2

I have a web role that I have configured via the NetworkConfiguration section of the .cscfg to be part of a Virtual Network. I only want the web role to be accessed from other computers within the Virtual Network, not from the public internet.

Initially I had created an input endpoint for port 80, and this allows me to access the web role from a computer on the virtual network, and from the public internet.

I then changed this to an internal endpoint for port 80, but this blocked all access from both the public internet and computers on the virtual network.

How can I block public internet access, but allow access via the virtual network?

BG100
  • 169
  • 1
  • 14
  • I'm also looking for something like this. Here is a similar article but it's for VM's in cloud services, not webroles. http://stackoverflow.com/questions/22512077/hiding-cloud-services-for-vpn-access-only – TWilly Jun 19 '14 at 21:45

2 Answers2

1

You may be able to do so, by editing the ACL on the endpoint tab of your Web Role settings page. To do so: - Select the endpoint you would like to restrict access to and then click on Manage ACL

Defining ACL for the selected endpoint:

enter image description here

Then you may be able to deny access to others networks like done above Note: the subnet 0.0.0.0/0 represent the Internet, be sure to put all permit rules on top as done above

Restricting access to others network:

enter image description here

Pierre.Vriens
  • 1,159
  • 34
  • 15
  • 19
Emmanuel TOPE
  • 101
  • 1
  • 6
0

The answer above is the easiest way to update the Access Control List for Azure Virtual Machines; however, at time of writing it is not possible to directly edit the ACL for an Azure Web / Worker role. It is necessary to update the role's ServiceConfiguration.Cloud.cscfg: http://blogs.msdn.com/b/walterm/archive/2014/04/22/windows-azure-paas-acls-are-here.aspx.

Once the cloud configuration file has been updated either redeploy both this file and the packaged role. If the role has already been deployed you can also just upload the configuration file through the Azure portal, or PowerShell: http://www.devopsfu.com/2014/08/11/azure-cs-endpoint-acls/.

Benjamin
  • 1
  • 1