i have deployed an ACI that has a small sftp server on it to a virtual network in azure. So this works great when you vpn into the network and access the sftp via something like

i want to publicly expose this now and control access via NAT and a Network Security Group to limit access to a predefined IP. I tried the azure app gateway, but this does not allow SSH according to microsoft.

i then tried a load balancer hoping i could just NAT this but it seems Azure LB's only want to go to Virtual machines or scale sets. Not an arbitrary internal IP address.

is there any way to map a public ip via some kind of NAT tool in azure to achieve what i am looking for? my only other alternatives at this point seem to be creating a VM and putting a SFTP server on that, or exposing the ACI with a public IP (outside the VNET) and using like IPTables in linux to control access - and i dont even know if that is possible w/ this build since it's essentially a docker image.

appreciate any advice! simply want to secure sftp.



You can assign a custom domain to your ACI instance, or use the out of the box "customlabel.azureregion.azurecontainer.io". When you assign a custom domain, it'll provide you with a PIP, or you can use DNS via a CNAME to map to your instance.

For confirmation, see the following Microsoft docs.microsoft.com article under the heading "Public IP connectivity and DNS name".

Moreover, there is a new preview that allows ACI's to be deployed in a VNET: see this article for reference.

  • Thanks for the answer but i am looking to ensure i can use at least an NSG to control access from a specific IP. What you have described is the same as deploying the ACI using a public IP - which i can do. I want to keep it inside my virtual network but this does not seem possible right now. I will likely implement SFTP via a standard VM. – Mike M May 9 '19 at 1:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.