Live data from Hacker News

Cloud Firewalls

digitalocean.com

41–50 of 119 posts

Re: Cloud Firewalls

#41
post #34

Earlier quoted context omitted.

There's also Backblaze: https://www.backblaze.com/b2/cloud-storage.html

B2 is nice, but the single location is something of a deal-breaker as far as being an S3 replacement.

Can you explain your use case? I know a lot of businesses solely using us-east-1

Re: Cloud Firewalls

#42
post #17
post #9

It's not clear what this offers over the usual iptables/firewalld + ansible solution. What am I missing?

The same thing that their load balancer project offers over HAProxy + Ansible - the ability to configure it via their API (or their Web UI) and have DigitalOcean own the implementation and management of everything. This includes making improvements under the hood, security updates, etc. There's very little you can't do with enough Ansible and other utilities, but letting your cloud hosting provider handle it comes wi…

Ive always like Ansible/Puppet/file storage. I can quickly boot from ethernet, populate a req key from puppet from ansible, load puppet to the appropriate config needed, and off I go.

No having to dork with servers one at a time. And with Ansible, if I change puppet manifests, I can reload puppet with ansible instead of waiting the default 30m.

Re: Cloud Firewalls

#43
post #8

DigitalOcean is killing it against Linode - I just migrated my last services off Linode because you still cannot attach arbitrary sized disks to your instances, something they've been promising as arriving "soon" for months. Go DO!

Am I the only one who has constant issues with VMs in Linode? I feel like that platform is the worst out of all the ones I've tried so far. Unfortunately, our company is stuck with it for now. :(

I use the San Jose facility for my Linodes. I haven't had a problem since the rolling power outages years ago where Hurricane Electric's backup power failed to kick in.

Re: Cloud Firewalls

#44
post #8

DigitalOcean is killing it against Linode - I just migrated my last services off Linode because you still cannot attach arbitrary sized disks to your instances, something they've been promising as arriving "soon" for months. Go DO!

Am I the only one who has constant issues with VMs in Linode? I feel like that platform is the worst out of all the ones I've tried so far. Unfortunately, our company is stuck with it for now. :(

Issues like what? I used to have my machines freak out and crash once in a while before moving it all to KVM. Haven't had trouble since.

Re: Cloud Firewalls

#45

Earlier quoted context omitted.

I had so many problems with Linode. The company itself seems really poorly structured, too. Do you consider this when you're talking about value? I know little about vultr. 5 vs 10 vs 20 vs 40 dollars doesn't mean much, and Linode pricing starts to converge on DO's after the $80 price point.

> 5 vs 10 vs 20 vs 40 dollars doesn't mean much This depends entirely on what you're doing with it. For a hobby project, it makes a big difference to me.

That's a good point. I forget, because I have a bunch of DO boxes: several, sometimes, for each client.

Re: Cloud Firewalls

#47
post #22

Earlier quoted context omitted.

Disclaimer: DO Support here The traffic is blocked/allowed at our network layer before being routed to the droplet. The rules are easily configurable through the control panel and API. You can also specify Droplets (individual or tagged) and our recently new Load Balancers as the targets. You can also layer multiple firewalls on top of one another if you want to apply specific firewall rules to only a specific set of…

How many firewalls can a single user create, and how many rules can be in each firewall? How is the order of multiple firewalls applied to the same droplet determined? Where is there logging to show when a rule matched? Is there any future plan to support REJECTing packets rather than only DROPing? Will the user interface warn the user when they are about to block all traffic (including ssh) to a droplet?

(DO employee here)

The intro article answers many of these questions (and more): https://www.digitalocean.com/community/tutorials/an-introduc...

> How many firewalls can a single user create, and how many rules can be in each firewall?

100 firewalls, 50 rules per firewall

> How is the order of multiple firewalls applied to the same droplet determined?

The rules are all added together and applied at the same priority. Order doesn't matter.

> Where is there logging to show when a rule matched?

No logging is available.

> Is there any future plan to support REJECTing packets rather than only DROPing?

No plans for this.

> Will the user interface warn the user when they are about to block all traffic (including ssh) to a droplet?

There are no footgun warnings, no.

Let me know if you have more questions... thanks!

Re: Cloud Firewalls

#48
post #2

They seem to be headed towards being an "AWS light". Would be nice to be have an alternative with reasonable egress costs. Still a long way to go though. At a minimum, they would need a more configurable load balancer and some S3 type function.

Feels like a losing battle. AWS codestar is essentially the DO/Heroku killer.

[deleted]

Re: Cloud Firewalls

#49
post #34

Earlier quoted context omitted.

B2 is nice, but the single location is something of a deal-breaker as far as being an S3 replacement.

Can you explain your use case? I know a lot of businesses solely using us-east-1

My specific use case isn't really that interesting. Many use cases where a single AZ or region failure shouldn't stop business exist.

Re: Cloud Firewalls

#50
post #4

Earlier quoted context omitted.

I would be extremely happy with DO if they put out an S3 competitor. Right now, most of my servers are on DO, the only things I need AWS for is a single windows server to run some windows only software, and S3 to store my database backups.

Throwaway, but I would bet money that you'll see this pretty soon on DO - hang in there!

This is one of the big reasons I come to HN...insider intel.
Post reply on HN