I operate a web server on a VM in Azure. Over the past few months, the VM has been getting hit with a very large number of spam requests that consume resources (which add to the VM bill) and slow down its ability to process real requests. After configuring IIS rewrite rules to drop the majority of the bad traffic, the overall resource usage has dropped significantly, but the server still must process each request before it can know to ignore it.

I'm looking for a way that Azure could be configured to block incoming traffic (by user agent or rate, at a minimum) so that I don't have to rig a custom solution that costs me. Does such a mechanism exist? I was guessing that it might be a feature on a load balancer resource or similar, but was unable to find anything that seemed appropriate.

  • Just curious how extra inbound traffic adds to your VM bill, since Azure VM's are billed by the minute, regardless of cpu % used. – David Makogon Jul 4 '16 at 5:38
  • @DavidMakogon Hmmmm... I was under the impression that it was based on CPU time instead of just uptime. Good to know! I haven't used VMs on Azure very much (mostly web services and SQL servers) and my usage is still very minimal, so I haven't actually checked. I think the main billing implications that I was seeing were due to the network traffic of my VM serving the requested pages, which I believe is billed separately. – Wasabi Fan Jul 4 '16 at 6:08
  • @DavidMakogon are you sure that the billing is uptime-based and not dependent on CPU time? I can't seem to find any references definitively pointing in either direction. – Wasabi Fan Jul 4 '16 at 6:29
  • 1
    I'm 100% sure, and it's been that way since Azure was launched. The only resource CPU-metered is Azure Web Apps, when you run free/shared tier. VM's are not, and have never been, CPU-metered. As far as network traffic goes (as you mentioned that in your other comment), inbound traffic is free, as well as the first 5GB outbound monthly (note: all traffic within a region is free, regardless of direction). – David Makogon Jul 4 '16 at 6:51

The only built-in IP-filtering mechanism, external to a VM, is the network security group and related inbound rules, where you can specify IP ranges to allow or block. If you're using a Classic VM, this is represented as ACL's on the endpoints.

Anything else will require you to deal with it yourself, whether in the web server VM itself or some other VM fronting your web server(s) (such as your own proxy / load balancer install).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.