3 ms·

How do you work on Digital Ocean or some other cloud without VPC? I haven't been able to figure this out. Sure, if I just have 1 or maybe 2 servers it's fine. M

How do you work on Digital Ocean or some other cloud without VPC? I haven't been able to figure this out. Sure, if I just have 1 or maybe 2 servers it's fine. More than that what are you doing? Mesh networking like ZeroTier? iptables on every machine? It just seems like a lot more work than setting up a VPC.

tyingq 9y ago
Not to say it's as robust a strategy as a VPC, but DO does have something called a cloud firewall. It supports the idea of tags that apply to groups of servers. https://www.digitalocean.com/community/tutorials/an-introduction-to-digitalocean-cloud-firewalls https://www.digitalocean.com/community/tutorials/an-introduc...
- beberlei 9y ago
  The problem on DO is not outside tradfic but insode. when you enable networking everyone in the same DC network can access open ports on your machines. That elastixsearxh or redis you use needs ssl and pw protection otherwise you have a big problem
  - rescbr 9y ago
    There's IPsec, although you are now trading VPC costs with sysadmin overhead costs.
  - tyingq 9y ago
    Ovh might be good cheap alternative if you have that need. They have a virtual rack product that's much closer to a VPC.
  - closeparen 9y ago
    You can configure the cloud firewall so that only VMs in your account with a certain tag can communicate, even over the internal network. Public network + firewall feels dirtier than private network, but in reality they are the same thing: a network that’s only accessible to your VMs, to the extent that you trust the provider’s software to enforce that boundary.
nh2 9y ago
A VPN can work very well. tinc [1] for example. Easy to deploy, sustains Gigabit speeds even on weak VMs. And works across different providers. [1] http://tinc-vpn.org http://tinc-vpn.org
- dozzie 9y ago
  And is about as good as building network on GRE tunnel, because its homebrew cryptography is written by a dilettante.
qaq 9y ago
if you are running simple web app not having VPC is not a big issue.

tyingq 9y ago

Not to say it's as robust a strategy as a VPC, but DO does have something called a cloud firewall. It supports the idea of tags that apply to groups of servers. https://www.digitalocean.com/community/tutorials/an-introduction-to-digitalocean-cloud-firewalls https://www.digitalocean.com/community/tutorials/an-introduc...

beberlei 9y ago
The problem on DO is not outside tradfic but insode. when you enable networking everyone in the same DC network can access open ports on your machines. That elastixsearxh or redis you use needs ssl and pw protection otherwise you have a big problem
- rescbr 9y ago
  There's IPsec, although you are now trading VPC costs with sysadmin overhead costs.
- tyingq 9y ago
  Ovh might be good cheap alternative if you have that need. They have a virtual rack product that's much closer to a VPC.
- closeparen 9y ago
  You can configure the cloud firewall so that only VMs in your account with a certain tag can communicate, even over the internal network. Public network + firewall feels dirtier than private network, but in reality they are the same thing: a network that’s only accessible to your VMs, to the extent that you trust the provider’s software to enforce that boundary.

nh2 9y ago

A VPN can work very well. tinc [1] for example. Easy to deploy, sustains Gigabit speeds even on weak VMs. And works across different providers. [1] http://tinc-vpn.org http://tinc-vpn.org

dozzie 9y ago
And is about as good as building network on GRE tunnel, because its homebrew cryptography is written by a dilettante.

qaq 9y ago

if you are running simple web app not having VPC is not a big issue.