11 ms·
Cloud Firewalls
- tyingq 9y agoThey seem to be headed towards being an "AWS light". Would be nice to be have an alternative with reasonable egress costs. Still a long way to go though. At a minimum, they would need a more configurable load balancer and some S3 type function.
- ryanSrich 9y agoFeels like a losing battle. AWS codestar is essentially the DO/Heroku killer.
- kraig911 9y agoI don't necessarily think so. There's still a reasonable market for things like DO/Heroku, AWS inherently isn't trying to make it easier for people. I just wish I could have their image support and interface with dedicated hardware.
- mholt 9y agoAnd yet I instantly prefer DO to AWS because of the experience and good customer support and developer relations. Takes almost no time getting up to speed, while AWS feels like a better fit for large enterprise, which I'm not in that world. Codestar all they want, it's still AWS.
- deleted 9y ago[deleted]
- Tostino 9y agoI would be extremely happy with DO if they put out an S3 competitor. Right now, most of my servers are on DO, the only things I need AWS for is a single windows server to run some windows only software, and S3 to store my database backups.
- randomdude1234 9y agoThrowaway, but I would bet money that you'll see this pretty soon on DO - hang in there!
- leesalminen 9y agoThis is one of the big reasons I come to HN...insider intel.
- dsugarman 9y agoit's always smart to store your backups on another service anyway for any doomsday scenarios
- Tostino 9y agoOh even if DO offered an S3 competitor, i'd still have them going to S3 as well. I'd just have them also going to DO's solution, so restores would be MUCH faster, and wouldn't cost an arm and a leg.
- stevekemp 9y agoAnd to double the single-points of failure? Now your "stuff" is only alive if both the virtual machine(s) are up, and the object-store is accessible!
- Tostino 9y agoWhat do you mean? It's not like if your object store becomes unavailable your database sending it's backups there will suddenly stop working.
- stevekemp 9y agoIndeed, but if you're hosting user-images on S3 and they go away your site is broken. That might not be a big deal, or it might mean your site is 100% broken. I can't guess, but I'd assume since you went to the effort to setup a store you need it in some way. (No backups? Of a database? That's one power-cut, or hardware failure away from complete data loss too!)
- entropy128 9y agoI've recently done a moderately complex hybrid setup that used DO in conjunction with S3 and Route53. My biggest takeaway from the experience was how much the simplicity and speed of DO's dashboard interface stood out - the AWS web interface just felt laggy by comparison. I know it sounds like a poor reason to favour a platform but DO was just a simple pleasure to navigate and use.
- egeozcan 9y agoI think the takeaway here is that AWS is designed to be managed via its API and that shows when one tries to use the GUI (Source: Had a similar experience).
- deleted 9y ago[deleted]
- debaserab2 9y agoIf you're managing your infrastructure via GUI it's probably not moderately complex.
- deleted 9y ago[deleted]
- manacit 9y agoFeatures like this feel like table stakes for cloud hosting in 2017, so it's nice to see DigitalOcean on board. It'll be interesting to see what the tooling support looks like for this, it looks like it's launching with API support day one: https://developers.digitalocean.com/documentation/v2/ https://developers.digitalocean.com/documentation/v2/ which is great. It looks like they're already working to get it into Terraform: https://github.com/hashicorp/terraform/pull/15121 https://github.com/hashicorp/terraform/pull/15121 which is fantastic! I look forward to the day that I can automatically spin up a DigitalOcean set of Droplets running Kubernetes using this.
- tyingq 9y ago>I look forward to the day that I can automatically spin up a DigitalOcean set of Droplets running Kubernetes using this Stackpoint.io can do this, you paste your DO API key and get a k8s cluster in a few minutes. Would be nice if DO built something like that in-house.
- skrebbel 9y ago> Would be nice if DO built something like that in-house. Curious, why? Isn't it much nicer to keep that separate from DO so that you can move away from DO easily should there be a reason to? I'm not sure if I'm weird this way, but one main reason we use DO and not, say, AWS is because we're afraid of vendor lock-in. The more we depend on specialized services, the harder it gets to move somewhere. I wonder whether this is a common sentiment in 2017 or whether I'm just old-fashioned.
- tyingq 9y agoHosted K8s isn't much lock-in...you could move to GKE or Azure.
- malux85 9y agoDigitalOcean is killing it against Linode - I just migrated my last services off Linode because you still cannot attach arbitrary sized disks to your instances, something they've been promising as arriving "soon" for months. Go DO!
- cuu508 9y agoThey both have their pros and cons. Linode offers more RAM for the same price. Linode's load balancers also support IPv6, DO's did not the last time I looked. And Google's Cloud Load Balancer beats both Linode and DigitalOcean hands down in terms of TLS handshakes per second.
