0

I have an Azure standard public load balancer with a few web server VMs behind it. I also need the VMs to have an individual public static IP each (not load balanced) for management stuff, so I've added a public IP to the NIC of each VM. A Network Security Group sits on the VM subnet to control access.

My setup functions, but there are a couple of issues.

To get load balanced traffic to nginx on the VMs I (seemingly) needed to add a NSG rule allowing "Internet" access to the ports nginx is listening on (7080,7443) with destination the Application Security Group the VMs are part of. This however also opens the ports to the internet on the public IP addresses, which I don't really want.

Is the access rule correct?

Is there a way to control access on the public IPs, at least so that you can't connect to nginx except via the ALB?

0

Is the access rule correct?

Yes, it's correct, you need to open these ports nginx is listening on if you want load balanced traffic to nginx on the VMs.

Is there a way to control access on the public IPs, at least so that you can't connect to nginx except via the ALB?

Unfortunately, it's impossible to do control access only for ALB by NSG. Generally you can use NSG to filter the network traffic for a subnet or NIC level by priority using the 5-tuple information (source, source port, destination, destination port, and protocol) to allow or deny the traffic. In this case, whatever you access the backend VMs via ALB or individual public IP addresses. For every inbound rule, you have the same ports, destination, protocol.

Ref: Azure Network Security Groups (NSG) – Best Practices and Lessons Learned

  • If the answer is helpful you could accept it or please let me know if you need more help. – Nancy Xiong Sep 14 '18 at 10:04
  • At present on the subnet NSG (NSG1) I have the rule Source: Internet, Destination: www-asg, Port: 7080,7443 TCP Are you saying to move this rule to a nic NSG? – johngirvin Sep 14 '18 at 11:57
  • Update my rely, I think it's impossible to do that, hope my explanation helps you. – Nancy Xiong Sep 16 '18 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.