1

So I have a VM in Azure. I would like to ensure that only I can access it. I setup port filtering so that only my IP is accepted, and only from port 3389.

The next day my IP changed, but only the last two octets, so I thought... ok I'll just use a CIDR range /16... but today I would need /24 !

Note: This isn't my only issue. My VM is running a VPN (but not on startup). I setup static routing for my IP, so that my RDP connection can make it through (after the VPN is running, if I need to disconnect and reconnect). But of course today my IP changed again, so I'll have to add this everyday??

This is planned to be a server that runs jobs daily. If I can't access the VM because of the VPN, then I have to restart the VM, this is not ideal.

I didn't see any place in Azure to filter by MAC Addresses... and of course MAC Addresses can be spoofed anyway.

Any thoughts or ideas?... Maybe I should look into that SSH thing...

Note: I don't think a static IP address is an option. My internet is provided by the building, I don't have a contract with the ISP.

Please excuse my ignorance, I never formally studied networking.

Improve this question
1
  • You need to edit your question to include more information, At lest a good description or diagram of the network, the network device models, and the network device configurations. You can refer to the Network Engineering Question Checklist for guidance.
    – Ron Maupin ♦
    Dec 7, 2018 at 15:29

3 Answers 3

Reset to default
1

I think it will be hard to negotiate static ip with your ISP.

The good way to solve your problem is to set up new VM responsible for VPN handling only with VPN required ports open.

A VM will be connected to your private network in Azure and to the internet on the other site. When you connect to your VPN you will get full access to your resources and server management. I think it's the best way.

Of course instead of using passwords in the VPN authentication use certificates.

Improve this answer
2

If you can script the access-control list, one method is:

  • Use a dynamic DNS service to get your client IP address in the DNS
  • Script the ACL on your server to look up the IP address and allow it (as /32)
  • Ensure you have a method to override (service provider web control panel, SSH, anything convenient)
Improve this answer
1
  • Possibly use a tunnel provider and build a tunnel from the dynamic site to the provider.
    – Ron Maupin ♦
    Dec 7, 2018 at 17:12
0

The optimised way is , Instead of whitelisting source specific IP address whitelist entire network subnet . So that any allocated IP address through DHCP within that subnet can access VM through RDP access ..

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.