Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloud Firewalls

digitalocean.com

Post reply on HN
Print view View original

81–90 of 119 posts

Re: Cloud Firewalls

#81

Post by tyingq »

skrebbel wrote: post #79
tyingq wrote: post #64

Earlier quoted context omitted.

>I look forward to the day that I can automatically spin up a DigitalOcean set of Droplets running Kubernetes using this Stackpoint.io can do this, you paste your DO API key and get a k8s cluster in a few minutes. Would be nice if DO built something like that in-house.

> Would be nice if DO built something like that in-house. Curious, why? Isn't it much nicer to keep that separate from DO so that you can move away from DO easily should there be a reason to? I'm not sure if I'm weird this way, but one main reason we use DO and not, say, AWS is because we're afraid of vendor lock-in. The more we depend on specialized services, the harder it gets to move somewhere. I wonder whether th…

Hosted K8s isn't much lock-in...you could move to GKE or Azure.

Re: Cloud Firewalls

#82

Post by lovehashbrowns »

artursapek wrote: post #44
lovehashbrowns wrote: post #29

Earlier quoted context omitted.

Am I the only one who has constant issues with VMs in Linode? I feel like that platform is the worst out of all the ones I've tried so far. Unfortunately, our company is stuck with it for now. :(

Issues like what? I used to have my machines freak out and crash once in a while before moving it all to KVM. Haven't had trouble since.

It's mostly "Hardware issue" errors. We'll get an email from them with the name of the VM saying that an error was detected, and that the issue will be resolved soon. It is generally fixed pretty quickly. It has the side effect of forcing me to learn how to recover from these events, but it's not so fun when my master database's server goes out (that's happened twice in the two years I've been at my current employer). We also have everything moved over to KVM already.

We occasionally experience problems with %steal due to other VMs in the same host. It was a lot worse when we had a critical service hosted in Linode, but that was gutted and moved to actual hardware. Only a small, low-traffic bit still remains in Linode.

Re: Cloud Firewalls

#83

Post by egeozcan »

NetStrikeForce wrote: post #78
throwasehasdwi wrote: post #73

Isn't this just doing the same exact thing as iptables only worse since it's not transparent to the operating system? I've created bad firewall rules by mistake many times and enforcing them transparently so the machines can't see them makes the issue almost impossible to debug and fix. Of course I have the same gripe with AWS VPC setups I guess... I just think it's funny how the cloud keeps reinventing cloud version…

Most people don't need anything more complex than this for their firewall needs, so iptables is overkill. Not only that, but iptables is just terrible to use and it just makes you want to kill yourself. I've deployed a pretty standard policy now in DO with a couple of clicks, works as expected. (And before anyone jumps, you should be using a host firewall too; defence in depth)

> Not only that, but iptables is just terrible to use and it just makes you want to kill yourself.

I can't agree more. Luckily though, if you have some setup scripts that you reuse, you don't have to think about iptables... Until the moment that you need to make this harmless quick change that shouldn't cause any problems and you end up locking yourself out of the server somehow.

Re: Cloud Firewalls

#84

Post by always_good »

blfr wrote: post #58

I know this is not strictly related but how well does Digital Ocean hold under a DDoS nowadays? Are they closer to Hetzner who just blackholes your IP or OVH who can withstand virtually anything?

In my experience last year, Digital Ocean blackholes you for 24 hours, during which they don't answer support tickets.

In other words, you can take down any Digital Ocean site for 24 hours after paying $1 to a booter unless they are behind CloudFlare or some other mitigation.

Re: Cloud Firewalls

#85

Post by lovehashbrowns »

IFeelOK wrote: post #71
lovehashbrowns wrote: post #29

Earlier quoted context omitted.

Am I the only one who has constant issues with VMs in Linode? I feel like that platform is the worst out of all the ones I've tried so far. Unfortunately, our company is stuck with it for now. :(

Disclaimer: I work there. What kind of issues are you running into? There's a lot of issues that can happen on a server, but a lot of them are due to not enough resources or a misconfiguration. Now, if your server is seeing constant issues on the host your server is on...

