I'd like to setup the below infrastructure in Azure. I have one possible solution, but it seems like it makes compromises in security architecture. Is there a better way to do this in Azure than in my compromised workaround?:
VM #1: Role: SQL Server and IIS. Server should have a unique public IP address. The hosted websites will be available through public port 80, and connect to local SQL Server.
VM #2: Role: IIS. Server should have a unique public IP address. The hosted websites will be available through public port 80, and will connect to SQL Server on VM #1.
This has been my experience so far:
No issues setting up VM #1.
With VM #2, I tried building it in the same cloud service as VM #1. When I did that, it was assigned the same public IP address as VM #1. Thus, in this scenario, hosting websites on port 80 on both machines doesn't work.
Next I tried building VM #2 in a different cloud service. This resulted in assignment of a unique public IP address. However, I was unable to obtain connectivity to SQL Server on VM #1.
Things I tried for the above: VM #1 SQL Server set as mixed mode, named SQL account provisioned (and connectivity confirmed locally), SQL configured to allow incoming remote TCP connections, firewall rule opened for incoming connections on TCP port that SQL runs under, but so far have not been able to connect to it from VM #2.
One architecture I believe would work is to open a public port on VM #1 and map that to the private SQL Server port. Then VM #2 could connect using the fully-qualifed public DNS name of VM #1. I believe Azure also would allow connectivity to be constrained to the public IP address of VM #2.
However, this seems less than ideal, because now SQL communication is being routed through a more public route than one would normally design for a data center, and an extra public port has to be opened on VM #1 (even if constrained by IP address, I'd rather not expose that surface area if not necessary). Additionally, sending the SQL Server data over a more public network hypothetically means transport security may need to be considered.
Research indicates connectivity between 2 VMs on different cloud services may not be possible using private ports, although the info I've found so far is not conclusive. So again, is there a better way to do this in Azure?
A single cloud service is a security boundary and the only way into it is through a public (input) endpoint on the unique public VIP of the service. A Virtual Network (VNET) can be used to host multiple cloud services and allow private visibility among them without going through a public endpoint.
A typical model would be to put an IIS website in a PaaS cloud service with a public VIP and the backend SQL Server in an IaaS cloud service with a public VIP but NO public endpoints declared on it. Both these cloud services would be hosted in the same VNET. This allows the front end web role instances access to the backend SQL Server instance over the private VNET. There is a hands-on lab in the Windows Azure Training Kit that describes precisely how to implement this.
In this case I would recommend separating the IIS/SQL Server combination so that the SQL Server box is in an IaaS cloud service with no public endpoint (although it will always have a public VIP). I would also recommend using either a Point-to-Site or Site-to-Site VPN which would allow you to access the VMs without exposing a public RDP endpoint. A point-to-site VPN is developer focused and very easy to configure. A site-to-site VPN is more of an IT thing since it requires configuration of a VPN router such as Cisco, Juniper or Windows Server.
Related
can anyone explain difference between Azure Application Gateway, Virtual Network Gateway, Virtual WAN, ExpressRoute, Arc and Private Link, please?
It seems to me all services are pretty similar helping with connecting either on-prem to Azure, in-Azure to in-Azure or public to Azure.
They're similar in that they all involve network traffic, but that's pretty much where the similarities end.
Application Gateway is a Layer 7 load balancing service with advanced features like SSL termination. It's used to route client requests to your applications.
Virtual Network Gateway is a VPN gateway for point-to-site (user) and site-to-site (office/datacenter) VPN connections to your own Azure VNETs. This would, for example, allow you to RDP into Azure VMs from your on-prem office using their private IPs.
ExpressRoute is similar to site-to-site, however it doesn't use IpSec tunnels, it's a dedicated, unencrypted connection from your location directly into Microsoft's backbone. (i.e. you don't traverse the public internet). There's no encryption and the connection is faster. This is a service you need to work with a 3rd party internet provider to implement.
Virtual WAN is more like a networking hub where there would be many site-to-site, point-to-site, ExpressRoute, etc... connections spanning a wide area (as the name implies). This would be for large enterpise organizations with many on-prem locations.
Arc is a means of adding your on-prem resources into Azure for management. e.g. you have a physical server somewhere and you want to manage it though ARM/portal.
Azure Private Link is a feature of many Azure services (storage, SQL PaaS, etc..) which allows you to create a private DNS record and assign a private IP address on your internal VNETs. This is used when you want to disable all public network access to a resource and only allow access from within your own VNET.
I have barely scratched the surface of the differences here, but suffice it to say, there are many differences. From this page, you can type the service name into the search and get more specific details on the offering. Hope this helps.
https://learn.microsoft.com/en-us/search/?terms=networking%20in%20azure
I am trying to access resources that are secured behind private endpoint from a remote location using an Azure VPN Point-to-Site connection.
So far I have setup a conditional forwarder to send DNS requests to Azure's internal DNS IP address (168.63.129.16). With my setup I can resolve all my private endpoints using nslookup to their private IP addresses. I can also connect to services such as SQL server from my local machine (using SQL Server Management Studio in the case of SQL server).
The problem I am facing is that I can only access resources if I use a desktop client for a given service. If I try to do anything using the Azure Portal, I get an error stating that I cannot access resources using my Public IP address without adding it as an inbound IP address. Whilst this is certainly an option, I don't want to go down this road.
I am hoping there is an option where I can connect to private endpoint resources from Azure Portal whilst connected to my point-to-site VPN. Any ideas?
So far I have setup a conditional forwarder to send DNS requests toAzure's internal DNS IP address (168.63.129.16). With my setup I can resolve all my private endpoints using nslookup to their private IP addresses. I can also connect to services such as SQL server from my local machine (using SQL Server Management Studio in the case of SQL server.
