nickdan wrote:
Guspaz wrote:
To be fair, the only purpose of a private network is to avoid getting charged for internal bandwidth; if there is no bandwidth charges, a private network is pointless. You shouldn't be trusting a private network to be secure anyhow, you should be using a VPN.
FYI, Linode's private network is just another open LAN; you'll get broadcast packets from other peoples' linodes.
That's not my understanding of the matter. See the post by Caker in this thread:
http://forum.linode.com/viewtopic.php?p=39528. I also confirmed this with Linode Support. I'll be very disappointed to learn it is not the case.
Guspaz was talking about broadcast traffic, while I'm pretty sure Caker's comments in that thread are in regards to unicast traffic.
Think of the private network as a big LAN switch. While your Linode's private interface will only receive unicast traffic directed at it, everyone sees broadcast traffic. There are ingress controls so no-one can spoof your private address (but I'd expect that on the public interface too), but anyone who generates unicast traffic at your Linode can reach it. I'm not sure what other sort of configuration you'd expect to make sense. Unless you're expecting Linode to define and maintain individual VLANs at layer 2 for all customers, but I'd expect that to be unreasonable (and unnecessary) in terms of scale and maintenance.
In terms of security, treat it just like the public interface, and filter to just those private addresses that you know belong to your Linodes. No differently than your public interface, or IPv6 traffic (which has no "private" network).
-- David