13 ms·
Introducing Private Networking
- Goranek 13y agoI was at first skeptic about DigitalOcean, and thought they wouldn't survive, but here they are and constantly upgrading. I remember days when Linode lovers where bashing on IRC..oh they were so wrong Overall, nice job Digital Ocean!
- barrycheng 13y agoThanks!=]
- larrys 13y ago"and thought they wouldn't survive, but here they are and constantly upgrading." I wish them well and they seem to be doing a good job as you are saying. But don't confuse being able to "survive" for 2 years approx (founded 6/2011) as a result of raising over 3 million dollars (ref: crunchbase) with long term survival. One of the first things I learned back in the mid 90's was the expression "the great provider today can be the shit provider tomorrow" (that was in reference to bandwidth providers btw.) http://www.crunchbase.com/company/digitalocean http://www.crunchbase.com/company/digitalocean
- iand675 13y agoI was getting really close to switching to another cloud hosting provider due to the lack of private networks. Great to see that Digital Ocean is staying a step ahead.
- Goranek 13y agoisn't DO technically a VPS and not cloud provider?
- ksec 13y agoI dont normally count Host with Per Minute billing and Storage in SAN a VPS.
- zagi 13y agoA cloud is not defined by high availability. Just look at Amazon's cloud - so many single points of failure. Amazon says to distribute your application and redundancy across multiple redundancy zones. Cloud is defined as: 1. On demand automated provisioning 2. API interface for programatic control 3. Infinite resources from the customer's perspective 4. Virtual addresses for physical location 5. Utility measured service This is the definition from NIST : http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145... So in that context DigitalOcean and Amazon are both Cloud providers.
- adventured 13y agoIsn't it all the cloud? A dedicated host could be called a dedicated cloud provider. They give every customer their own cloud. Mostly it's a marketing gimmick. What DO is, is a variation of dividing server resources, whether we use the term cloud or VPS or other.
- raiyu 13y agoGlad we got you to stick around! =]
- arscan 13y ago> This address is only accessible from other other servers in the NYC2 region that have private networking enabled. Probably a really stupid question: is that interface only accessible from other servers in the same Digital Ocean account (in the NYC2 region w/priv networking enabled), or to every machine across all DO accounts (in the NYC2 region w/private networking enabled)?
- zagi 13y agoAll machines in NYC2 region are accessible via this private network.
- arscan 13y agoIt might be worth noting that in the tutorial. While this has a lot of great benefits for people that move a lot of data around between their servers, it doesn't really improve security at all.
- larrys 13y agoIt's actually worth noting that more clearly on the main page actually. Your parent question wasn't stupid at all. Not to mention the fact that the sales page hasn't even been proofed very well part of it reads: "Each new Droplet spun up in NYC2 can include a second interface on a network with no public internet access that is accessible from other Droplets have the private networking interface. You can enable shared private networking on your Droplet on the Droplet create screen. Traffic sent between Droplets on across the private network" Specifically "droplets have" and "droplets on across" Additionally "droplets" is not an industry standard term. It's a term (afaik) that DO invented for their marketing. They might want to define that as well for anyone who lands on that page and doesn't want to explore the rest of the site. That's the type of thing that will stop people dead in their tracks when trying to understand what is going on. It's cute but I'd really rather read industry standard terms for things.
- film42 13y agoBut it is a lot cheaper as it doesn't count against your monthly bandwidth. I read this as "cost savings plus added security."
- corresation 13y agoIs this not bounded to a particular tenant? Meaning if I have a droplet I can hammer/DoS/or exploit test other tenants? Obviously people should be giving these private IPs the normal care and concern that they give their "public" IP, but with many other vendors these are by default externally limited to images that you own, effectively providing layers of defense. EDIT: Note that I ask this specifically because the term private networking may be misleading to some. These are non-publicly routed, but they most certainly aren't private.
- zagi 13y agoThat is correct, it's not bound by tenant. Most other providers do not restrict private network either, I'm talking about the big ones like RackSpace, Amazon and others. What you're talking about is dedicated private VLAN's or private subnet's and that is not common especially in a cloud environment.
