i have deployed an ACI that has a small sftp server on it to a virtual network in azure. So this works great when you vpn into the network and access the sftp via something like 10.0.0.2.
i want to publicly expose this now and control access via NAT and a Network Security Group to limit access to a predefined IP. I tried the azure app gateway, but this does not allow SSH according to microsoft.
i then tried a load balancer hoping i could just NAT this but it seems Azure LB's only want to go to Virtual machines or scale sets. Not an arbitrary internal IP address.
is there any way to map a public ip via some kind of NAT tool in azure to achieve what i am looking for? my only other alternatives at this point seem to be creating a VM and putting a SFTP server on that, or exposing the ACI with a public IP (outside the VNET) and using like IPTables in linux to control access - and i dont even know if that is possible w/ this build since it's essentially a docker image.
appreciate any advice! simply want to secure sftp.