2

We are looking at deploying an application on azure web sites and deploying a redis and solr clusters on sets of azure virtual machines. What is the best practise for restricting access so just my azure web site can access these boxes?

We store private information in the redis and solr cluster so cannot risk allowing other azure websites access to the redis and solr clusters so allowing the complete IP range of the azure data centres is a no go.

David Makogon
  • 69,407
  • 21
  • 141
  • 189
Ollie
  • 1,140
  • 8
  • 26

2 Answers2

2

Azure Web Sites do not have dedicated outbound IP addresses for each deployment. This precludes you from using ACLs or Virtual Networks to connect to your Redis / Solr virtual machines.

While you can filter IP traffic entering a Virtual Machine via ACL, this will only work with Cloud Services (web/worker roles) and Virtual Machines. Likewise, you can add Cloud Services and Virtual Machines to a Virtual Network, allowing you to directly access your Redis/Solr instances.

As @Itamar mentioned in his answer, you can use IP filtering on the Redis/Solr instances themselves, via the OS or within Redis/Solr as supported. You can also use an SSL connection.

David Makogon
  • 69,407
  • 21
  • 141
  • 189
  • Surely moving the IP filtering to the Redis/Solr instances will have no effect. You still have the problem of not being able to predict the outbound MAWS IP address so you would need to allow the entire range though for the data centre you use right? – Paul Hiles Jun 28 '14 at 21:03
  • Correct. Just pointing out the various options for filtering (via ACL, via VNet, via OS-hosted firewall). There's still no option for filtering traffic from a specific Azure Web Sites application due to not having dedicated outbound IP address. – David Makogon Jun 28 '14 at 21:19
0

Don't know about solr, but if you want a secure connection to your Redis you should consider using a secure proxy such stunnel on the website and the Redis servers (see for example http://bencane.com/2014/02/18/sending-redis-traffic-through-an-ssl-tunnel-with-stunnel)... or, just use a Redis service provider that supports SSL (e.g. http://redislabs.com ;)).

Itamar Haber
  • 47,336
  • 7
  • 91
  • 117
  • The communication between services is internal to the data centre, I am looking more towards a IP restriction rather than SSH / SSL tunnels. – Ollie Apr 09 '14 at 10:32
  • We also do IP/Subnet access control if that's what you're after – Itamar Haber Apr 09 '14 at 10:35