- jarito 13y agoThat's not entirely true. While Rackspace does provide a shared private network for intra-DC communication, it also provides the Cloud Networks product that is capable of creating tenant specific networks. Think VLAN tagging for Cloud. On that private network, you can use your own addressing, use multi-cast, etc. Much less limited and more secure than a shared private network. It's also free. Mandatory Disclosure: I work for Rack.
- shanelja 13y agoI spun up my first unmanaged server this morning on digitalocean and found the experience difficult (having next to no sysadmin experience) but now I've got it all set up it's fast and powerful. I love the work these guys are doing and can't wait to see more from them.
- frakkingcylons 13y agoIf you haven't already, check out the community tutorials. https://www.digitalocean.com/community/ https://www.digitalocean.com/community/
- raiyu 13y agoAwesome, glad to hear that the experience turned around for you. We do have a ton of articles in our community section to help you get started as others have mentioned: https://www.digitalocean.com/community https://www.digitalocean.com/community
- Ellipsis753 13y agoOut of interest what do people use this for?
- derengel 13y agohmm... are we still in hacker news?
- positr0n 13y agoYou can be a hacker and still know nothing about how modern website backends are designed.
- shiftpgdn 13y agoNot everyone is born with intrinsic knowledge of systems administration. Deriding someone for attempting to expand their knowledge is disgusting and needs to stop.
- xutopia 13y agoThere are lots of people who hack electronics or do desktop programming who have no idea how servers work even though they might be interested. We can't know everything and reminding people of their ignorance when they're asking to know more is discouraging. Stop it.
- zedpm 13y agoWhen people have multiple servers, often they need/want those servers to communicate. For example, I might have a web server and a separate database server. So anything on my web server that needs to make a database query would have to communicate over the network to the database server. Prior to this change, Digital Ocean users would have to do that communication over the public internet interface (public IPs), and the traffic would count towards their quota. Now, the servers can have private-side interfaces that aren't internet-facing, allowing this internal communication to take place on the internal network, avoiding the public interfaces and not counting towards the traffic quotas.
- 13y ago
- arcavorago 13y agoJust signed up for DO mostly just as a layer of separation for when I am on IRC. Very impressed with them and thinking about many other possibilities now. Keep it up DO!
- mitchwainer 13y agoThanks! =]
- jneal 13y agoI switched everything to DO a month ago and I'm loving it. I've been very impressed as well.
- mikecsh 13y ago>> just as a layer of separation for when I am on IRC What do you mean by this? Using your DO VM as a proxy?
- arcavorago 13y agoEssentially, yes. Sometimes as a proxy and sometimes straight from shell (irssi). My long term goal is to tailor an IRC bot to represent me virtually while I am unavailable (at work, etc).
- nly 13y ago> My long term goal is to tailor an IRC bot to represent me virtually while I am unavailable (at work, etc). Sounds like you want http://wiki.znc.in/ZNC http://wiki.znc.in/ZNC
- TazeTSchnitzel 13y agoJust get an IRC boucer. I like BIP.
- arcavorago 13y agoI'm talking about AI style responses based off a dataset I provide. Not just presence. =)
- IgorPartola 13y agoWhen will they introduce IPv6? They could then allocate a /64 to each customer and the customer can then firewall off their own little corner. 2013 is not a year when IPv6 is optional.
- napcae 13y agoThey started it but no ETA yet: http://digitalocean.uservoice.com/forums/136585-digital-ocean/suggestions/2639897-ipv6-addresses http://digitalocean.uservoice.com/forums/136585-digital-ocea...
- IgorPartola 13y agoThat ticket is going to be a year old soon.
- alepper 13y agoThere's a recent, more promising reply, though: "Once the initial rollout of [private networking to] the first region is finished we'll be moving to get IPv6 enabled in our NY2 region first and are targeting an October ETA for the first public beta!"
