This just made my day. Running apps on FreeBSD is awesome, but dealing with IPFW config is a nightmare.
Cloud Firewalls
111–119 of 119 posts
Re: Cloud Firewalls
#112Earlier quoted context omitted.
And to double the single-points of failure? Now your "stuff" is only alive if both the virtual machine(s) are up, and the object-store is accessible!
What do you mean? It's not like if your object store becomes unavailable your database sending it's backups there will suddenly stop working.
Indeed, but if you're hosting user-images on S3 and they go away your site is broken.
That might not be a big deal, or it might mean your site is 100% broken. I can't guess, but I'd assume since you went to the effort to setup a store you need it in some way.
(No backups? Of a database? That's one power-cut, or hardware failure away from complete data loss too!)
Re: Cloud Firewalls
#113Earlier quoted context omitted.
We don't have a formal system for that but we do announce customer early request betas. Sometimes they are invite only, other times we open them more broadly. In those cases where it is more broad it's usually featured on our homepage and then it's on a first come, first serve basis in terms of getting access and limited by the number of invitations that we are accepting. It's a bit of a fluid process as it depends o…
Any chance I can get in on the beta for this? I've done the Load balancer and block storage beta? @gmail.com
We will make sure to add you once the beta is available.
Re: Cloud Firewalls
#114Earlier quoted context omitted.
Just checking if I have this right... > The rules are all added together and applied at the same priority. Order doesn't matter. If I make several firewalls, and the order of the rules when mixed results in unexpected traffic flows compared to the firewalls being applied individually, I have a bug that is hard to see, only experience during traffic as "timeout" or "not a timeout", and because of a lack of logging, no…
It's possible you're assuming the firewalls have more rule types than they actually do. Basically these firewalls default to dropping all packets, and any rules you add are to accept a port or port range. Adding such rules together is simple and doesn't depend on order.
Oh... I hadn't quite grasped the limitations. So these "firewalls" are basically two chains with a drop policy and rules with ACCEPT jump targets, and either a source or destination. This seems to be a port whitelist rather than a firewall.
It does seem that if you create one single firewall per role, this is a simple and effective means of applying really basic port access rules to a large number of droplets at once. But by calling it a "firewall", people actually believe it replaces a real modern firewall and have actually dropped real firewalls from their droplets, making overall security worse. Not to mention the many ways you could accidentally open up or restrict more than you wanted to.
Maybe I missed something again. It says your firewalls are stateful. Are the input rule targets really "NEW,ESTABLISHED" and the output rule targets really "ESTABLISHED,RELATED" ? If they are doing connection tracking and verifying the 3way handshake before passing on the connection, I suppose this is useful to prevent syn floods that don't complete a handshake. I'd be interested to know what actual protection these firewalls give other than port whitelisting. (And yes, I see a generic icmp type is included as well as tcp & udp)
Re: Cloud Firewalls
#115Earlier quoted context omitted.
Disclaimer: I work there. What kind of issues are you running into? There's a lot of issues that can happen on a server, but a lot of them are due to not enough resources or a misconfiguration. Now, if your server is seeing constant issues on the host your server is on...
The emails we get are generally ones saying it was an issue affecting the physical hardware that the VM is hosted on, yeah. :( I tend to just ignore them now though, lol. There are only a few VMs there that are absolutely critical. Everything else is configured for HA.
[deleted]
Re: Cloud Firewalls
#116Earlier quoted context omitted.
Disclaimer: I work there. What kind of issues are you running into? There's a lot of issues that can happen on a server, but a lot of them are due to not enough resources or a misconfiguration. Now, if your server is seeing constant issues on the host your server is on...
The emails we get are generally ones saying it was an issue affecting the physical hardware that the VM is hosted on, yeah. :( I tend to just ignore them now though, lol. There are only a few VMs there that are absolutely critical. Everything else is configured for HA.
That's no good, I'd like to take a look and see what's happened - having multiple hardware issues isn't necessarily normal. If you have time, please shoot a ticket our way. Mention that you spoke to Soh on Ycombinator and that I requested this ticket to be opened so we can seek out any solutions.
Re: Cloud Firewalls
#117Earlier quoted context omitted.
It's possible you're assuming the firewalls have more rule types than they actually do. Basically these firewalls default to dropping all packets, and any rules you add are to accept a port or port range. Adding such rules together is simple and doesn't depend on order.
Oh... I hadn't quite grasped the limitations. So these "firewalls" are basically two chains with a drop policy and rules with ACCEPT jump targets, and either a source or destination. This seems to be a port whitelist rather than a firewall. It does seem that if you create one single firewall per role, this is a simple and effective means of applying really basic port access rules to a large number of droplets at once…
The firewalls are stateful, with connection tracking.