You run a server S. You want to ensure that all traffic to S is forced to go through a middlebox M. Middlebox M may not be located on the physical path to S.