I would like to restrict access to some Web Apps I am developing on Azure through a whitelist of allowed in-bound IP addresses. I have achieved this using Network Security Group, applied to a VM. I can also see how I can achieve this using a App Service Environment, but this is very costly. Is there any way of applying a Network Security Group to a Web App? Or can I add a Network Security Group to a Virtual Network? Or is there another method that I'm overlooking?
Thanks!
You can restrict IP addresses in the web.config using the ipSecurity element like so:
<system.webServer>
<security>
<ipSecurity allowUnlisted="false">
<add ipAddress="XXX.XXX.XXX.XXX" allowed="true" />
</ipSecurity>
</security>
</system.webServer>
Full documentation on the ipSecurity element: https://www.iis.net/configreference/system.webserver/security/ipsecurity
Azure Web App support for the feature:
https://azure.microsoft.com/en-us/blog/ip-and-domain-restrictions-for-windows-azure-web-sites/
Related
I have deployed a node js web app on azure and I want to restrict access to it by ip address. I have done a similar thing easily before in AWS with security groups. However, I am at present on the free dev platform and when I got to the ip restrictions setting tab in the Azure portal gui it says I need to upscale the app because ip restriction is not available on the current platform. What I'm build needs very minimal resources. It is a one page internal static newsletter. What is the minimal resource on azure I need to use to get the ip restriction or is there another route I can use?
The minimal resource you need to configure IP restrictions within the Portal is B1:
Read here how to configure it:
Azure App Service Static IP Restrictions
Note: You can also enable IP Restrictions on the free tier by adding a web.config using the IP Security setting. Working sample:
<configuration>
<system.webServer>
<security>
<ipSecurity allowUnlisted="false">
<clear/>
<add ipAddress="83.116.19.53" allowed="true"/>
</ipSecurity>
</security>
</system.webServer>
</configuration>
Now all you have to do is to put the web.config to your wwwroot directory. You can either include the web.config in your deployment or you manually add it using the Kudu engine.
Just replace <YOURSITE> with your actual site and follow the link:
https://<YOURSITE>.scm.azurewebsites.net/DebugConsole/?shell=powershell
If you now browse the app using an unlisted IP you will get the following error:
You do not have permission to view this directory or page.
I wanted to restrict access from internet to my app service environment, such that only my front end app service can only access it. Is there a possible way to do it?.
As shown in the above picture I wanted to associate an NSG to tier 2 such that only tier 1 can access tier 2. Nobody else can access it. Is there a solution to this problem?
Developers can use IP and Domain Restrictions to control the set of IP addresses, and address ranges, that are either allowed or denied access to their websites. With Windows Azure Web Sites developers can enable/disable the feature, as well as customize its behavior, using web.config files located in their website
<system.webServer>
<security>
<ipSecurity>
<add ipAddress="x.x.x.x" allowed="false" />
</ipSecurity>
</security>
</system.webServer>
https://azure.microsoft.com/en-us/blog/confirming-dynamic-ip-address-restrictions-in-windows-azure-web-sites/
If a request is made to a website from an address outside of the allowed IP address range, then an HTTP 404 not found error is returned as defined in the denyAction attribute.
https://learn.microsoft.com/en-us/azure/app-service/environment/network-info
https://learn.microsoft.com/en-us/azure/app-service/environment/forced-tunnel-support
I would like to use some of the benefits of hosting a web api in Azure, but I want that api to be private (not accessible from the outsite world) as it only be used internally.
I am not sure if that is even possible. I've tried deploying from visual studio but the api is hosted on xyz.azurewebsites.net and is accessible from everywhere.
Thanks in advance.
You could restrict access to the site to a specific ip address or range of addresses through the web.config. Add a section to system.webServer:
<system.webServer>
<security>
<ipSecurity allowUnlisted="false" denyAction="NotFound">
<add allowed="true" ipAddress="123.456.0.0" subnetMask="255.255.0.0"/>
</ipSecurity>
</security>
</system.webServer>
More info here: IP and Domain Restrictions for Windows Azure Web Sites
In addition to levelnis's suggestion about static ip security restricting access, there is the option of using an App Service Environment.
https://learn.microsoft.com/en-us/azure/app-service-web/app-service-app-service-environment-intro
App Service Environments are ideal for application workloads
requiring:
Very high scale
Isolation and secure network access
An ASE is always placed in a virtual network's subnet, so you can use NSGs to control access. ASEs are a Premium service though so can be quite expensive.
I am building a RESTful node js API server using express which shall communicate only with a specific set of other servers that have dynamic IP addresses. What is the best way to deny access to requests originating from any other domains/servers?
You can list a IPs of your services, and config IP Security in the web.config in your application.
E.G.
<system.webServer>
<security>
<ipSecurity allowUnlisted="true"> <!-- this line blocks everybody, except those listed below -->
<clear/> <!-- removes all upstream restrictions -->
<add ipAddress="83.116.19.53"/> <!-- block one IP -->
<add ipAddress="83.116.119.0" subnetMask="255.255.255.0"/> <!--block network 83.116.119.0 to 83.116.119.255-->
</ipSecurity>
</security>
</system.webServer>
Otherwise, you can refer to App Service Environment.
Please refer to https://azure.microsoft.com/en-us/documentation/articles/app-service-security-readme/ for more about Azure App Service Security.
I have a WCF service running on a azure app service. I want to restrict this WCF to a few azure website, external IPs and some other deployments.
I am using IPSecurity tag for that in my WCF web.config
My issue is the IP restrictions work, but the azure website domains that i allow access to, dont seem to work.
for exmaple, i have an azure website with a custom domain, abcdef.info. i am trying to give this domain access to wcf, but it doesnt seem to be working.
below is my configuration.
<ipSecurity enableReverseDns="true" allowUnlisted="false">
<add ipAddress="127.0.0.1" allowed="true" />
<add ipAddress="xx.xx.xx.xx" allowed="true" /> (IP of azure website i got after nslookup)
<add domainName="azurewebsitedomain.azurewebsites.net" allowed="true" />
<add domainName="abcdef.info" allowed="true" /> (custom domain tied to my azure website)
</ipSecurity>
i was assuming that one of the last 3 settings here will whitelist my wcf client running to azure website to access WCF but so far nothing.
Will appreciate any help. Thanks.
Azure Web App infrastructure uses different IP's for inbound and outbound communications. You have whitelisted the inbound IP address. Also, Whitelisting the domain name may not work either.
Azure Web Apps use a set of 4 outbound IP's for Outbound communication. This can be retrieved from portal:
Select the web app
Click on Properties
Copy the OUTBOUND IP ADDRESSES
Whitelist these 4 IP Addresses the way you did earlier and then you could test by issuing a CURL request from the KUDU console (SCM) of the source app.
curl -i https://destinationsitename.azurewebsites.net