Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm in the process of trying to setup a couple Win2008 Server Virtual Machines on Windows Azure (using the VM Preview feature) and I'm not sure how to get my desired "architecture" setup properly. Here's what I'm trying to achieve -

I want one server that will act only as my database server running MongoDB (I know they say Linux is better, but I'm restricted to Windows for various reasons at this point in time).

I want a second server that will act as my webserver. This web application will be ran off node.js.

The database server should only accept connections from the web server and only after a handshake has been made, and was successful.

I can solve the handshake problem by having a second node.js server running on the database server that basically acts as a Rest API for my database while verifying handshakes and what not. The thing I'm having a problem figuring out is how to make the database server accept connections from only my web server?

If we assume I do build the second node.js app for the DB server, is this network configuration even required considering I could build the node app to only accept connections from a certain IP address? Or would it still make sense to maintain this rule somewhere else?

I know absolutely nothing about networking so this is all a little over my head right now. I would appreciate any help, guidance, links, etc anyone has to share :)

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

If you place both Virtual Machines in the same cloud service, the virtual machines can talk with each other over any open ports on the VMs. So, assuming your MongoDB server is running on 27017, and the MongoDB Virtual Machine allows tcp traffic on 27017, your Web VM can talk with MongoDB.

Now, on to the endpoints: Just create endpoints for port 80 and 443, and only on the Web Virtual Machine. No need to create load-balanced endpoints, as you never want traffic from the outside world reaching your MongoDB VM. At this point, the only externally-reachable ports will be the ones defined in your endpoints (in this case, 80 and 443). And, as long as they're not load-balanced endpoints, traffic is directed only to a single VM.

For a much more in-depth look at how Virtual Machines can be set up, read Michael Washam's blog post, here, in the Virtual Machine Networking section.

share|improve this answer
    
This was very helpful. Thank you! –  Jason L. Aug 8 '12 at 17:22
    
Hi David - This was able to get me up and running. However I can't seem to get communication flowing from my Web VM to my Mongo VM. Do I use the "Internal IP Address" as listed by the Azure Management Portal? –  Jason L. Aug 9 '12 at 0:45
    
You need to make sure your MongoDB VM has the correct port (default 27017) open on the firewall. By default, Windows Server has all ports locked down. If you go into the firewall settings, you can add an inbound rule for tcp traffic on the desired port. –  David Makogon Aug 20 '12 at 13:31
add comment

Seems to me that the easiest way to accomplish this would be to use Windows firewall and make sure it has the default block all inbound connections that don't match a rule setting enabled... and then create a rule to allow the traffic you need from the IP of your database server. Make sure it's the only rule in there, and you're good to go. Or, have accomplished what you set out to do. You might find that a bit too restrictive for full functionality, and it might not be a horrible idea to allow remote management or monitoring from certain other machines too, but that's a separate question.

In fact, there's a nifty little Q&A on this topic (for Win7) over on SuperUser, which isn't horrible and has screenshots. The interface is the same in Win7 and Server 2008, so it might be worth a visit just for the screenshot. Or the how to do it with IPSec answer, even.

share|improve this answer
    
No need to block inbound connections, as there can't be any connections unless an endpoint is defined for the Virtual Machine. This is easily configurable via the portal or via PowerShell scripts. They can be done with Mac/Linux scripts as well, but the OP mentioned the need to work within a Windows environment. –  David Makogon Aug 7 '12 at 4:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.