You can. Of course. You can harden that instance to make sure no other application is running on it. If it's a Linux instance, you can use iptables/ufw. Again, my point is that I don't want my Masternode server to be on the same network as thousands of unknowns. Which is why my analogy of your home network connected to thousands of unknowns. You can try to secure your stuff, but why be on the same network as these guys? And they have bad intentions based on the fail2ban reports I was seeing.
ddwrt router would only open port 9999 to the MN. Even if I'm running an MN that is not fully hardened, it can't be accessed. I'll have other ways to access the box for remote admin stuff, but it will be through a single IP defined on the ddwrt router. I plan to use ssh with certificates also. Forget username/password.
So... if you don't trust your firewall to block all connections from the private network, how can you trust it to block stuff you don't want from the Internet at large? I get that Amazon will upstream block some trash (DDOS etc.) from the internet, but if the private interface is being fully firewalled and no services are listening on it anyway, then it shouldn't even need upstream protection from (say) DDOS, right? And Amazon would presumably pull the plug on anybody who attempted DDOS within their private network anyway.
I also don't see how "being on the same network as thousands of unknowns" is any less scary than having it on a virtualized server in general, where your instance is pretty much guaranteed to reside on hardware that shares VMs (and thus physical CPU, RAM, HDD/SSD) with unknowns. Don't get me wrong, I understand protected memory and all that jazz, but still the thought is scary as hell, and IMO scarier than having a fully blockable virtualized network connection to a private network. In both instances, you basically have to trust that things work as advertised.
All that being said, if I had the DRK to run a MN, I would be setting it up on hardware that I own and have formatted from 000000's, in a locking case, in a colo in the city where I live. If the revenue grew to be significant enough, I would spring for a locked private rack.
Really, my home network IS connected to the same network as thousands of unknowns. It's called the Internet. My home network is just behind a firewall (router, whatever you want to call it) that I trust. Currently it is a commercial router (not much important going on in my home network), but I have run a FreeBSD box with multiple NICs as my main home router in the past, when I was running a small web service company from home. In any case, I obviously wouldn't try running a MN on my home network, no matter how good my router!
Agreed, SSH with certificates is better than username/password, but sometimes impractical. Restricting SSH access to a single IP is good too. Just make sure that you can always obtain outbound access from that IP whenever you need to; and also that that IP will never ever change.