- lovehashbrowns 9y agoAm I the only one who has constant issues with VMs in Linode? I feel like that platform is the worst out of all the ones I've tried so far. Unfortunately, our company is stuck with it for now. :(
- fictioncircle 9y agoI use the San Jose facility for my Linodes. I haven't had a problem since the rolling power outages years ago where Hurricane Electric's backup power failed to kick in.
- artursapek 9y agoIssues like what? I used to have my machines freak out and crash once in a while before moving it all to KVM. Haven't had trouble since.
- lovehashbrowns 9y agoIt's mostly "Hardware issue" errors. We'll get an email from them with the name of the VM saying that an error was detected, and that the issue will be resolved soon. It is generally fixed pretty quickly. It has the side effect of forcing me to learn how to recover from these events, but it's not so fun when my master database's server goes out (that's happened twice in the two years I've been at my current employer). We also have everything moved over to KVM already. We occasionally experience problems with %steal due to other VMs in the same host. It was a lot worse when we had a critical service hosted in Linode, but that was gutted and moved to actual hardware. Only a small, low-traffic bit still remains in Linode.
- daxorid 9y agoIt's not clear what this offers over the usual iptables/firewalld + ansible solution. What am I missing?
- blowski 9y agoPoint and click configuration for those of us not so comfortable with text files, I guess
- certifiedloud 9y agoA GUI. Seriously though, they are probably using the technologies that you mentioned (or some equivalent) under the hood.
- snowpalmer 9y agoIt defines a firewall outside of your machine so your iptables/firewalld configuration on individual droplets can be much simpler. (assuming it works like security groups on AWS, create one apply to many.)
- manacit 9y agoThe same thing that their load balancer project offers over HAProxy + Ansible - the ability to configure it via their API (or their Web UI) and have DigitalOcean own the implementation and management of everything. This includes making improvements under the hood, security updates, etc. There's very little you can't do with enough Ansible and other utilities, but letting your cloud hosting provider handle it comes with a lot of benefits.
- kefka 9y agoIve always like Ansible/Puppet/file storage. I can quickly boot from ethernet, populate a req key from puppet from ansible, load puppet to the appropriate config needed, and off I go. No having to dork with servers one at a time. And with Ansible, if I change puppet manifests, I can reload puppet with ansible instead of waiting the default 30m.
- genpage 9y ago
- jimaek 9y agoOnce they double the RAM on all plans like Linode and Vultr did, I will move all of my servers back to DigitalOcean. I love these features but double the RAM for the same price still outweighs them.
- StavrosK 9y agoThis is exactly why my next server will be on Vultr, too, although I still curse Linode for still not having block storage and forcing me to pay double price for a larger server even though I just need 20 more GB of disk space.
- odonnellryan 9y agoNot supporting Linode, but can't you use something like AWS for that?
- StavrosK 9y agoHmm, how do you mean? Mount an EC2 volume on a Linode server? The latency would be horrible.
- odonnellryan 9y agoOr S3, or another DO box, I guess. You're right that you'd never get excellent latency, but it could be good for storage.
- StavrosK 9y agoUnfortunately it's a database that's gotten big, so I need low latency :/
- odonnellryan 9y agoHmm! How big?
- chays 9y agoFinally I can block all SSH access by default and only open up to 1 IP address on demand then remove when finished. No jump hosts required.
- the_common_man 9y agoCan someone clarify if the traffic between two droplets is "secure" i.e other droplets cannot see them? On AWS, I can create a VPC and put two ec2 instances on that.
- vultour 9y agoI'm not expert on hypervisors but is what you're saying even possible? One would think that dispatching the correct packets to the correct VM would be an integral part of the virtualization environment.
- majewsky 9y agoNot an expert either, but afaik customer isolation is quite easy when you put each customer on their own VLAN (or similar) and remove the VLAN tag only after the packet has reached the virtual NIC of the customer's VM.
- SXX 9y agoI have no idea if something changed, but at least about year ago "Private Networking" on DO was shared between more than just your droplets and required additional firewall / encryption.
- quicksilver03 9y agoIt isn't by default, that's why DO calls it "shared private network" (their words, not mine). To secure internal traffic on DO you have to encrypt it, using for example something like tinc.
- lobster_johnson 9y agoDon't use Tinc if you care about performance. Tinc is implemented in userland, and is an order of magnitude slower than a kernel-negotiated encryption. IPsec and GRE tunnels are much better solutions.
- raiyu 9y agoWe are about 2 quarters in on VPC, and we are looking to launch a full VPC solution in Q4 of 2017 or early Q1 of 2018. That coupled with firewalls will allow you to completely segment your traffic and also ensure that all private traffic is completely segmented as well.
- jbrooksuk 9y agoReally all we (the company I work for) need now is Block Storage in LON1!
- blfr 9y agoI know this is not strictly related but how well does Digital Ocean hold under a DDoS nowadays? Are they closer to Hetzner who just blackholes your IP or OVH who can withstand virtually anything?
