<blockquote>
<p>I would like some of those droplets to be blocked from the internet
The only way to do this on Digital Ocean is with the appropriate firewall rules</p>
</blockquote>
<p>The only way to do this (Terraform or otherwise) is to create the firewall rules and associate them to the droplets. The droplets are always assigned a public IP address by Digital Ocean, and the network firewall can be used to manage access via that endpoint.</p>
<p>However, internal configuration of the machine can be done to configure the droplets to use a custom preconfigured gateway and not use the public interface as a gateway.</p>
<p>Digital Ocean has <a href="https://docs.digitalocean.com/products/networking/vpc/how-to/configure-droplet-as-gateway/" rel="nofollow noreferrer">a writeup</a> on how they suggest this, using IP Tables and cloud-init:</p>
<ul>
<li>set up gateway server as NAT router <code>sysctl -w net.ipv4.ip_forward=1</code></li>
<li>change default route to your NAT gateway: <code>ip route change default via &lt;private IP of gateway host&gt;</code></li>
</ul>

CC BY-SA 4.0
2022-12-07T11:23:02.483Z
2022-12-07T11:23:02.483Z
Bruce Becker
<p>I am provisioning droplets on Digital Ocean with Terraform. I would like some of those droplets to be blocked from the internet, except for the Shared Private Network, and their appropriate gateway on that Network.</p>
<p>Is it possible to do this with Terraform?</p>

<terraform>
Is it possible to run a droplet on Digital Ocean without a public IP?
Evan Carroll
# Is it possible to run a droplet on Digital Ocean without a public IP?

(Asked by: username_0 on 2022-12-06)

I am provisioning droplets on Digital Ocean with Terraform. I would like some of those droplets to be blocked from the internet, except for the Shared Private Network, and their appropriate gateway on that Network.

Is it possible to do this with Terraform?

**Tags:** terraform


---

## 1 answers

### Answer by username_1 on 2022-12-07. Score: 1

> I would like some of those droplets to be blocked from the internet
> The only way to do this on Digital Ocean is with the appropriate firewall rules

The only way to do this (Terraform or otherwise) is to create the firewall rules and associate them to the droplets. The droplets are always assigned a public IP address by Digital Ocean, and the network firewall can be used to manage access via that endpoint.

However, internal configuration of the machine can be done to configure the droplets to use a custom preconfigured gateway and not use the public interface as a gateway.

Digital Ocean has [a writeup](https://docs.digitalocean.com/products/networking/vpc/how-to/configure-droplet-as-gateway/) on how they suggest this, using IP Tables and cloud-init:

* set up gateway server as NAT router `sysctl -w net.ipv4.ip_forward=1`
* change default route to your NAT gateway: `ip route change default via`


---

