(ic.ctx, req)
    if err != nil {
        return nil, fmt.Errorf("failed to insert attachment: %w", err)
    }

    // Wait for operation to complete (timeout 10 minutes)
    timeoutCtx, cancel := context.WithTimeout(ic.ctx, 10*time.Minute)
    defer cancel()

    err = op.Wait(timeoutCtx)
    if err != nil {
        return nil, fmt.Errorf("attachment creation failed: %w", err)
    }

    // Fetch created attachment
    resp, err := ic.client.Get(ic.ctx, &computepb.GetInterconnectAttachmentRequest{
        Project:             ic.projectID,
        Region:              ic.region,
        InterconnectAttachment: attachmentName,
    })
    if err != nil {
        return nil, fmt.Errorf("failed to get attachment: %w", err)
    }

    log.Printf("Created Cloud Interconnect attachment: %s", *resp.Name)
    return resp, nil
}

// DeleteInterconnectAttachment removes an existing attachment
func (ic *InterconnectClient) DeleteInterconnectAttachment(name string) error {
    req := &computepb.DeleteInterconnectAttachmentRequest{
        Project:             ic.projectID,
        Region:              ic.region,
        InterconnectAttachment: name,
    }

    op, err := ic.client.Delete(ic.ctx, req)
    if err != nil {
        return fmt.Errorf("failed to delete attachment: %w", err)
    }

    timeoutCtx, cancel := context.WithTimeout(ic.ctx, 5*time.Minute)
    defer cancel()

    err = op.Wait(timeoutCtx)
    if err != nil {
        return fmt.Errorf("attachment deletion failed: %w", err)
    }

    log.Printf("Deleted Cloud Interconnect attachment: %s", name)
    return nil
}

func main() {
    projectID := os.Getenv("GCP_PROJECT_ID")
    if projectID == "" {
        log.Fatal("GCP_PROJECT_ID environment variable not set")
    }

    region := "us-central1"
    interconnectName := "prod-dedicated-interconnect-1"
    vpcName := "prod-workload-vpc"

    client, err := NewInterconnectClient(projectID, region)
    if err != nil {
        log.Fatalf("Failed to initialize client: %v", err)
    }

    attachment, err := client.CreateInterconnectAttachment("", interconnectName, vpcName)
    if err != nil {
        log.Fatalf("Failed to create attachment: %v", err)
    }

    fmt.Printf("Attachment Details:\n")
    fmt.Printf("  Name: %s\n", *attachment.Name)
    fmt.Printf("  Type: %s\n", attachment.Type)
    fmt.Printf("  MTU: %d\n", *attachment.Mtu)
}

def generate_production_payload() -> bytes:
    """Generate payload matching production checkout request schema."""
    import json
    payload = {
        "user_id": "prod-user-12345",
        "cart_items": [{"sku": "SKU-789", "qty": 2, "price": 49.99}],
        "payment_token": "tok_visa_123456",
        "session_id": "sess-abcde-12345",
        "timestamp": time.time()
    }
    return json.dumps(payload).encode("utf-8")

# Terraform snippet to route bulk traffic via Direct Connect
resource "aws_route" "bulk_route" {
  route_table_id         = aws_route_table.dx_routes.id
  destination_cidr_block = "10.1.0.0/16"  # Bulk backup subnet
  gateway_id             = aws_vpn_gateway.main.id
}

# Cron job to run benchmark every 5 minutes
*/5 * * * * /usr/bin/python3 /opt/benchmark/tunnel_benchmark.py >> /var/log/benchmark_cron.log 2>&1