Connecting your own servers privately
Once you have two machines, they need to talk to each other. The default — over their public addresses — is the worst of the options available to you.
Why not just use the public addresses
It works, and it means your database port, your cache and your internal API are reachable from the internet with only a firewall rule between them and everybody else. One mistake in that rule and you are in the news. Exposed Redis and MySQL instances are found by automated scanners within minutes of appearing.
It is also metered differently, adds latency, and leaves your internal traffic readable to anything on the path.
The options, in order of preference
- A private VLAN
- If your machines are with us, ask support for a private network between them. A
second interface on a VLAN that does not touch the internet, with addresses from
10.0.0.0/8or192.168.0.0/16. Full port speed, no transfer counted, nothing reachable from outside. - A cross-connect
- For colocated racks, a direct cable between them. The simplest thing that can possibly work, and the fastest.
- An encrypted overlay
- WireGuard over the public network. The right answer when the machines are in different buildings or with different providers, and sensible even on a private VLAN if the data is sensitive.
Bind services to the private address
Having a private network helps only if your services actually use it. Check what is listening on what:
ss -ltnp
Anything showing 0.0.0.0: is listening on every interface, public
included. Fix it at the application:
- MySQL/MariaDB:
bind-address = 10.0.0.2 - PostgreSQL:
listen_addresses = '10.0.0.2', plus the matchingpg_hba.confrule - Redis:
bind 10.0.0.2andprotected-mode yes - Elasticsearch, MongoDB, memcached: the same, and check after every upgrade
Then firewall it as well, so a configuration mistake is caught by the second layer. Belt and braces is correct here; see firewalling your server.
Name your machines
Put the private addresses in /etc/hosts on each machine, or run a small
internal DNS zone. Configuration that refers to db01.internal rather
than a literal address survives a renumbering, and makes it obvious at a glance which
traffic is meant to be internal.
Do not route between customers
A private VLAN is private to you. Do not bridge it to another customer's network or hand out addresses on it to machines that are not yours — our switches enforce what belongs where, and an unexpected MAC address on a port is treated as a fault rather than a feature. If you need to reach another party's infrastructure, that is a routed arrangement; ask us.
Ask before you cable
Private networking is arranged by an engineer, not a checkbox: we need to know which machines, which ports and what you are trying to achieve. Open a ticket with that and it is usually in place the same day.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base