AfAIK, the process which you are doing is correct, To fix this issue try to update the local host file on client desktop to deploy a recourse with private endpoint please refer this link for more in detail
By default when you create a Private Endpoint in the Azure Portal it will automatically lock out public access. Service Endpoints operate by adding routes to allow traffic out of the virtual network to reach the public endpoint of the service selected. If you are access resources error, update firewall rules to communicate with your Azure resources you really need to configure v-net traffic on the firewall settings
Next option is conditional forwarder, in your scenario the ble from every v-net, its public ip it won't overlap with any private ips, it available from inside of azure v-net unique to each
In conditional for forwarder, client asks the ip of a host like www.seraltos.com .The dns server looks to see the answer if knows, if not a lookup will done based on root servers or forwarder to find the ip address returns that to the client
For more information in detail, please refer below links:
Private Endpoints and DNS in Azure & Cannot access my own public IP
https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints
https://learn.microsoft.com/en-us/azure/private-link/manage-private-endpoint?tabs=manage-private-link-powershell
We have three App Services in Azure (API1, API2, API3).
API2 is getting data from CosmosDB.
API3 is getting data from other CosmosDB.
Main API1 calls API2 to get some data. Then using this data calls API3.
We have poor performance of API1 and we are trying to figure out why. We noticed that there are too many connections in metrics. Also we have issue with SNAT ports.
We tried to setup these APIs to the same VNet but it doesn't help and we are not sure how to set up it correctly.
Do you have any idea what we should setup?
UPDATE:
Seems like VNet helped us with SNAT ports issue but performance of API was still very poor.
What really helped us was change from Windows to Linux. When all APIs runs on the Linux servers we don't see any connections anymore.
Not sure what's specific configurations about three APIs on your side. If you want to use IP from Vnet instead of an external one, you can use a separate environment ASE.
Alternatively, you can use a private link to the app service. By using Private Endpoint, you can connect privately to your web app. Read Connect privately to a web app by using Azure Private Endpoint (Preview).
Today, you can secure this connection using VNet service endpoints
which keep the traffic within the Microsoft backbone network and allow
the PaaS resource to be locked down to just your VNet. However, the
PaaS endpoint is still served over a public IP address and therefore
not reachable from on-premises through Azure ExpressRoute private
peering or VPN gateway. With today’s announcement of Azure Private
Link, you can simply create a private endpoint in your VNet and map it
to your PaaS resource (Your Azure Storage account blob or SQL Database
server). These resources are then accessible over a private IP address
in your VNet, enabling connectivity from on-premises through Azure
ExpressRoute private peering and/or VPN gateway and keep the network
configuration simple by not opening it up to public IP addresses.
For more information, you could read here.
While configuring an Azure managed Postgres service, I am trying to configure connecting from local machines through VPN.
I can connect to the DB when white-listing IPs in Connection Security.
I have added the subnet the VPN-gateway is connected to to the VNET Rules – this doesn't seem to make a difference.
I can connect to VMs through the VPN from my local machine.
However to make that work, I added the VMs' (private IP, Azure URL)-pairs to my local machines hosts-file.
I can't find any IP for the DB-service (which seems to make sense for a managed service), so I can't make the same trick.
The error I'm getting, when trying to connect to the DB, is similar to the ones I got before adding hosts mappings.
This all leads me to believe I need some way of having Azure resolve the URL (which might also preempt the need for hosts-mappings in general).
From this article, I tried setting my DNS for 168.63.129.16, but that doesn't work at all (nothing at all is resolved).
Is there a way (and if so, how) to connect from a local machine to an Azure Database for Postgresql service through a VPN gateway?
I don't think there is a way to do this as your desired. You want to map an Azure database logical server private IP to your local hosts file, then access it via VPN gateway.
You only know the public IP for the Azure database server. The public IP addresses of Azure services change periodically. You could find an IP address list by filtering your region. It does not recommend to use such a dynamic IP address. Refer to this blog.
Since Azure database is a fully managed Platform as a Service (PaaS) Database Engine not IaaS like Azure virtual machines, It's public and does not expose the database server private IP address. We only could access the database via Azure database server name over the Internet.
Furthermore, if you want to restrict its access only from a private network with virtual Network service endpoints. However, this works to allow resources like Azure VM in the authorized subnet to access directly your Azure database in a private network, could not guarantee that if you could access the Azure database from your local machine via VPN. This seems no on-premise route to your Azure database.
I would like to host a firebird database in an Azure virtual machine.
Normally, I would indicate in a program a connection like this:
hostname:databasename
....to connect to remote host. In azure, you cannot do that.
I would need to connect with something like:
?.cloudapp.net:someport:databasename
The client would be talking to ?.cloudapp.net thinking that someport is the port to communicate with the database server.
So it seems I would need a proxy to login-connect to windows azure cloud resources and the client would then use the proxy to talk with the database server. This looks like a hassle - are there any alternatives?
I'm not entirely sure of your Cloud architecture in Azure, but assuming you have one VM with your DB installed you should be able to open up a a public endpoint (via the portal manage.windowsazure.com for your Cloud Service) and connect to that via it's public IP address & the port).
Windows Azure does have more advanced features that allows you to connect to specific VM's within a Cloud Service via Port Forwarding.
Michael Washam has a great blog post on this 'Windows Azure Virtual Machines':
http://michaelwasham.com/2012/06/08/understanding-windows-azure-virtual-machines/
The architecture of cloud services makes endpoint configuration
interesting. Since each cloud service has a single public IP address
but multiple virtual machines can reside in it how do you address
individual servers directly in a non-load balanced fashion?
Port forwarding allows you to configure an endpoint on a specific VM
listening on any of the ephemeral ports that will then be forwarded to
the correct internal port.