Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ content:
paragraph: Discover essential best practices for securing and optimizing public connectivity in your Scaleway cloud environment. Learn how to enhance performance and ensure robust protection.
tags: flexible-ip public-ip private-network connectivity best-practice
dates:
validation: 2024-09-30
validation: 2025-04-07
posted: 2024-09-30
categories:
- network
Expand All @@ -20,7 +20,7 @@ This document sets out best practices for securing and optimizing public connect
Public vs private connectivity defines how resources are accessed and exposed over networks.

- **Public connectivity**: Your resource has a [public IP address](/ipam/concepts/#public-flexible-ip-address) and is reachable over the public internet. Anyone with the right credentials can access the resource via its public IP address, e.g. over an [SSH connection](/instances/how-to/connect-to-instance/) or simply by directly accessing its IP address in a browser to retrieve and display any content it is serving, e.g. over HTTP.
- **Private connectivity**: Your resources is reachable over an attached [Private Network](/vpc/concepts/#private-networks). The resource has a [private IP address](/vpc/concepts/#private-ip-address), but it can only be accessed via this address from within the VPC of the Private Network. Such a resource may or may not also have a public IP address.
- **Private connectivity**: Your resource is reachable over an attached [Private Network](/vpc/concepts/#private-networks). The resource has a [private IP address](/vpc/concepts/#private-ip-address), but it can only be accessed via this address from within the VPC of the Private Network. Such a resource may or may not also have a public IP address.

## Effectively managing IP addresses

Expand Down Expand Up @@ -58,7 +58,7 @@ Depending on the resource type, public connectivity can be disabled by:
- Deactivating public connectivity (after resource creation)

<Message type="note">
For some products, e.g. Apple Silicon, public connectivity cannot be disabled at any stage, and for other resources, eg Managed Databases for Redis, public connectivity options cannot be modified after resource creation. Check the documentation for your specific product to learn more.
For some products, e.g. Apple Silicon, public connectivity cannot be disabled at any stage, and for other resources, e.g. Managed Databases for Redis, public connectivity options cannot be modified after resource creation. Check the documentation for your specific product to learn more.
</Message>

Favor resources such as Public Gateways and Load Balancers to provide access to the public internet over the Private Network. This allows Instances and other attached resources to send and receive packets to the internet through a single, secure point of access. You can use the Public Gateway's SSH bastion feature to [connect to your resource via its private IP address](/public-gateways/how-to/use-ssh-bastion/#how-to-connect-to-a-resource-behind-your-ssh-bastion).
Expand All @@ -73,18 +73,20 @@ Different products offer different security features and controls to help place

[Security groups](/instances/concepts/#security-group) act as firewalls, filtering public internet traffic on your Instances. They can be stateful or stateless, and allow you to create rules to drop or allow public traffic to and from your Instance. [Find out how to create and configure security groups](/instances/how-to/use-security-groups/).

### Load Balancers: ACLs
### Load Balancers: ACLs and WAF

<Macro id="acls" />

Learn how to use the ACL feature in our [dedicated how-to](/load-balancer/how-to/create-manage-acls/) and go deeper with our [reference documentation](/load-balancer/reference-content/acls/).

You can also add a *W**eb **A**pplication **F**irewall to your Load Balancer via our [Edge Services](/edge-services/reference-content/understanding-waf/) product. This adds an extra level of protection to your Load Balancer, by filtering requests and blocking those judged to be malicious.

### Other controls

For resources such as Instances and Elastic Metal servers, you may wish to implement third-party manual solutions in front of your public services to enhance security, for example:

- Deploying a reverse proxy, e.g. Nginx (/tutorials/nginx-reverse-proxy/), and configuring it to enforce rate limits and to throttle traffic. This helps to prevent abuse and DDOS attacks on your public-facing services.
- Installing a **W**eb **A**pplication **F**irewall that can filter out malicious traffic such as requests containing attack patterns, or requests from blacklisted IPs.
- Installing a third-party **W**eb **A**pplication **F**irewall that can filter out malicious traffic such as requests containing attack patterns, or requests from blacklisted IPs.

## Handling traffic surges

Expand All @@ -96,7 +98,7 @@ Scaleway currently offers Autoscaling in Public Beta. Autoscaling allows you to

### Load Balancer

Placing a Scaleway Load Balancer in front of your backend servers allows you to expose multiple Instances through a single public IP. The Load Balancer distributes workload across the servers in the backend pool, ensurable scalable and continuously available applications, even during heavy traffic. You can manually add and remove servers from the backend pool as necessary, and configure the best balancing method for your particular needs. Find out more in the [Load Balancer documentation](/load-balancer/).
Placing a Scaleway Load Balancer in front of your backend servers allows you to expose multiple Instances through a single public IP. The Load Balancer distributes workload across the servers in the backend pool, ensuring scalable and continuously available applications, even during heavy traffic. You can manually add and remove servers from the backend pool as necessary, and configure the best balancing method for your particular needs. Find out more in the [Load Balancer documentation](/load-balancer/).