The emails we get are generally ones saying it was an issue affecting the physical hardware that the VM is hosted on, yeah. :( I tend to just ignore them now though, lol. There are only a few VMs there that are absolutely critical. Everything else is configured for HA.

Re: Cloud Firewalls

#86

Post by derefr »

throwasehasdwi wrote: post #73

Isn't this just doing the same exact thing as iptables only worse since it's not transparent to the operating system? I've created bad firewall rules by mistake many times and enforcing them transparently so the machines can't see them makes the issue almost impossible to debug and fix. Of course I have the same gripe with AWS VPC setups I guess... I just think it's funny how the cloud keeps reinventing cloud version…

1. These are stack-neutral: they let "cloud orchestrator" software plug one service into another by starting up Instance B and then opening the firewall port on Existing Instance A to talk to it, without having any ability to talk to or manage Existing Instance A, let alone knowledge of what it would have to say. Existing Instance A might be a Windows Server instance, or some custom unikernel; this approach would still work.

2. Depending on how they've implemented this, traffic that hits their firewall and bounces off might not be counted toward your bandwidth bill (presuming there's any part of DO's services that bills for bandwidth.) Once the traffic is served to your instance, they can't know whether your instance's OS firewall has just thrown it away, so they have to assume it hasn't and bill you for that. SDN-level firewalls enable "automatic DDoS protection"-type services, where you receive (and get charged for!) regular traffic, but not malicious traffic.

Re: Cloud Firewalls

#87

Post by rgrove »

always_good wrote: post #84
blfr wrote: post #58

I know this is not strictly related but how well does Digital Ocean hold under a DDoS nowadays? Are they closer to Hetzner who just blackholes your IP or OVH who can withstand virtually anything?

In my experience last year, Digital Ocean blackholes you for 24 hours, during which they don't answer support tickets. In other words, you can take down any Digital Ocean site for 24 hours after paying $1 to a booter unless they are behind CloudFlare or some other mitigation.

DigitalOcean automatically blackholed one of my droplets due to a DDoS attack last year. They notified me immediately via email and a human responded to my support ticket within 30 minutes with technical details.

I was able to provision a new droplet right away, so the downtime was minimal. I think the way DigitalOcean handled the incident was perfectly reasonable, and was a much better experience than I've had with other cloud providers in the past.

Re: Cloud Firewalls

#88

Post by [deleted] »

debaserab2 wrote: post #72
entropy128 wrote: post #18

Earlier quoted context omitted.

I've recently done a moderately complex hybrid setup that used DO in conjunction with S3 and Route53. My biggest takeaway from the experience was how much the simplicity and speed of DO's dashboard interface stood out - the AWS web interface just felt laggy by comparison. I know it sounds like a poor reason to favour a platform but DO was just a simple pleasure to navigate and use.

If you're managing your infrastructure via GUI it's probably not moderately complex.

[deleted]

Re: Cloud Firewalls

#89

Post by ino »

McBlorker wrote: post #60
ino wrote: post #55

Earlier quoted context omitted.

We need it for ams3

We published the roll-out schedule for Block Storage a little while back. Both LON1 and AMS3 are planned for this year: https://blog.digitalocean.com/block-storage-comes-to-singapo...

sweet. Is it possible to enable backups on block storage?

Re: Cloud Firewalls

#90

Post by tasn »

NetStrikeForce wrote: post #78
throwasehasdwi wrote: post #73

Isn't this just doing the same exact thing as iptables only worse since it's not transparent to the operating system? I've created bad firewall rules by mistake many times and enforcing them transparently so the machines can't see them makes the issue almost impossible to debug and fix. Of course I have the same gripe with AWS VPC setups I guess... I just think it's funny how the cloud keeps reinventing cloud version…

Most people don't need anything more complex than this for their firewall needs, so iptables is overkill. Not only that, but iptables is just terrible to use and it just makes you want to kill yourself. I've deployed a pretty standard policy now in DO with a couple of clicks, works as expected. (And before anyone jumps, you should be using a host firewall too; defence in depth)

iptables is terrible, but nftables is great and mostly available.

I wrote a post about my nftables config a while back.

Plug: https://stosb.com/blog/explaining-my-configs-nftables/

Post reply on HN