- always_good 9y agoIn my experience last year, Digital Ocean blackholes you for 24 hours, during which they don't answer support tickets. In other words, you can take down any Digital Ocean site for 24 hours after paying $1 to a booter unless they are behind CloudFlare or some other mitigation.
- rgrove 9y agoDigitalOcean automatically blackholed one of my droplets due to a DDoS attack last year. They notified me immediately via email and a human responded to my support ticket within 30 minutes with technical details. I was able to provision a new droplet right away, so the downtime was minimal. I think the way DigitalOcean handled the incident was perfectly reasonable, and was a much better experience than I've had with other cloud providers in the past.
- xchaotic 9y agoI'm trying to explain what these are to my grandmother. Any car analogies? ;)
- ethanpil 9y agoThey are providing strong walls with carefully planned entry and exits to the "highway." The point is to only allow access to the road from predetermined, controlled points. Although its not 100% guaranteed to control access, it will mitigate many (if not most) of the unwanted traffic. As far as the actual entry and exit points that are sanctioned, those can still cause problems and still need to be monitored.
- blktiger 9y agoA physical firewall is "a wall or partition designed to inhibit or prevent the spread of fire" and a car typically has one in-between the engine and the passenger compartment. That way if the engine starts on fire, the passenger should have time to get out of the car before the fire gets to them. Computer firewalls are similar in that they are designed to protect the computer (the passenger compartment) from security threats (fire). Just like the firewall in your car, a firewall on a computer probably won't completely prevent security threats from getting through but it will help.
- riffic 9y agoA firewall is named for the structure in an automobile which keeps engine compartment fires out of the passenger cabin. https://en.wikipedia.org/wiki/Firewall_(engine) https://en.wikipedia.org/wiki/Firewall_(engine)
- nodomain 9y agoThis is why I love Hackernews.
- redbeard0x0a 9y agoOn top of it, there are holes (ports) in the firewall to let various wires through. It would also keep road grime, rocks, etc that might be kicked up from entering the passenger compartment.
- throwasehasdwi 9y agoIsn't this just doing the same exact thing as iptables only worse since it's not transparent to the operating system? I've created bad firewall rules by mistake many times and enforcing them transparently so the machines can't see them makes the issue almost impossible to debug and fix. Of course I have the same gripe with AWS VPC setups I guess... I just think it's funny how the cloud keeps reinventing cloud versions of things that perform objectively worse than the original, but then everyone still uses them out of pure convenience or stupidity.
- NetStrikeForce 9y agoMost people don't need anything more complex than this for their firewall needs, so iptables is overkill. Not only that, but iptables is just terrible to use and it just makes you want to kill yourself. I've deployed a pretty standard policy now in DO with a couple of clicks, works as expected. (And before anyone jumps, you should be using a host firewall too; defence in depth)
- egeozcan 9y ago> Not only that, but iptables is just terrible to use and it just makes you want to kill yourself. I can't agree more. Luckily though, if you have some setup scripts that you reuse, you don't have to think about iptables... Until the moment that you need to make this harmless quick change that shouldn't cause any problems and you end up locking yourself out of the server somehow.
- tasn 9y agoiptables is terrible, but nftables is great and mostly available. I wrote a post about my nftables config a while back. Plug: https://stosb.com/blog/explaining-my-configs-nftables/ https://stosb.com/blog/explaining-my-configs-nftables/
- derefr 9y ago1. These are stack-neutral: they let "cloud orchestrator" software plug one service into another by starting up Instance B and then opening the firewall port on Existing Instance A to talk to it, without having any ability to talk to or manage Existing Instance A, let alone knowledge of what it would have to say. Existing Instance A might be a Windows Server instance, or some custom unikernel; this approach would still work. 2. Depending on how they've implemented this, traffic that hits their firewall and bounces off might not be counted toward your bandwidth bill (presuming there's any part of DO's services that bills for bandwidth.) Once the traffic is served to your instance, they can't know whether your instance's OS firewall has just thrown it away, so they have to assume it hasn't and bill you for that. SDN-level firewalls enable "automatic DDoS protection"-type services, where you receive (and get charged for!) regular traffic, but not malicious traffic.
- nodesocket 9y agoSo awesome. It made me giggy today to remove all droplet level iptables rules and convert them to network level Cloud Firewall rules. Love how DigitalOcean allows you to specify droplets as sources, groups of droplets (tags) as sources, or CIDR ranges.
- Narkov 9y agoHow do you prevent one compromised host spreading to the rest of your hosts? Shouldn't this be an added level of security rather than a replacement?
- thomasruns 9y agoIs there a way to upload a list of ip addresses instead of having to paste, remove focus, re-focus over and over? I use cloud9 IDE and just for 1 region there are 90 possible IPs that they could be using to ssh into my DO box.
- aphextron 9y agoThis just made my day. Running apps on FreeBSD is awesome, but dealing with IPFW config is a nightmare.