- windexh8er 13y agoJust FYI - you can't technically carve up a /64 without breaking EUI-64 rules if you're talking about subnets. With that said, you can still technically do just that or just break it up logically. You can have some interesting fun with routing between a few internal hosts. I've had some fun with Quagga on Linode slices in this regard.
- IgorPartola 13y agoI am not suggesting carving up a /64, but rather just allocating a /64 to every customer. Then I can allocate addresses out of the /64 to my own instances. I can further instruct them to not communicate on certain ports with anything outside of my /64. For example, I could tell my DB servers to only serve my /64, etc. I suppose if you are doing something cross data center then you want a larger allocation. Linode currently allocates 1 address per instance I think? It's better than nothing, but really they should do a /64.
- spindritf 13y agoThey also seem to have fixed the routing issues in Europe: $ ping -n -c 4 speedtest-ams1.digitalocean.com PING speedtest-ams1.digitalocean.com (198.211.119.108) 56(84) bytes of data. 64 bytes from 198.211.119.108: icmp_req=1 ttl=55 time=35.2 ms 64 bytes from 198.211.119.108: icmp_req=2 ttl=55 time=36.2 ms 64 bytes from 198.211.119.108: icmp_req=3 ttl=55 time=35.1 ms 64 bytes from 198.211.119.108: icmp_req=4 ttl=55 time=33.8 ms --- speedtest-ams1.digitalocean.com ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3004ms rtt min/avg/max/mdev = 33.854/35.095/36.208/0.845 ms It used to be over 100ms, almost as much as to NYC2.
- osiemens 13y agoAccording to Digitalocean the routing issue wasn't on their side. From what I could see, the cause of the latency was asymmetric routing. Some of my Amsterdam -> Amsterdam traffic had its return traffic sent via NY. This was resolved when they got more bandwidth and were able to disconnect Cogent some time last week.
- thejosh 13y agoNeeds VLAN support, atleast it's not on by default (yet), or someone might have the inkling to scan all internal IPs for people who didn't secure that networking interface.
- samsnelling 13y agoLet me preface by saying: I LOVE DIGITALOCEAN... However... For the past two days I have been evaluating a production system for my client base (which is primarily in the North Texas and Oklahoma Area. Here are my ServerBear results: UnixBench score: 3453.0 I/O rate: 354.0 MB/second Bandwidth rate: 24.5 MB/second Bandwidth to Dallas: 1.4 MB/s and UnixBench score: 3906.2 I/O rate: 369.0 MB/second Bandwidth rate: 17.2 MB/second Bandwidth to Dallas: 4.2 MB/second All in all, I decided to go with a managed Linode server. I'll be paying out the ass for it... but I think the bandwidth to my client base is more important. EDIT: I host just about all of my other projects on DO and I love it :)
- raiyu 13y agoWhen it comes to pure throughput there's unfortunately no way around physical proximity, but glad to hear the rest of your projects are on DO =]
- jlgaddis 13y agoSounds like this is one big subnet that all droplets (with the "private" interface) will be in (i.e. a single broadcast domain). Keep that in mind when designing security into your applications.
- bmath 13y agoThat's correct. DO does some filtering to prevent networks from leaking to a different droplet's interface. However, we recommend that the users protect both public and private interfaces with iptables filters and use encryption where the data stored or transfered is sensitive.
- mkhattab 13y agoGreat news for the NYC2 datacenter. I'm just waiting for the SFO to have this feature, among other things. One other critical feature I think should be implemented is the ability deploying instances to different physical hosts in master/slave setups, either automatically or manually[0]. [0]: http://digitalocean.uservoice.com/forums/136585-digital-ocean/suggestions/3859618-deploy-to-physically-separated-hardware http://digitalocean.uservoice.com/forums/136585-digital-ocea...
- kbar13 13y agoarchlinux template seems to not correctly bring up networking with private IP enabled.
- gelstudios 13y agoiperf results: 0.0-10.0 sec 1.10 GBytes 941 Mbits/sec. Same for 20, 30, and 40 seconds.