Answers: <p>I am going to suggest an approach that I would not necessarily recommend, because I do not consider it a manageable, scalable solution:</p>
  
  <p>SSH port forwarding.</p>
  
  <p>SSH is a Swiss Army knife in terms of its features. Virtually any port can be securely forwarded to any other port on a remote machine, and indeed through a remote machine to a target machine beyond.  Documentation abounds, but I really like the drawings <a href="https://unix.stackexchange.com/a/115906">in this answer</a>. I use ssh across <a href="https://en.wikipedia.org/wiki/Bastion_host" rel="nofollow noreferrer">bastion hosts</a> regularly in a manner that mirrors the diagrams at the link.</p>
  
  <p>As I said, I don't think this is a good solution, but it might serve to give you some ideas and it could be one component of a larger solution.</p>
  
  <p>Good luck!</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-04-19T11:28:24.040Z
Answers: SSH forwarding and using spiped are almost equivalent in principle, with the main difference that spiped seems to be more scalable (just define one secret per host per port on your configuration system for the receive part, and give access to the services that need to communicate with)
Answers: lullis
Answers: CC BY-SA 4.0
Answers: 2019-04-18T23:02:20.887Z
Answers: 2019-04-18T23:02:20.887Z
Answers: rriehle
Answers: <p>Another idea: <a href="https://www.zerotier.com" rel="nofollow noreferrer">ZeroTier</a>. </p>
  
  <p>I have not used it, but a fellow DevOps nerd recommends it.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-04-18T23:23:31.143Z
Answers: 2019-04-18T23:23:31.143Z
Answers: rriehle
Body: <p>I am working on an application that requires a number of different services (web application + database + worker queues, XMPP server for messaging, redis, central authentication via LDAP, etc). For my first attempt at designing the thing, I am estimating that I will need ~15 instances of varying sizes: more RAM/SSD for the database, less so for web server and LDAP, more cores for the worker queues, and so on.</p>
  
  <p>I don't want to use the big cloud Providers (AWS, Azure, GCP) for matters of cost. This is something I am still bootstrapping and GCP pricing calculator put this at ~$5800/month. A similar (in terms of CPU/RAM/SSD) spec in Hetzner cloud would be ~$430/month.</p>
  
  <p>Of course, the difference in price also comes with some difference in features. Hetzner Cloud VM instances do not have any sort of private networking. So I am wondering how I can ensure that all those machines can be effectively protected from the public internet. Some of these services (web server, xmpp server) should also have a public IP, but ideally all other services should have all ports closed (including SSH)</p>
  
  <p>I know that one of the answers is "build your own OpenVPN AS". However, (a) I never done it before and (b) I am under the impression this would mean yet more services to add to this infrastructure.</p>
  
  <p>One thing I <em>did</em> do before was to connect machines via <a href="https://www.tarsnap.com/spiped.html" rel="noreferrer">spiped</a>. This does not give you a private network but at least ensures that only those with the key can connect to your public-facing machines.</p>
  
  <p>So my question is: am I missing some alternative to these two above?</p>
  
  <p>Also: docker. I have limited experience with Docker and Kubernetes, but if I went this route it seems I would end up going to the arms of the big providers, not to mention it would still be yet-another thing to learn and take time from my application development. Is Docker Swarm something that could solve this requirement?</p>
  
Comments: CC BY-SA 4.0
Comments: 2019-04-17T05:32:51.013Z
Comments: I can't answer all your questions but I want to do something similar: same providers, less hosts. I will go for Kubernetes, in my tests it takes ~300MB more from the host compared to pure Docker. To secure your network you can choose one of those https://chrislovecnm.com/kubernetes/cni/choosing-a-cni-provider/ or implement wireguard. This one might be interesting too: https://romantomjak.com/posts/hetzner-private-networking.html
Comments: Marged
Tags: <security><cloud><networking>
Title: Securing communication between cloud VMs without private networks. Any strategy besides building own VPN? Spiped?
UserDisplayName: lullis
ThreadText: # Securing communication between cloud VMs without private networks. Any strategy besides building own VPN? Spiped?
  
  (Asked by: username_0 on 2019-04-16)
  
  I am working on an application that requires a number of different services (web application + database + worker queues, XMPP server for messaging, redis, central authentication via LDAP, etc). For my first attempt at designing the thing, I am estimating that I will need ~15 instances of varying sizes: more RAM/SSD for the database, less so for web server and LDAP, more cores for the worker queues, and so on.
  
  I don't want to use the big cloud Providers (AWS, Azure, GCP) for matters of cost. This is something I am still bootstrapping and GCP pricing calculator put this at ~$5800/month. A similar (in terms of CPU/RAM/SSD) spec in Hetzner cloud would be ~$430/month.
  
  Of course, the difference in price also comes with some difference in features. Hetzner Cloud VM instances do not have any sort of private networking. So I am wondering how I can ensure that all those machines can be effectively protected from the public internet. Some of these services (web server, xmpp server) should also have a public IP, but ideally all other services should have all ports closed (including SSH)
  
  I know that one of the answers is "build your own OpenVPN AS". However, (a) I never done it before and (b) I am under the impression this would mean yet more services to add to this infrastructure.
  
  One thing I *did* do before was to connect machines via [spiped](https://www.tarsnap.com/spiped.html). This does not give you a private network but at least ensures that only those with the key can connect to your public-facing machines.
  
  So my question is: am I missing some alternative to these two above?
  
  Also: docker. I have limited experience with Docker and Kubernetes, but if I went this route it seems I would end up going to the arms of the big providers, not to mention it would still be yet-another thing to learn and take time from my application development. Is Docker Swarm something that could solve this requirement?
  
  **Tags:** security, cloud, networking
  
  > **Comments:**
  > **username_1**: I can't answer all your questions but I want to do something similar: same providers, less hosts. I will go for Kubernetes, in my tests it takes ~300MB more from the host compared to pure Docker. To secure your network you can choose one of those https://chrislovecnm.com/kubernetes/cni/choosing-a-cni-provider/ or implement wireguard. This one might be interesting too: https://romantomjak.com/posts/hetzner-private-networking.html  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2019-04-18. Score: 1
  
  I am going to suggest an approach that I would not necessarily recommend, because I do not consider it a manageable, scalable solution:
  
  SSH port forwarding.
  
  SSH is a Swiss Army knife in terms of its features. Virtually any port can be securely forwarded to any other port on a remote machine, and indeed through a remote machine to a target machine beyond. Documentation abounds, but I really like the drawings [in this answer](https://unix.stackexchange.com/a/115906). I use ssh across [bastion hosts](https://en.wikipedia.org/wiki/Bastion_host) regularly in a manner that mirrors the diagrams at the link.
  
  As I said, I don't think this is a good solution, but it might serve to give you some ideas and it could be one component of a larger solution.
  
  Good luck!
  
  > **Comments:**
  > **username_0**: SSH forwarding and using spiped are almost equivalent in principle, with the main difference that spiped seems to be more scalable (just define one secret per host per port on your configuration system for the receive part, and give access to the services that need to communicate with)  
  
  ---
  
  ### Answer by username_2 on 2019-04-18. Score: 0
  
  Another idea: [ZeroTier](https://www.zerotier.com).
  
  I have not used it, but a fellow DevOps nerd recommends it.
  
  
  ---
  
  