Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloud Firewalls

digitalocean.com

Post reply on HN
Print view View original

71–80 of 119 posts

Re: Cloud Firewalls

#71

Post by IFeelOK »

lovehashbrowns wrote: post #29
malux85 wrote: post #8

DigitalOcean is killing it against Linode - I just migrated my last services off Linode because you still cannot attach arbitrary sized disks to your instances, something they've been promising as arriving "soon" for months. Go DO!

Am I the only one who has constant issues with VMs in Linode? I feel like that platform is the worst out of all the ones I've tried so far. Unfortunately, our company is stuck with it for now. :(

Disclaimer: I work there.

What kind of issues are you running into? There's a lot of issues that can happen on a server, but a lot of them are due to not enough resources or a misconfiguration.

Now, if your server is seeing constant issues on the host your server is on...

Re: Cloud Firewalls

#72

Post by debaserab2 »

entropy128 wrote: post #18
tyingq wrote: post #2

They seem to be headed towards being an "AWS light". Would be nice to be have an alternative with reasonable egress costs. Still a long way to go though. At a minimum, they would need a more configurable load balancer and some S3 type function.

I've recently done a moderately complex hybrid setup that used DO in conjunction with S3 and Route53. My biggest takeaway from the experience was how much the simplicity and speed of DO's dashboard interface stood out - the AWS web interface just felt laggy by comparison. I know it sounds like a poor reason to favour a platform but DO was just a simple pleasure to navigate and use.

If you're managing your infrastructure via GUI it's probably not moderately complex.

Re: Cloud Firewalls

#73

Post by throwasehasdwi »

Isn't this just doing the same exact thing as iptables only worse since it's not transparent to the operating system?

I've created bad firewall rules by mistake many times and enforcing them transparently so the machines can't see them makes the issue almost impossible to debug and fix.

Of course I have the same gripe with AWS VPC setups I guess... I just think it's funny how the cloud keeps reinventing cloud versions of things that perform objectively worse than the original, but then everyone still uses them out of pure convenience or stupidity.

Re: Cloud Firewalls

#74

Post by stevekemp »

dsugarman wrote: post #15
Tostino wrote: post #4

Earlier quoted context omitted.

I would be extremely happy with DO if they put out an S3 competitor. Right now, most of my servers are on DO, the only things I need AWS for is a single windows server to run some windows only software, and S3 to store my database backups.

it's always smart to store your backups on another service anyway for any doomsday scenarios

And to double the single-points of failure? Now your "stuff" is only alive if both the virtual machine(s) are up, and the object-store is accessible!

Re: Cloud Firewalls

#75

Post by leesalminen »

dsugarman wrote: post #15
Tostino wrote: post #4

Earlier quoted context omitted.

I would be extremely happy with DO if they put out an S3 competitor. Right now, most of my servers are on DO, the only things I need AWS for is a single windows server to run some windows only software, and S3 to store my database backups.

it's always smart to store your backups on another service anyway for any doomsday scenarios

We use Google Cloud Storage Coldline as our backup file storage. Synced using rclone (rsync for cloud) nightly. The cost is next to nothing. IIRC, ~3TB stored for $25/mo.

Re: Cloud Firewalls

#76

Post by Tostino »

stevekemp wrote: post #74
dsugarman wrote: post #15

Earlier quoted context omitted.

it's always smart to store your backups on another service anyway for any doomsday scenarios

And to double the single-points of failure? Now your "stuff" is only alive if both the virtual machine(s) are up, and the object-store is accessible!

What do you mean? It's not like if your object store becomes unavailable your database sending it's backups there will suddenly stop working.

Re: Cloud Firewalls

#77

Post by Dirlewanger »

toomuchtodo wrote: post #41
tyingq wrote: post #34

Earlier quoted context omitted.

B2 is nice, but the single location is something of a deal-breaker as far as being an S3 replacement.

Can you explain your use case? I know a lot of businesses solely using us-east-1

A business needs their S3 component highly available. If they don't have a DR plan in place, and a massive S3 outage (like the one that happened a couple months ago) occurs, they're fucked.

Re: Cloud Firewalls

#78

Post by NetStrikeForce »

throwasehasdwi wrote: post #73

Isn't this just doing the same exact thing as iptables only worse since it's not transparent to the operating system? I've created bad firewall rules by mistake many times and enforcing them transparently so the machines can't see them makes the issue almost impossible to debug and fix. Of course I have the same gripe with AWS VPC setups I guess... I just think it's funny how the cloud keeps reinventing cloud version…

Most people don't need anything more complex than this for their firewall needs, so iptables is overkill.

Not only that, but iptables is just terrible to use and it just makes you want to kill yourself.

I've deployed a pretty standard policy now in DO with a couple of clicks, works as expected.

(And before anyone jumps, you should be using a host firewall too; defence in depth)

Re: Cloud Firewalls

#79

Post by skrebbel »

tyingq wrote: post #64
manacit wrote: post #6

Features like this feel like table stakes for cloud hosting in 2017, so it's nice to see DigitalOcean on board. It'll be interesting to see what the tooling support looks like for this, it looks like it's launching with API support day one: https://developers.digitalocean.com/documentation/v2/ which is great. It looks like they're already working to get it into Terraform: https://github.com/hashicorp/terraform/pull/1…

>I look forward to the day that I can automatically spin up a DigitalOcean set of Droplets running Kubernetes using this Stackpoint.io can do this, you paste your DO API key and get a k8s cluster in a few minutes. Would be nice if DO built something like that in-house.

> Would be nice if DO built something like that in-house.

Curious, why? Isn't it much nicer to keep that separate from DO so that you can move away from DO easily should there be a reason to?

I'm not sure if I'm weird this way, but one main reason we use DO and not, say, AWS is because we're afraid of vendor lock-in. The more we depend on specialized services, the harder it gets to move somewhere. I wonder whether this is a common sentiment in 2017 or whether I'm just old-fashioned.

Post reply on HN