I have two droplets, one a DB server and one an application server. The DB server has a host-based UFW ruleset allowing access only to from a certain IP, specifically so that only the application server can communicate with it.

My question is, in a scenario like this, is DO’s Cloud Firewall preferable? My understanding is that this firewall is network-based, and would filter the traffic before it touches the host, potentially saving the host some resources.

Is this a correct assumption? And if so, would configuring the cloud firewall in this way eliminate the need for the UFW configuration?

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
1 answer

Hello,

Indeed you are correct, having a Cloud Firewall would essentially mean that the traffic would be filtered before it even reaches your server. This could be very beneficial in case of a big DDoS attack, that way the malicious traffic would not even reach your droplet.

It is not necessary to have a software firewall like UFW enabled even if you have a separate Cloud Firewall.

Hope that this helps!
Regards,
Bobby

  • Hi;

    In my cloud firewall I defined a custom inbound rule for a particular port with UDP protocol. However, in my server ufw configuration this particular port is neither denied nor accepted. I would assume that internal ufw would not allow the traffic through this port, but it does.

    I’d appreciate any suggestions.

    Thanks

Submit an Answer