Cloud Networking Basics: Addresses, Firewalls and Security Groups

Cloud networking has a small number of concepts that explain most of what you will meet. Getting them straight prevents both accidental exposure and hours spent wondering why traffic will not arrive.

Public and private addresses

Most cloud servers have two addresses. A public one is reachable from the internet. A private one is reachable only from within the provider’s network, usually only from your own resources.

Traffic between servers should use private addresses wherever possible. It is faster, it does not traverse the public internet, and on most providers internal traffic is cheaper or free while public egress is billed. See bandwidth, egress and the cost of moving data.

Reserved addresses

A public address assigned automatically at boot usually changes if the machine is recreated. A reserved address, variously called elastic, floating or static, belongs to your account and can be moved between machines.

That indirection is what lets you replace a server without changing DNS. It is also a quiet cost when reserved and unattached, as noted in why cloud bills surprise people.

Two firewalls, not one

This catches people regularly. There are typically two layers:

• The provider firewall — security groups, cloud firewalls or network rules, applied outside the machine. Traffic blocked here never reaches the server.
• The host firewall — running on the machine itself.

Traffic must pass both. When a service is unreachable and the application is clearly running, one of these two is almost always the reason, and it is usually the one you forgot exists.

Default deny

The only sound starting position is to deny everything inbound and open exactly what is needed: a management port from your own address range, and the ports the application serves. Nothing else.

Opening a database port to the whole internet is the single most common serious misconfiguration, and automated scanners find such hosts within minutes.

Inherited rules

Firewall rules on an account you did not configure encode someone else’s intentions. Review every rule before relying on the environment, and narrow anything broader than it needs to be. That check belongs in auditing an unfamiliar cloud account.