Hacker News Reader

Comment by cakeface | Hacker News Reader

How do you work on Digital Ocean or some other cloud without VPC? I haven't been able to figure this out. Sure, if I just have 1 or maybe 2 servers it's fine. More than that what are you doing? Mesh networking like ZeroTier? iptables on every machine? It just seems like a lot more work than setting up a VPC.

View on HN

Not to say it's as robust a strategy as a VPC, but DO does have something called a cloud firewall. It supports the idea of tags that apply to groups of servers.

https://www.digitalocean.com/community/tutorials/an-introduc...

The problem on DO is not outside tradfic but insode. when you enable networking everyone in the same DC network can access open ports on your machines. That elastixsearxh or redis you use needs ssl and pw protection otherwise you have a big problem

There's IPsec, although you are now trading VPC costs with sysadmin overhead costs.

Ovh might be good cheap alternative if you have that need. They have a virtual rack product that's much closer to a VPC.

You can configure the cloud firewall so that only VMs in your account with a certain tag can communicate, even over the internal network.

Public network + firewall feels dirtier than private network, but in reality they are the same thing: a network that’s only accessible to your VMs, to the extent that you trust the provider’s software to enforce that boundary.

A VPN can work very well. tinc [1] for example. Easy to deploy, sustains Gigabit speeds even on weak VMs. And works across different providers.

[1] http://tinc-vpn.org

And is about as good as building network on GRE tunnel, because its homebrew cryptography is written by a dilettante.

if you are running simple web app not having VPC is not a big issue.

Reply on news.ycombinator.com