4 ms·
That is not the same level of isolation. What you describe is of course possible and exactly how non vpc ec2 works, but nobody recommends that for serious setup
by jo909 11y ago
That is not the same level of isolation. What you describe is of course possible and exactly how non vpc ec2 works, but nobody recommends that for serious setups.
Im not saying that nat is good, but isolation is.
- zAy0LfpBZLC8mAC 11y agoI guess I wasn't necessarily talking just about EC2, but network setups in general, where more distributed firewalls might often be a good choice, were it not for the problems that NAT brings. Actually having a packet filter per machine would be an extreme case, obviously, but the same problem occurs when you have multiple gateways to different networks, or maybe you are multihomed, or you have multiple locations with their own internet uplinks ... having to maintain NAT state and generally ensuring reachability despite the NAT tends to get complicated fast if you have multiple independent filters/NAT gateways, while that's reasonably easy to maintain without NAT.