CDN / WAF

CNX's CDN/WAF is a three-PoP domestic anycast platform: schema-validated, OWASP-inspected delivery for both static content and API traffic, deployed via GitOps, running entirely inside Cambodia. Anycast edge, managed rule sets, schema validation, config-as-code — a full delivery and inspection stack, built and operated in Cambodia, under Cambodian jurisdiction, connected directly into the country's domestic exchange.

CDN/WAF is paired with DNS Shield, which directs each user into the right network segment before any request reaches here.

PoP topology

PoPs	Three domestic, identical build
Access network	100GE
Node isolation	100% — no transit capacity to any upstream, at any PoP
International traffic	Isolated bulkhead node — own transit, excluded from the domestic mesh
Configuration plane	Separate GitOps push target — not on the anycast data plane

Network Isolation

Each domestic PoP has no transit connection to any upstream provider — no default route out of Cambodia exists at the PoP. The domestic PoPs are simply not connected to any segment that carries international transit.

International traffic is handled by a separate bulkhead node with its own transit connection, excluded from the domestic east-west mesh. It has no network path back into the three domestic PoPs, so a compromise or volumetric attack on that node does not propagate to them.

Origin connectivity

Two supported paths to origin: a dedicated PNI on dark fiber into a CNX facility, or a VLAN handover at your own ISP or data-centre provider if your infrastructure sits elsewhere. Traffic to origin never transits a shared public path.

Inspection pipeline

Stage	What happens
1. Schema validation	Every request checked against your OpenAPI schema — declared endpoints, methods, and parameter types only
2. OWASP Core Rule Set	Full CRS applied to whatever passes schema validation
3. Cache split	Static content served from cache; the API surface is never cached
4. Origin	Forwarded over PNI or VLAN handover, not the public internet

Configuration

WAF rules and DNS steering config live in a Git repository — full change management: every change is a reviewed commit, deployed automatically on merge, with an auditable history of who changed what and when. A new rule set can run in observation/logging mode before switching to active blocking. Access is via your own SSO or CamDigiKey.

Logs are stored on CNX's own S3-compatible storage, sealed with a TSA timestamp for cryptographic proof of integrity, and can be encrypted against a customer-supplied public key. You download your own logs directly, with your own access token — no request to CNX required.

Observability

Key metrics — cache hit ratio, origin response time, edge error rate, and requests blocked at each inspection stage — are exported to Prometheus and available in Grafana, using your own SSO.

Transport

TCP path	TLS 1.3, ECDSA certificates, Encrypted Client Hello (ECH)
QUIC path	HTTP/3, supported at the same edge as TCP+TLS — not a separate deployment
Session resumption	Session tickets and 0-RTT reconnection — a session resuming after a mobile-to-Wi-Fi switch doesn't cost a full handshake

Client support determines whether an app gets QUIC in practice — automatic on iOS 15+, requires adopting Cronet on Android if the app currently runs plain OkHttp.

Sponsored data

CNX's domestic edge runs on infrastructure directly connected to Cambodia's carriers, at a known, stable IP range dedicated to this platform — not a shared global anycast range that shifts by region. That makes it possible for a carrier to identify and zero-rate traffic to it. On request, CNX can work with a customer's carrier relationships to sponsor data for their mobile app, so the app keeps working for a customer with no active data plan or an exhausted balance. A global CDN's shared, constantly-changing IP ranges make that arrangement impractical for a carrier to commit to; a fixed, locally-connected platform is what makes it workable.

Service mapping

Familiar concept	CNX Delivery
Global anycast network	Domestic-only anycast, three isolated Cambodian PoPs
Managed WAF rule sets	OWASP Core Rule Set, self-hosted inside Cambodia
API schema validation	OpenAPI schema validation, same stage in the pipeline
Private origin tunnel	Dedicated PNI (dark fiber) or VLAN handover to origin
Infrastructure-as-code config	GitOps — the Git repo is the source of truth, auto-deployed
Global threat intelligence	Not needed — the domestic segment has no global attack surface to defend (see Overview)