4 ms·

It's not clear what this offers over the usual iptables/firewalld + ansible solution. What am I missing?

blowski 9y ago
Point and click configuration for those of us not so comfortable with text files, I guess
certifiedloud 9y ago
A GUI. Seriously though, they are probably using the technologies that you mentioned (or some equivalent) under the hood.
snowpalmer 9y ago
It defines a firewall outside of your machine so your iptables/firewalld configuration on individual droplets can be much simpler. (assuming it works like security groups on AWS, create one apply to many.)
manacit 9y ago
The same thing that their load balancer project offers over HAProxy + Ansible - the ability to configure it via their API (or their Web UI) and have DigitalOcean own the implementation and management of everything. This includes making improvements under the hood, security updates, etc. There's very little you can't do with enough Ansible and other utilities, but letting your cloud hosting provider handle it comes with a lot of benefits.
- kefka 9y ago
  Ive always like Ansible/Puppet/file storage. I can quickly boot from ethernet, populate a req key from puppet from ansible, load puppet to the appropriate config needed, and off I go. No having to dork with servers one at a time. And with Ansible, if I change puppet manifests, I can reload puppet with ansible instead of waiting the default 30m.
genpage 9y ago
Disclaimer: DO Support here The traffic is blocked/allowed at our network layer before being routed to the droplet. The rules are easily configurable through the control panel and API. You can also specify Droplets (individual or tagged) and our recently new Load Balancers as the targets. You can also layer multiple firewalls on top of one another if you want to apply specific firewall rules to only a specific set of Droplets/LBs The Intro tutorial we have is great for details: https://www.digitalocean.com/community/tutorials/an-introduction-to-digitalocean-cloud-firewalls https://www.digitalocean.com/community/tutorials/an-introduc... Feel free to reach out to us if you have any more specific questions. :)
- peterwwillis 9y ago
  How many firewalls can a single user create, and how many rules can be in each firewall? How is the order of multiple firewalls applied to the same droplet determined? Where is there logging to show when a rule matched? Is there any future plan to support REJECTing packets rather than only DROPing? Will the user interface warn the user when they are about to block all traffic (including ssh) to a droplet?
  - beardicus 9y ago
    (DO employee here) The intro article answers many of these questions (and more): https://www.digitalocean.com/community/tutorials/an-introduction-to-digitalocean-cloud-firewalls https://www.digitalocean.com/community/tutorials/an-introduc... > How many firewalls can a single user create, and how many rules can be in each firewall? 100 firewalls, 50 rules per firewall > How is the order of multiple firewalls applied to the same droplet determined? The rules are all added together and applied at the same priority. Order doesn't matter. > Where is there logging to show when a rule matched? No logging is available. > Is there any future plan to support REJECTing packets rather than only DROPing? No plans for this. > Will the user interface warn the user when they are about to block all traffic (including ssh) to a droplet? There are no footgun warnings, no. Let me know if you have more questions... thanks!
    - 9y ago
closeparen 9y ago
For example, let all your Droplets talk to each other (and no one else), but not have to explicitly track the list of IPs and generate firewall rules from that list on every host every time it changes. Deny outbound access except through specific hosts (config management, internal package mirrors) so that even an attacker with root can't phone home. The same reasons anyone uses firewall devices vs. host-based firewalls.
deleted 9y ago
[deleted]
AYBABTME 9y ago
iptables will consume resources on your droplet (CPU/network) to filter out the traffic. Cloud Firewalls are applied directly by the DO network, before ever hitting any of your droplets, so it uses none of your resources.

Point and click configuration for those of us not so comfortable with text files, I guess

A GUI. Seriously though, they are probably using the technologies that you mentioned (or some equivalent) under the hood.

snowpalmer 9y ago

It defines a firewall outside of your machine so your iptables/firewalld configuration on individual droplets can be much simpler. (assuming it works like security groups on AWS, create one apply to many.)

manacit 9y ago

The same thing that their load balancer project offers over HAProxy + Ansible - the ability to configure it via their API (or their Web UI) and have DigitalOcean own the implementation and management of everything. This includes making improvements under the hood, security updates, etc. There's very little you can't do with enough Ansible and other utilities, but letting your cloud hosting provider handle it comes with a lot of benefits.

kefka 9y ago
Ive always like Ansible/Puppet/file storage. I can quickly boot from ethernet, populate a req key from puppet from ansible, load puppet to the appropriate config needed, and off I go. No having to dork with servers one at a time. And with Ansible, if I change puppet manifests, I can reload puppet with ansible instead of waiting the default 30m.

genpage 9y ago

Disclaimer: DO Support here The traffic is blocked/allowed at our network layer before being routed to the droplet. The rules are easily configurable through the control panel and API. You can also specify Droplets (individual or tagged) and our recently new Load Balancers as the targets. You can also layer multiple firewalls on top of one another if you want to apply specific firewall rules to only a specific set of Droplets/LBs The Intro tutorial we have is great for details: https://www.digitalocean.com/community/tutorials/an-introduction-to-digitalocean-cloud-firewalls https://www.digitalocean.com/community/tutorials/an-introduc... Feel free to reach out to us if you have any more specific questions. :)

peterwwillis 9y ago
How many firewalls can a single user create, and how many rules can be in each firewall? How is the order of multiple firewalls applied to the same droplet determined? Where is there logging to show when a rule matched? Is there any future plan to support REJECTing packets rather than only DROPing? Will the user interface warn the user when they are about to block all traffic (including ssh) to a droplet?
- beardicus 9y ago
  (DO employee here) The intro article answers many of these questions (and more): https://www.digitalocean.com/community/tutorials/an-introduction-to-digitalocean-cloud-firewalls https://www.digitalocean.com/community/tutorials/an-introduc... > How many firewalls can a single user create, and how many rules can be in each firewall? 100 firewalls, 50 rules per firewall > How is the order of multiple firewalls applied to the same droplet determined? The rules are all added together and applied at the same priority. Order doesn't matter. > Where is there logging to show when a rule matched? No logging is available. > Is there any future plan to support REJECTing packets rather than only DROPing? No plans for this. > Will the user interface warn the user when they are about to block all traffic (including ssh) to a droplet? There are no footgun warnings, no. Let me know if you have more questions... thanks!
  - 9y ago

closeparen 9y ago

For example, let all your Droplets talk to each other (and no one else), but not have to explicitly track the list of IPs and generate firewall rules from that list on every host every time it changes. Deny outbound access except through specific hosts (config management, internal package mirrors) so that even an attacker with root can't phone home. The same reasons anyone uses firewall devices vs. host-based firewalls.

deleted 9y ago

[deleted]

AYBABTME 9y ago

iptables will consume resources on your droplet (CPU/network) to filter out the traffic. Cloud Firewalls are applied directly by the DO network, before ever hitting any of your droplets, so it uses none of your resources.