Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloud Firewalls

digitalocean.com

Post reply on HN
Print view View original

91–100 of 119 posts

Re: Cloud Firewalls

#91

Post by gist »

genpage wrote: post #22
daxorid wrote: post #9

It's not clear what this offers over the usual iptables/firewalld + ansible solution. What am I missing?

Disclaimer: DO Support here The traffic is blocked/allowed at our network layer before being routed to the droplet. The rules are easily configurable through the control panel and API. You can also specify Droplets (individual or tagged) and our recently new Load Balancers as the targets. You can also layer multiple firewalls on top of one another if you want to apply specific firewall rules to only a specific set of…

Question. Does DO log access to a clients vps in some way if they do not have the cloud firewall product?

In other words if a VPS has traffic to http https ssh ftp and so on coming in from all over. Does DO have logs that show that traffic where it's coming from and where on DO it's going to? Or does DO only know who has spun up and requisitioned the VPS?

(Same question for the firewall product as well).

Re: Cloud Firewalls

#92

Post by gr2020 »

throwasehasdwi wrote: post #73

Isn't this just doing the same exact thing as iptables only worse since it's not transparent to the operating system? I've created bad firewall rules by mistake many times and enforcing them transparently so the machines can't see them makes the issue almost impossible to debug and fix. Of course I have the same gripe with AWS VPC setups I guess... I just think it's funny how the cloud keeps reinventing cloud version…

Sometimes software like Docker (in certain network configurations) will use iptables for its own purposes, clobbering some of your own iptables rules. Having an external firewall for access control is super advantageous in cases like this.

Re: Cloud Firewalls

#93

Post by calpaterson »

throwasehasdwi wrote: post #73

Isn't this just doing the same exact thing as iptables only worse since it's not transparent to the operating system? I've created bad firewall rules by mistake many times and enforcing them transparently so the machines can't see them makes the issue almost impossible to debug and fix. Of course I have the same gripe with AWS VPC setups I guess... I just think it's funny how the cloud keeps reinventing cloud version…

Many many people work in environment where their machines are firewalled by a different time so perhaps it's no worse to them. These sorts of services are never as flexible as iptable and friends but they're still useful, especially for defense in depth (my planned usage).

Re: Cloud Firewalls

#94

Post by tomsthumb »

gr2020 wrote: post #92
throwasehasdwi wrote: post #73

Isn't this just doing the same exact thing as iptables only worse since it's not transparent to the operating system? I've created bad firewall rules by mistake many times and enforcing them transparently so the machines can't see them makes the issue almost impossible to debug and fix. Of course I have the same gripe with AWS VPC setups I guess... I just think it's funny how the cloud keeps reinventing cloud version…

Sometimes software like Docker (in certain network configurations) will use iptables for its own purposes, clobbering some of your own iptables rules. Having an external firewall for access control is super advantageous in cases like this.

Docker in _most_ (all?) situations on linux will use IPTables to allocate and admin it's networks and interfaces.

Re: Cloud Firewalls

#95

Post by ionrock »

throwasehasdwi wrote: post #73

Isn't this just doing the same exact thing as iptables only worse since it's not transparent to the operating system? I've created bad firewall rules by mistake many times and enforcing them transparently so the machines can't see them makes the issue almost impossible to debug and fix. Of course I have the same gripe with AWS VPC setups I guess... I just think it's funny how the cloud keeps reinventing cloud version…

Personally, I think it is more convenient to think about things like this (ie firewall rules) as data, which makes the use of an API a convenient way to work with the data. The converse, in my mind, is that I'd have to configure each node and ensure a text representation of my firewall rules are correct. That opens the door for some thinking about concurrency that I thankfully get to avoid with an API like this.

That said, I can see your point that you are hiding some details from the OS that might be helpful such as what hosts you can talk to.

Fortunately, just because you might configure a firewall with an API rather than some Ansible plays, it doesn't mean that you can't continue to use Ansible to fill in the gaps. For example, if you did use Ansible to previously configure your iptables, you might change the playbook to call the API based on some YAML. You might use the same YAML to write some information on the host that your application can use to understand the firewall rules that are used.

