4 ms·

Well, I wouldn't put _any_ service on a public network, unless it is explicitly required. Firewall is all well and good, but security in depth is even better.

• solatic 3y ago
  The easiest firewall in the world is one that is set up to deny all traffic from all sources. Which is how any decent firewall is configured by default anyway. I'm not saying that running a private network doesn't provide genuine security value, only that it drastically complicates your networking architecture for very little security benefit. Organizations can decide whether that trade-off is worth it, for organizations with deep threat models like militaries and banks, it's probably worth it. For 99% of the private sector, it's folly.
• MayeulC 3y ago
  "Private networking" as defined by assigning private-range IP addresses are only private as long as there is no route to your network, or as long as it's isolated on a dedicated vlan (even then, there could be some rogue machines). In the first case, you need a firewall for IPv4 anyway. In the second case, that would also work with IPv6. Disclaimer: I know nothing about Azure/AWS internals.
• Shorel 3y ago
  Therefore job security of old school network administrators is the main factor against IPv6 coverage. Hopefully one of the big cloud providers figures it is in their best interest to have a much bigger address space and make all this busywork sinecure obsolete.
  • vasachi 3y ago
    Good luck administering IPv6 networks, they are so much easier to understand.
• fulafel 3y ago
  This phrasing is really problematic. Using internet addressing (vs ambiguous addresses) does not make your network "public". Just like using unique MAC addresses doesn't. Confusing global addressing with public reachabiliy is exactly the rhetoric used by AWS, Azure etc to scare people into building mazes of ambiguously addressed 10.x networks.
  • vasachi 3y ago
    What? Private networks are defined as networks, that use private address ranges[0]. They are most certainly not AWS "rhetoric". And why are unique MAC addresses a problem? [0] https://en.wikipedia.org/wiki/Private_network https://en.wikipedia.org/wiki/Private_network
    • fulafel 3y ago
      I was referring to "public network". (Though that WP page seems also to have self-coined the "private network" phrase and I don't think it's an estabilished term in this meaning. The first and second references off the leading paragraph talk about "private internets" and "unique local addresses" respectively).
      • vasachi 3y ago
        "Public network" can mean many things, but in context of IP addresses it usually means a network, that uses a globally addressable IP range. Now, that doesn't mean that the network is globally accessible. It can be tightly firewalled.
    • sgjohnson 3y ago
      Private address ranges doesn’t make a network private. Firewall does. If I know the external, publicly addressable IP address of your router (e.g. 135.77.9.106), and no firewall whatsoever, there’s nothing at all preventing me from doing `ip route add 10.0.0.0/8 135.77.9.106`, and voila, I’d have a route to your “private” network. Using private addresses vs globally unique offers no security benefiy whatsoever.