I prepared two virtual machines with Windows Server 2012. I want allow them to communicate with each other: I opened port and disabled firewall on both machines, but when I try to ping one VM from another one using private or public IP address and when I am using telnet, I have problem with timeout. Both are in same virtual network. What else should I do?
By default, VMs in the same VNet could communicate with each other with any port and any protocol in the NSG unless you have added some inbound or outbound port rules with high priority. Also some rules in windows firewall blocks on the VMs.
In this case, you could check if the app or service is started and the port is listening for 0.0.0.0.
Related
I have created a Windows WCF Service and I want to host it inside Azure VM.
The service is locally running fine inside the VM, but when attempting to access the service outside of the VM, I cannot connect to the service at the specified port.
While requesting the service, I'm getting the following error:
SocketException (0x274d): No connection could be made because the target machine actively refused it...
Also, while pinging the VM through the command prompt with public ip, I'm getting Request timed out.
I have enabled the port for TCP in Azure inbound rules as well as in VM firewall inbound rules. The VM is Windows Server.
How can I access the service running in the VM from another system?
Any help is appreciated.
check application is running on the port you exposed
check windows level firewall allows traffic on that port from your destination
check NIC level NSG allows traffic on that port from your destination
check subnet level NSG allows traffic on that port from your destination
you might also have Azure Firewall\UDR\NVA in the networking setup, check those as well (this is highly unlikely if you are not running an enterprise grade setup).
I am testing my own TCP client/server software, trying to use an Azure VM for testing. I have done this successfully on a Azure VM that I set up over a year ago. Now I have created a new VM that I need to test with. My service is installed on the VM and is monitoring port 18971. In the Azure portal, I have created an "endpoint" for TCP for that port. The machine is running Windows 2012. I have configured Windows Firewall with inbound and outbound rules to allow all TCP traffic to/from that port. I have also tried turning the firewall off. Still, my client software does not work, I receive error 10060 on the Winsock API "connect". I tried both the domain name and the IP address.
Any ideas of what else I have to do to allow TCP traffic? I am pretty sure this is an Azure configuration problem - I have successfully tested the software on direct connected machines as well as the old Azure VM I mentioned (I see no difference between it and the one I am trying now).
I guess you use the new type of VM with a resource manager on the old portal which you have "endpoint" for TCP for that port. You have to open some ports (endpoints) on new VM via the new portal. Refer to this.
For the new type of VM with a resource manager, you have to allow the port 18971 in the inbound port rules of NSG associated with your Azure VM or subnet.
Navigate to your virtual machine settings, and find Networking---Add inbound port rule.
I'm using Windows Azure virtual machines. What I did was I have added some new TCP port to inbound and outbound rules in the firewall. After that I can't get the Remote Desktop connection from my PC. But I got Remote Desktop connection from another virtual machine by using the local IP address.
My DNS is :xxxx.cloudapp.net:3389.
This is the issue I'm facing. What I actually want is to give provision to new ports inbound and outbound rules in windows Azure virtual machines. Any help would be grateful.
Not exactly a programming question but anyway:
Nmap scan report for mjsindia.cloudapp.net (13.66.56.229)
PORT STATE SERVICE
3389/tcp filtered ms-wbt-server
Make sure you have 3389/TCP open inbound on both the Network Security Group or ACL in the Azure Portal and Windows Firewall (on the VM, for all Firewall profiles - Private/Public/Domain).
I'm starting to use the cloud service of Microsoft Azure and I have a question about Virtual Networks.
I created a virtual network, without dns server, and allocate two virtual machines in this virtual network.
So I ran one service in my virtual machine that have a web interface on port 4040.
But I can't access this port from my local machine, like:
public_ip:4040
or
internal_ip: 4040
I added an endpoint to port 4040 in this machine in my manage portal and the result is the same.
Can anyone suggest something to try?
This kind of operation is possible?
Congratulations on flagging-off your Azure Journey!
I assume these are windows servers that you have them deployed. I have elaborated some of the troubleshooting that you can do:
You would have an NSG attached to the VM NIC/Subnet. Kindly proceed to create an inbound rule to Allow 4040 from your specific public IP from where you are trying to access the VM.
Now, do a nestat -ano | Findstr 4040 from your cmd and see if it's listening
Should you have them both, now turnoff your windows firewall from all profiles
After which, you can take a network capture using easy to go tools such as Wireshark/network monitor on the VM's or if you are using a Linux VM. Simple TCPdump.
While you are collecting captures, keep in mind to initiate traffic from your client IP to the respective Public IP:4040
Narrow down the issue:
- If the packets are incoming with destination port 4040. No issues with Azure
- If the 4040 is not listening, the service needs to listen on that port
- Put the firewall back on and see if the TCP packets are still coming on 4040
- If none of this works, it's highly unlikely for that port to be used. So, you can give
it a restart and check the same.
But, I highly recommend network captures with continuous TCP ping on to the port 4040.
I hope this helps. Should you have any difficulty with network captures use the links below:
https://blogs.msdn.microsoft.com/lucascan/2007/08/15/using-microsoft-network-monitor-netmon-to-capture-a-network-trace/
Psping: https://learn.microsoft.com/en-us/sysinternals/downloads/psping
http://www.azurespeed.com/Azure/PsPing
If there is a firewall between your machine and the azure cloud you need to have opened the port 4040 for your machine.
I am using Azure Virtual Machine (Windows Server 2008 R2 image) provided from the gallery and created Public port and private port using the portal. I did remote log in to VM and I run a TCP server application inside VM (TCP server binds to the private port of the VM). Problem I face is that I can not connect it through the public IP and port (from external machine). I have created a inbound rule in VM's Firewall, where I enable connection to the Private port of VM. I tried recreating the VM, also the new ports. Still problem persists. One more thing I observed is that my TCP Client is able to connect to RemoteDesktop port of the VM also the PowerShell port. But does not connect to the port that I created through the portal. Pls suggest what can be wrong?
Note: I also observed some weird behavior. I enabled all ports for my TCP Server app in Inbound rule of firewall and found that some unknown IP (was similar to azure internal IP) is connecting to my server. Why it is happening?
I would like to understand as to how you are trying to connect with the Virtual Machine, using RDP or trying to test the connectivity, for example, using Port Ping.
Endpoints for RDP and Powershell are configured by default. So if you are trying to connect using Remote Desktop, you can directly connect to the VM using MSTSC from Run and provide the IP of the VM followed by the Port Number using the below format
xx.xx.xx.xx:3389
However if you would like to test the connectivity to the VM, I suggest you to use Port Ping instead of ICMP ping since ICMP traffic is blocked by the Azure load balancer and the ping requests timeout. While Ping.exe uses ICMP, other tools such as PsPing, Nmap, or Telnet allow you to test connectivity to a specific TCP port.
On the other hand, after creating the VM, you can add endpoints additionally as needed. You can also manage incoming traffic to the public port by configuring rules for the Network Access Control List (ACL) of the endpoint.
The private port is used internally by the virtual machine to listen for traffic on that endpoint.
The public port is used by the Azure load balancer to communicate with the virtual machine from
external resources. After you create an endpoint, you can use the network access control list
(ACL) to define rules that help isolate and control the incoming traffic on the public port. For
more information, see About Network Access Control Lists.