3 ms·
Can someone clarify if the traffic between two droplets is "secure" i.e other droplets cannot see them? On AWS, I can create a VPC and put two ec2 instances on
by the_common_man 9y ago
Can someone clarify if the traffic between two droplets is "secure" i.e other droplets cannot see them? On AWS, I can create a VPC and put two ec2 instances on that.
- vultour 9y agoI'm not expert on hypervisors but is what you're saying even possible? One would think that dispatching the correct packets to the correct VM would be an integral part of the virtualization environment.
- majewsky 9y agoNot an expert either, but afaik customer isolation is quite easy when you put each customer on their own VLAN (or similar) and remove the VLAN tag only after the packet has reached the virtual NIC of the customer's VM.
- SXX 9y agoI have no idea if something changed, but at least about year ago "Private Networking" on DO was shared between more than just your droplets and required additional firewall / encryption.
- quicksilver03 9y agoIt isn't by default, that's why DO calls it "shared private network" (their words, not mine). To secure internal traffic on DO you have to encrypt it, using for example something like tinc.
- lobster_johnson 9y agoDon't use Tinc if you care about performance. Tinc is implemented in userland, and is an order of magnitude slower than a kernel-negotiated encryption. IPsec and GRE tunnels are much better solutions.
- raiyu 9y agoWe are about 2 quarters in on VPC, and we are looking to launch a full VPC solution in Q4 of 2017 or early Q1 of 2018. That coupled with firewalls will allow you to completely segment your traffic and also ensure that all private traffic is completely segmented as well.