Why does my German VPS route through US?

Running your own resolver helps but it's not the full picture. If the VPS provider is using anycast for their network infrastructure - not DNS, but the actual IP space - then your traffic gets hoovered into whichever POP announces the prefix best. BGP doesn't care about your DNS settings.

I saw this with a BuyVM instance years ago. Their anycasted IPs would land in Vegas for half the world regardless of where the actual VM was.

Check if your VPS IP is in an anycast range.

whois YOUR_IP | grep -i anycast

This is the key point everyone keeps missing. You can change DNS all day, if the IP itself is anycasted you're stuck. The DNS just determines which IP you get, and if that IP is announced from multiple places, BGP picks the "best" path which is usually closest to the user, not closest to the server.

So for pdxltd's original problem: German VPS, user in Lisbon, both hitting Ashburn. That means either the VPS IP is anycasted (weird for a single VPS) or there's a middlebox - CDN, WAF, DDoS proxy - that's anycasted and terminating the TCP connection.

Yes this is exactly what I found with OVHcloud. They weren't anycasting my VPS IP, but their network uses anycast for certain shared services and depending on how you hit the API or the DNS it can pull your whole flow into a different region. It was maddening because the support people didn't understand the difference between "my server is in France" and "my traffic enters OVH's network in Virginia."

I ended up moving that particular service to a non-anycasted IP block they have in Limburg. Took three tickets to get someone who knew what I meant.

I learning about anycast now. So if I have Vultr in Singapore and user in Hanoi, and I use Cloudflare DNS, the traffic maybe go to Hong Kong or Tokyo first? Then my ping is bad?

I check my Vultr and they have Osaka datacenter too. Maybe better for Vietnam? I used https://www.vultr.com/pricing/ to check.

For Hanoi you want Singapore or maybe Osaka. But yes if you put Cloudflare in front, traffic goes to Cloudflare edge first. For Indonesia they have Jakarta now I think, but before that everything went to Singapore and sometimes Tokyo.

I don't use Cloudflare for my reseller hosting, too many problems with email delivery and weird routing. Just straight DNS at registrar.

Can someone explain why Ashburn specifically? Every traceroute in this thread goes through Ashburn. Is there some special internet gravity there?

Ashburn Virginia is basically the internet's biggest intersection. More datacenters and fiber there than anywhere else on earth. If you're a CDN or anycast network, you put nodes there because everyone peers there. So when BGP is picking "closest" anycast node, Ashburn often wins just by having the most connectivity, even if it's not geographically closest to you.

For Lisbon, Madrid or London or even Frankfurt would be closer in km. But if the anycast network doesn't have good presence in those, or if their Ashburn node has better path diversity, you end up in Virginia.

Did anyone ever figure out if this was actually CloudCone's fault or just how anycast works? I read the whole thread and I'm still not sure if I should open a ticket or just change my DNS and live with it.