> I have a couple of servers running in digital ocean with some docker web applications on them. I want to block access to these web services from the public in

> I have a couple of servers running in digital ocean with some docker web applications on them. I want to block access to these web services from the public internet but allow them from the VPC network. What you need is a private network[1]. A private VPC will allow instances to communicate with each other, but to access them from the outside a "bastion host" is required. If you install a VPN in the bastion house and add the appropriate routes and settings, you'll be able to connect to your instances internally. This is the "proper" way to create a "private" network. You could achieve the same thing using Cloud Firewall[2]. The cloud firewall supports droplet as a "source" definition. UPDATE: You can create a private network using a shared VPN but it is an overkill if instances are on the same data centre. [1]: https://www.digitalocean.com/docs/networking/vpc/#features https://www.digitalocean.com/docs/networking/vpc/#features [2]: https://www.digitalocean.com/docs/networking/firewalls/#features https://www.digitalocean.com/docs/networking/firewalls/#feat...