### Edge Services

Expand Down
6 changes: 3 additions & 3 deletions pages/load-balancer/faq.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ meta:
content:
h1: Load Balancer FAQ
dates:
validation: 2024-09-25
validation: 2025-04-07
category: network
productIcon: LbProductIcon
---
Expand All @@ -15,7 +15,7 @@ productIcon: LbProductIcon
Load Balancers are highly available and fully managed Instances, configured to distribute workload across a set of backend servers. They ensure the scaling of applications while securing their continuous availability. Load Balancers are therefore commonly used to improve the performance and reliability of websites, applications, databases, and other services.
Scaleway Load Balancer monitors the availability of your backend servers via health checks. If it detects that a server is down, it rebalances the load between the rest of the servers, making your applications highly available for users.

A Load Balancer can be used as frontend for any Instance type, even if it is not a Scaleway resource, thanks to the [multi-cloud feature](/load-balancer/faq/#what-is-the-difference-between-multi-cloud-and-non-multi-cloud-offers).
A Load Balancer can be used as frontend for any type of backend server, even if it is not a Scaleway resource, thanks to the [multi-cloud feature](/load-balancer/faq/#what-is-the-difference-between-multi-cloud-and-non-multi-cloud-offers).

## Can I use Load Balancers with other products?

Expand Down Expand Up @@ -92,4 +92,4 @@ Yes, this is possible with Scaleway's [Edge Services](/edge-services/) product,

## How can I add extra security such as a firewall or anti-DDOS to my Load Balancer?

This will be available soon via [Edge Services](/edge-services/), watch this space.
You can add a **W**eb **A**pplication **F**irewall to your Load Balancer via [Edge Services](/edge-services/reference-content/understanding-waf/).
6 changes: 3 additions & 3 deletions pages/load-balancer/how-to/create-load-balancer.mdx
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
---
meta:
title: How to create a Load Balancer
description: This page explains how to create a Load Balancer
description: Learn how to create a Load Balancer with Scaleway's step-by-step guide, ensuring scalable and continuously available applications.
content:
h1: How to create a Load Balancer
paragraph: This page explains how to create a Load Balancer
paragraph: Learn how to create a Load Balancer with Scaleway's step-by-step guide, ensuring scalable and continuously available applications.
tags: load-balancer load balancer
dates:
validation: 2024-10-04
validation: 2025-04-07
posted: 2021-05-26
categories:
- network
Expand Down
6 changes: 3 additions & 3 deletions pages/load-balancer/how-to/use-with-private-network.mdx
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
---
meta:
title: How to use your Load Balancer with a Private Network
description: This page explains how to use your Load Balancer with a Private Network
description: Learn how to use Scaleway Load Balancers with Private Networks to distribute workloads securely and efficiently.
content:
h1: How to use your Load Balancer with a Private Network
paragraph: This page explains how to use your Load Balancer with a Private Network
paragraph: Learn how to use Scaleway Load Balancers with Private Networks to distribute workloads securely and efficiently.
tags: load-balancer private-network load balancer private network
dates:
validation: 2024-10-04
validation: 2025-04-07
posted: 2021-05-26
categories:
- network
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ categories:
- load-balancer
- network
dates:
validation: 2024-10-04
validation: 2025-04-07
posted: 2023-06-05
---

Expand Down
2 changes: 1 addition & 1 deletion pages/public-gateways/faq.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ meta:
content:
h1: Public Gateways FAQ
dates:
validation: 2024-09-25
validation: 2025-04-07
category: network
productIcon: PublicGatewayProductIcon
---
Expand Down
2 changes: 1 addition & 1 deletion pages/vpc/how-to/create-private-network.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ content:
paragraph: Find out how to create a Private Network in a Scaleway VPC, and start building optimized, secure cloud infrastructures away from the public internet
tags: regional-private-network private-network vpc virtual-private-cloud region
dates:
validation: 2024-10-07
validation: 2025-04-07
posted: 2023-03-21
categories:
- network
Expand Down
4 changes: 2 additions & 2 deletions pages/vpc/how-to/delete-private-network.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ content:
paragraph: This page explains how to delete a Private Network
tags: regional-private-network private-network vpc virtual-private-cloud delete destroy
dates:
validation: 2024-10-04
validation: 2025-04-07
posted: 2023-03-21
categories:
- network
Expand All @@ -18,7 +18,7 @@ categories:
- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- [Created a Private Network](/vpc/how-to/create-private-network/)
- [Detached all resources](/vpc/how-to/attach-resources-to-pn/#how-to-detach-a-resource-from-a-private-network) from the Private Network you want to delete
- [Detached all resources](/vpc/how-to/attach-resources-to-pn/#how-to-detach-a-resource-from-a-private-network) and [released all reserved IP addresses](/ipam/how-to/reserve-ip/#how-to-release-a-reserved-private-ip-address) from the Private Network you want to delete

## How to delete a Private Network

Expand Down