Create EC2-like security groups, so you don't have to configure iptables for each instance.
For instance, I would like each of my webserver instances to share the same iptables configuration, and furthermore to be communicate between each other without having to reconfigure each server's iptables every time an instance is added or removed.
intrepidweb
shared this idea
6 comments
-
Dougie
commented
Not that I don't agree that Rackspace could (and should) make this better/easier for customers, but this is not all that big of a deal compared to the other glaring areas they're lacking in.
Hows about use your config management app (chef, puppet, BladeLogic, whatever) to push out /etc/sysconfig/iptables and write a template that generates the ruleset on demand? Works fine for me and took about 2 minutes to write a recipe for my rulesets.
-
Sukrit Khera
commented
I have been using EC2 and now moving to Rackspace. This is really a must have especially if you have auto scaling array (cluster). With iptables alone , you have to write so many script and handle situations :
1. Server in the cluster goes down
2. New server is added
etc. -
Matt Solnit
commented
This would be great. I would love it if I could make firewall changes without SSH'ing to every running server and making the same iptables change. Also, I would no longer need to create a new server image if I want a firewall change for future servers.
-
Mike Conigliaro
commented
Additionally, messing with iptables rules on cloud instances can be really dangerous, because there is a very real chance that you could accidentally lock yourself out (remember, there's no such thing as console access in the cloud!). Security groups are much safer, because if you ever actually did make a mistake, it's trivial to just edit/delete the rule.
-
Mike Conigliaro
commented
I fail to see how iptables is simpler than ec2 security groups...
-
Matt Juszczak
commented
I personally feel that Rackspace Cloud shouldn't do this. Primarily because security groups are (mostly) iptables setups - just on the host box and not on the guest. It'll just add another layer to the mix of an implementation that I feel is already better than EC2 because of simplicity. If you use something like puppet, you can pretty easily automate iptables rules.
