Automate Firewall for Private LAN-ish

March 11, 2014 3k

By:

maximelb

I am looking at DO to run a cloud we currently have in AWS VPC, the prices are hard to beat so I am overlooking the fact DO doesn't have a truly safe private network (only available to a user). However, our cloud uses ZMQ between processing nodes and connects to a Cassandra cluster, which we would all like to have at DO, but none of which is authenticated by default. So I was wondering if DO (or anyone else) has a good way to automate firewall rules across a fleet of droplets. Essentially I would like to use something like SaltStack to automatically propagate new node's IP addresses and setup the firewall rules only allowing traffic between those, essentially sort of replicating the VPC from AWS here. I'm sure I could do it by hand, but this is just crazy, I want something 100% automated, has this been done by anyone?

Log In to Comment

1 Answer

iko April 7, 2014

I think, Digital Ocean is simple cloud hosting, built for developers. You can build your own cloud.

"Essentially I would like to use something like SaltStack to automatically propagate new node's IP addresses and setup the firewall rules only allowing traffic between those..."

- Ummm........ :
http://docs.saltstack.com/en/latest/topics/cloud/digitalocean.html

- DO saltstack:
https://www.digitalocean.com/community/articles/how-to-install-salt-on-ubuntu-12-04

- Automatic or Manage Infrastructure with Puppet/Chef
https://www.digitalocean.com/community/articles/how-to-install-puppet-on-a-digitalocean-vps

https://www.digitalocean.com/community/articles/how-to-create-simple-chef-cookbooks-to-manage-infrastructure-on-ubuntu

- Puppet Enterprise ??
http://puppetlabs.com/puppet/puppet-enterprise

=============
Firewall
=============
- Config Server Firewall (CSF)
https://www.digitalocean.com/community/articles/how-to-install-and-configure-config-server-firewall-csf-on-ubuntu
* White list all your node IP

- Forge firewall with puppet module
https://forge.puppetlabs.com/puppetlabs/firewall

===========
Migration
===========
- Transitioning from Amazon EC2 to DigitalOcean's Control Panel
https://www.digitalocean.com/community/articles/transitioning-from-amazon-ec2-to-digitalocean-s-control-panel

"Essentially I would like to use something like SaltStack to automatically propagate new node's IP addresses..."

https://www.digitalocean.com/community/questions/can-i-get-additional-ip-addresses-for-a-droplet

...............................................................................
Moisey say:

"We currently don't support multiple IP addresses for the same droplet, but if you give us some more info on what you're looking to setup we may be able to recommend a solution where we can work around the restriction of 1 IP per droplet."
...............................................................................

End:
Click support ticket.

Transitioning from Amazon EC2 to DigitalOcean's Control Panel

by Justin Ellingwood

This guide serves as an introduction to the DigitalOcean Droplet interface for those familiar with Amazon EC2 servers. The article covers some of the similarities and differences between the two services and as a basic navigation guide for common VPS tasks within the DigitalOcean interface.

Have another answer? Share your knowledge.