I have a website hosted in IIS on an Azure Windows Server VM (Datacenter 2019). I can telnet to port 80 on the VM (and as you'd expect this stops working if I try disabling the relevant Windows Firewall rule), and I can access the site from a browser on the VM, but can't browse to the site from outside the machine. I have the following:
A public IP address
A network security group
An inbound rule in the NSG: Source = any, source port range = *, destination = internal IP address of VM, service = HTTP
As above for HTTPS, although I'm really only concerned with HTTP for now, I haven't set up a certificate yet
The port 80 inbound rule open in Windows Firewall (hence the telnet working).
If it makes a difference, this Azure instance has two separate resource groups, one for each client. The other client has a running site accessible to the internet.
SOLUTION: The site was actually running fine. This ended up being because browsers add the www automatically, despite me trying to work around this by disabling automatic URL modifications in Firefox (there's an about:config setting for this). A colleague had the same idea, but worked around it by putting an entry in the hosts file.
Then inbound rule in the NSG, should like below:
Source = public ip of client vm, source port range = *, destination = any, service = HTTP
Related
I have a site that I can run locally, but it's not accessible from my URL.
Here are the steps I've taken.
I have an A record created to my external IP.
My firewall has an access rule to allow the port I designated to be allowed in to the network from the WAN interface
I have a NAT rule to send any traffic on that port to the IIS server running the site.
I have disabled the Windows Firewall.
When I try and a get to the site via the URL + the port I get an error. See the image below.
What have I missed??
I've setup a VM and installed IIS. I checked that the firewall rules were enabled for HTTP and HTTPS. Furthermore, in Azure Portal, I've enabled the two predefined inbound security network group rules for HTTP and HTTPS.
When in the VM, I can go to localhost and see the default Web page of IIS Default Web Site.
Inbound security rule in Network Security Group
Anybody know how to go about figuring out how to make this work?
Thx
You should add port 443 and port 80 to azure VM windows firewall inbound rules.
Are the Source port ranges on your inbound rules set to 80/443 or * (i.e. all source ports)?
Try changing them to * with only the destination ports set to 80 or 443 respectively.
Ex:
Refer How to open ports to a virtual machine with the Azure portal for more details.
There are two ways to make your site accessible from the Internet.
Use the public IP address which is associated to the virtual machine's NIC.
Configure DNS for your VM machine (e.g. web.southeastasia.cloudapp.azure.com). This DNS is bounded to the associated public IP Address.
Reference: https://learn.microsoft.com/en-us/azure/virtual-machines/windows/portal-create-fqdn
In your IIS, just configure binding to make sure the incoming request from the Internet is recognized by IIS.
You also need to make sure you have no rule in Network Security Group (NSG) blocking port 80. Or if there is a NSG, you need to create an inbound rule to allow port 80.
I Azure Windows VM, apart from configuring the NSG rule, we should also create a Windows firewall rule to allow inbound TCP connections on the required port. Just RDP into your windows VM, open Windows Defender Firewall and add the rule
I'm banging my head on this seemingly simple task. I'm trying to stand up a Redhat VM in Azure. I've tried both the resource group approach and the classic approach.
I currently have a classic deployment. I've installed httpd via yum. I confirm that I can SSH to the server via the virtual IP. Once in, I start httpd and I can perform wget http://localhost/ and get the content that I expect.
However, when I attempt to connect to the virtual IP from my local browser, there is no response. I've also tried creating a static public IP with no success.
I have created an HTTP "endpoint" in Azure portal. I set the public and private ports to 80 with a protocol of TCP. There are no ACL values (I assume it's defaulting to allow everything).
There is no network security group assigned to the VM.
Still no success. What else am I missing!?
Well, if you really setup an endpoint on the portal to allow port 80, the only thing thats left is the firewall on the Linux VM itself, allow port 80 on the firewall and you are good to go
1) service httpd restart and 2) service firewalld restart did the trick
I have created a CentOS 7.1 VM using Resource Manager deployment model.
I am not able to access the application using a browser on a machine connected to internet.
However I am able to access the application on same machine and other VM on same virtual network using private IP address.
I configured Network Security Group and allowed port 80 and 443 in Inbound Rules.
Well, it turned out that I needed to open ports under "Inbound Security Rules" and needed to open all in "Source Port Range". For doing so, i needed to put * there and in Destination port for https - 443 etc.
This * thing was the catch which i was missing in all the Inbound security rules for allowing the ports.
I've just set up a windows azure VM and installed IIS on it.
When I remote desktop onto the box I can see the default IIS website fine but I can't get this to serve on the web from the IP address of the box.
I've opened up port 80 on windows firewall and also added an endpoint for port 80.
I've tried to access it with the firewall completely turned off also but to no avail...
I cant work out if there is anything else I need to do to get this working?
Add endpoints for port 80 (http) and port 443 (https) to the VM in the Azure portal (tip: this can be automated with powershell or the Azure cli).
Remote desktop to the machine. Open the Windows firewall control panel and allow traffic to port 80 (http) and port 443 (https) or just turn it off ... the firewall is ON by default (tip: can also be scripted through the VM agent / powershell).
Go to the Azure portal and find the cloudapp.net subdomain for your VM (actually the cloud service) your VM is running under. Try accessing the site with that domain. If that doesn't work, try browsing to http://localhost on the server (remote desktop) to make sure IIS works and troubleshoot from there.
Modify the DNS records of your custom domain to use a CNAME to the .cloudapp.net domain. If you need A records make sure to use the public IP of the cloud service (just ping the .cloudapp.net domain to find it or look in the Azure portal).
You might want to look into Azure Websites or Azure Cloud Services (web roles). Those are a lot easier to manage and a lot cheaper. They still offer most of the functionality.
What fixed the issue for me was to go into the Azure Portal, browse to 'Network Security Groups', select the VM and then create an inbound rule to allow traffic to port 80.
Note: Also ensure that the inbound rule to port 80 is added and enabled on the actual VM.
Well, I deleted the existing VM and Cloud service and started again - all worked fine out of the box this time.
How annoying! The only thing I did notice was that before my cloud service had the same name as my VM - this time they had different names so that might have been what was causing the issue.
Cheers
For the newer VMs and pre-configured setups (2015+), it's possible your setup is using an azure asset called "Public IP". If so, you can set a custom DNS name label in it, inside "Configuration". Note that this name will consider any type of region used when creating the VM (e.g. my-site.brazilsouth.cloudapp.azure.com).
It's good to remember that for testing purposes, it still suffices to use the value of the public IP that is randomly designated to you.
The VMs are actually accessed via a Cloud Service (well they are for me). Azure created a Cloud Service automatically to be the scaling engine/load balancer on the front of the VM. I have to connect to the web site via that cloud service, not the VM directly.
Its possible you were using the internal IP rather than the external IP.
The sites have to use the internal IP address in the bindings section of IIS. However, in your dns you will need to use the external IP. This is presumably since the 'internal IP' is just a virtual one that Azure uses to map traffic from the external network to the VM's inside azure.
You should find both the internal and external IP's are visible on the VM's desktop.
Switch off TLS 1.3 in the Registry Editor.
This is what worked for me as of writing this in Mar 2021.