DigitalOcean Raises $37.2M From Andreessen Horowitz to Take on AWS

Re:DigitalOcean Raises $37.2M From Andreessen Horowitz to Ta... by bad_user on Thursday March 06, 2014 @02:07PM (#7355852)

iptables is powerful but definitely not simple.

Simple is being able to simply say "allow all outgoing traffic and incoming traffic should only be allowed for HTTP(S) and SSH" and being able to figure out how to do it by just invoking "ufw --help".

Maybe someday I'll learn about iptables, I'm sure it's going to be worth it, but for now ufw does the job for me.

[ Parent | on HN ]

Re:DigitalOcean Raises $37.2M From Andreessen Horowitz to Ta... by nknighthb on Thursday March 06, 2014 @09:45PM (#7358219)

> iptables is powerful but definitely not simple.

> Maybe someday I'll learn about iptables

Hmm...

    iptables -A INPUT -p tcp --dport 22 -j ALLOW
    iptables -A INPUT -p tcp --dport 80 -j ALLOW
    iptables -A INPUT -p tcp --dport 443 -j ALLOW
    iptables -A INPUT -p icmp -j ALLOW
    iptables -A INPUT -i eth0 -j DROP

So complicated...

[ Parent | on HN ]

Re:DigitalOcean Raises $37.2M From Andreessen Horowitz to Ta... by rlpb on Friday March 07, 2014 @09:21AM (#7360304)

> So complicated...

Indeed, it is. Even if you want to cargo cult that without understanding it, you might get bitten because running those commands again will not do what you expect, since they're not idempotent.

You will now reply telling me how to deal with this situation, for example if I want to now listen on a different port, or how I get FTP (or some other protocol that needs "-m state" to work. The need to do this proves that using iptables is more complicated that your example.

[ Parent | on HN ]

Re:DigitalOcean Raises $37.2M From Andreessen Horowitz to Ta... by vacri on Friday March 07, 2014 @12:53AM (#7358722)

I've not played with iptables much, but when I do, I'm always struck by how easy it is to read rules, yet hard to write from scratch. This being said, a simple config like this is trivially googleable.

[ Parent | on HN ]