Reply to: Any Azure Guru's among the forums?

[eek]

Vodafone!

Yep - good luck there. But how often does the ip address actually change...

[SimonMac]

Who doesn't?

Vodafone!

[eek]

They don't provide static IP's

Who doesn't?

[SimonMac]

Try and send Lance a PM - he's a cloud god

Or, pay for a static IP from your provider. I'm with PlusNet and they charged me a one-off fee of a fiver to have a fixed IP for the length of the contract. Best internet provider out there IMO.

Edit: Hadn't seen, he had already replied! Teach me to read the whole thread before commenting!

They don't provide static IP's

[Lance]

Try and send Lance a PM - he's a cloud god

Or, pay for a static IP from your provider. I'm with PlusNet and they charged me a one-off fee of a fiver to have a fixed IP for the length of the contract. Best internet provider out there IMO.

Edit: Hadn't seen, he had already replied! Teach me to read the whole thread before commenting!

Blasphemy.... There's only one cloud god.

[mattfx]

VPN into the network. It's never a good idea having a windows server with port 3389 open to the public either.

Gareth

I always change my RDS services to run over a different port - usually something like 4489 so I can remember!

[mattfx]

Try and send Lance a PM - he's a cloud god

Or, pay for a static IP from your provider. I'm with PlusNet and they charged me a one-off fee of a fiver to have a fixed IP for the length of the contract. Best internet provider out there IMO.

Edit: Hadn't seen, he had already replied! Teach me to read the whole thread before commenting!

[garethevans1986]

VPN into the network. It's never a good idea having a windows server with port 3389 open to the public either.

Gareth

[Lance]

Azure network security groups won't allow use of DNS names.
So your choices are:
1) A firewall appliance that does allow DNS names. I'm not sure if any on the marketplace do that and they're costly as they usually need a D2 VM as a minimum to run.
2) VPN
3) Is strong authentication not suitable? Maybe set it to lockout for an hour after 5 failed attempts
4) A Linux VM running as a firewall as you can get quite funky with that and won't need a D2 VM.

[ctm]

You could do it with the firewalls available on the marketplace. But not sure there is quite the business case for the cost.

The cisco ASA-v would do this for example.

[SimonMac]

Well if you'd said that in the first place.....

I was trying to set it at the Azure level, not the VM level

[DaveB]

That would be perfect, if I was using IIS, even if I was using Apache it would be possible using .htaccesss, but it's a Splunk instance which uses something called CherryPy for it's webserver

Well if you'd said that in the first place.....

[SimonMac]

How about this?

https://blogs.endjin.com/2014/09/res...-whitelisting/

That would be perfect, if I was using IIS, even if I was using Apache it would be possible using .htaccesss, but it's a Splunk instance which uses something called CherryPy for it's webserver

[DaveB]

I use noip.com to give me the DNS name, and any IP changes get picked up automatically (I am using this to VPN into my network) I just wanted to be able to set the inbound rule on Azure to the DNS name rather than an IP address.



I think this will have to be the solution I use

How about this?

https://blogs.endjin.com/2014/09/res...-whitelisting/

[SimonMac]

You can use a dynamic DNS service. Lots of free ones around if you google, or paid ones that support multiple addresses / domains etc.

They assign you a DNS name entry against the initial IP you give them and run a client on the machine you need access for that automatically detects IP changes and update the DNS in real time.

I use noip.com to give me the DNS name, and any IP changes get picked up automatically (I am using this to VPN into my network) I just wanted to be able to set the inbound rule on Azure to the DNS name rather than an IP address.

We have some sub contractors in a similiar boat connecting to multiple differernt azure subscriptions. (Infact when we had it opened, there was a large number of brute force connections against servers with public IPs)

The way we got around it was to setup a Point to Site VPN and they connect in to where they are required. We then lock down the environments to only local IPs.

I think this will have to be the solution I use