Unsure of how to setup two Virtual Machines on Windows Azure to match my desired architecture

Question

I'm in the process of trying to setup a couple Win2008 Server Virtual Machines on Windows Azure (using the VM Preview feature) and I'm not sure how to get my desired "architecture" setup properly. Here's what I'm trying to achieve -

I want one server that will act only as my database server running MongoDB (I know they say Linux is better, but I'm restricted to Windows for various reasons at this point in time).

I want a second server that will act as my webserver. This web application will be ran off node.js.

The database server should only accept connections from the web server and only after a handshake has been made, and was successful.

I can solve the handshake problem by having a second node.js server running on the database server that basically acts as a Rest API for my database while verifying handshakes and what not. The thing I'm having a problem figuring out is how to make the database server accept connections from only my web server?

If we assume I do build the second node.js app for the DB server, is this network configuration even required considering I could build the node app to only accept connections from a certain IP address? Or would it still make sense to maintain this rule somewhere else?

I know absolutely nothing about networking so this is all a little over my head right now. I would appreciate any help, guidance, links, etc anyone has to share :)

Answer 1

If you place both Virtual Machines in the same cloud service, the virtual machines can talk with each other over any open ports on the VMs. So, assuming your MongoDB server is running on 27017, and the MongoDB Virtual Machine allows tcp traffic on 27017, your Web VM can talk with MongoDB.

Now, on to the endpoints: Just create endpoints for port 80 and 443, and only on the Web Virtual Machine. No need to create load-balanced endpoints, as you never want traffic from the outside world reaching your MongoDB VM. At this point, the only externally-reachable ports will be the ones defined in your endpoints (in this case, 80 and 443). And, as long as they're not load-balanced endpoints, traffic is directed only to a single VM.

For a much more in-depth look at how Virtual Machines can be set up, read Michael Washam's blog post, here, in the Virtual Machine Networking section.

Answer 2

Seems to me that the easiest way to accomplish this would be to use Windows firewall and make sure it has the default block all inbound connections that don't match a rule setting enabled... and then create a rule to allow the traffic you need from the IP of your database server. Make sure it's the only rule in there, and you're good to go. Or, have accomplished what you set out to do. You might find that a bit too restrictive for full functionality, and it might not be a horrible idea to allow remote management or monitoring from certain other machines too, but that's a separate question.

In fact, there's a nifty little Q&A on this topic (for Win7) over on SuperUser, which isn't horrible and has screenshots. The interface is the same in Win7 and Server 2008, so it might be worth a visit just for the screenshot. Or the how to do it with IPSec answer, even.