The point being is that it is always good to remember these are not either/or decisions.

Lastly, I'll also speak up for those folks that don't know much about firewalls and iptables. I understand the principles, but I'm far from feeling confident managing that system myself. In my case, I'm really glad to have an option that lets me get the benefits without forcing me to operate a system I'm not well equipped to do.

Re: Cloud Firewalls

#96

Post by raiyu »

Tostino wrote: post #68
raiyu wrote: post #67

Earlier quoted context omitted.

Object Storage is currently in internal-company-beta =] After that we will be doing a customer beta followed by a GA release scheduled for Q3. =]]

That makes me really happy to hear. Is there any good way to keep up on potential up-coming features you are working on? I feel like that would be good knowledge to have when making decisions.

We don't have a formal system for that but we do announce customer early request betas. Sometimes they are invite only, other times we open them more broadly. In those cases where it is more broad it's usually featured on our homepage and then it's on a first come, first serve basis in terms of getting access and limited by the number of invitations that we are accepting.

It's a bit of a fluid process as it depends on the type of service, product, feature, we are rolling out.

Re: Cloud Firewalls

#97

Post by redbeard0x0a »

riffic wrote: post #63
xchaotic wrote: post #59

I'm trying to explain what these are to my grandmother. Any car analogies? ;)

A firewall is named for the structure in an automobile which keeps engine compartment fires out of the passenger cabin. https://en.wikipedia.org/wiki/Firewall_(engine)

On top of it, there are holes (ports) in the firewall to let various wires through. It would also keep road grime, rocks, etc that might be kicked up from entering the passenger compartment.

Re: Cloud Firewalls

#98

Post by genpage »

gist wrote: post #91
genpage wrote: post #22

Earlier quoted context omitted.

Disclaimer: DO Support here The traffic is blocked/allowed at our network layer before being routed to the droplet. The rules are easily configurable through the control panel and API. You can also specify Droplets (individual or tagged) and our recently new Load Balancers as the targets. You can also layer multiple firewalls on top of one another if you want to apply specific firewall rules to only a specific set of…

Question. Does DO log access to a clients vps in some way if they do not have the cloud firewall product? In other words if a VPS has traffic to http https ssh ftp and so on coming in from all over. Does DO have logs that show that traffic where it's coming from and where on DO it's going to? Or does DO only know who has spun up and requisitioned the VPS? (Same question for the firewall product as well).

We do not log any type of network access to a client Droplet/VPS. Whether they use Cloud Firewall or not.

I hope that answers the question. If you have more or would like more information, feel free to reach out to our Support team!

Re: Cloud Firewalls

#99

Post by lobster_johnson »

quicksilver03 wrote: post #57
the_common_man wrote: post #30

Can someone clarify if the traffic between two droplets is "secure" i.e other droplets cannot see them? On AWS, I can create a VPC and put two ec2 instances on that.

It isn't by default, that's why DO calls it "shared private network" (their words, not mine). To secure internal traffic on DO you have to encrypt it, using for example something like tinc.

Don't use Tinc if you care about performance. Tinc is implemented in userland, and is an order of magnitude slower than a kernel-negotiated encryption. IPsec and GRE tunnels are much better solutions.

Re: Cloud Firewalls

#100

Post by jazoom »

halfeatenpie wrote: post #38
jimaek wrote: post #11

Once they double the RAM on all plans like Linode and Vultr did, I will move all of my servers back to DigitalOcean. I love these features but double the RAM for the same price still outweighs them.

Vultr has the cheaper side down I will admit, but their network hasn't been to great for me. It's great for development work but for production-level stuff I wouldn't put anything on it. Linode is like that old king on the block. They've had security issues in the past (multiple) and since they do store your credit card information those did get released (If I recall). They're decent and they work. They're a bit slow…

Vultr has been rock solid for me for years in the Sydney region.
Post reply on HN