View All Products
Compute
Storage
Networking
Databases
Services
Developer Tools
Industries
Pricing
Community
Engage With Us
Community ▶ Questions ▶ How Private is Private?
Log in to Ask a Question

How Private is Private?

networking

Sorry for the stupid question, but I just want to make sure I understand Private IPs. So if I have two Linodes with private IPs, clearly any traffic between the two is hidden from the Internet, but is it hidden from other Linodes in the same data center? Or on the same subnet?

In other words, do I need to encrypt private IP traffic between my two Linodes, or is it impossible for anyone else to sniff my private IP traffic?

6 Replies

No it's not accessible from the Internet

Private Network

As for internally, you really do need take measures, I may be mistaken but everyone within Linode's network in that data center would be visible.

@marcus0263:

No it's not accessible from the Internet

Private Network

As for internally, you really do need take measures, I may be mistaken but everyone within Linode's network in that data center would be visible.

iirc, your internal (private) interface(s) are visible to other linoden in your datacenter. it's up to you to lock it down.

Because of the way caker has the linode networking stuff set up, no linode can see the traffic that isn't explicitly destined for it.

@warewolf:

Because of the way caker has the linode networking stuff set up, no linode can see the traffic that isn't explicitly destined for it.

well, that's comforting :)

Thought I would maybe clarify this a bit.

You DO need to secure your ports because anyone in your datacenter can connect to services you make available via the private network.

So you should only allow IPs which you expect to communicate with.

So don't leave your memcached server exposed so that someone can come across it on a port scan and steal your data over the private net.

However, they have promiscuous mode turned off, and no broadcast/multicast stuff so you don't need to worry about someone sniffing your traffic as it goes across the wire.

@H3LR4ZR:

…and no broadcast/multicast stuff…
(Sorry for the partial quote)

Broadcast is certainly enabled – whoever has 192.168.139.100 in the Atlanta DC seems to enjoy Samba on their Linode and I keep seeing all the damn MS protocol broadcasts traffic on my Linode:

[IPTABLES REJECT] : IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:fe:fd:40:16:47:15:08:00 SRC=192.168.139.100 DST=192.168.255.255 LEN=243 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=223 
[IPTABLES REJECT] : IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:fe:fd:40:16:47:15:08:00 SRC=192.168.139.100 DST=192.168.255.255 LEN=235 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=215 
[IPTABLES REJECT] : IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:fe:fd:40:16:47:15:08:00 SRC=192.168.139.100 DST=192.168.255.255 LEN=243 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=223 
[IPTABLES REJECT] : IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:fe:fd:40:16:47:15:08:00 SRC=192.168.139.100 DST=192.168.255.255 LEN=235 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=215

Reply

Please enter an answer
Tips:

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (https://www.google.com)

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Log in to Reply
Community Code of Conduct