0

These are the relevant Terraform bits which I used to create a Windows instance.

locals {
  vpc_id            = "vpc-..."
  availability_zone = "eu-central-1a"

  windows_ami = "ami-018c2bcdc530c0630" # Microsoft Windows Server 2019 Base

  admin_username = "..."
  admin_password = "..."
}

resource "aws_subnet" "subnet" {
  vpc_id            = "${local.vpc_id}"
  cidr_block        = "10.102.128.16/28" # 10.102.128.17-10.102.128.30
  availability_zone = "${local.availability_zone}"
}

resource "aws_security_group" "sg" {
  name   = "my-use-case"
  vpc_id = "${local.vpc_id}"

  ingress {
    description = "Public access"
    protocol    = "-1"
    from_port   = 0
    to_port     = 0

    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  ingress {
    description = "Ping always possible"
    protocol    = "icmp"
    from_port   = -1
    to_port     = -1
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    protocol    = "-1"
    from_port   = 0
    to_port     = 0
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "host" {
  ami           = "${local.windows_ami}"
  instance_type = "t3.large"

  availability_zone = "${local.availability_zone}"
  subnet_id         = "${aws_subnet.subnet.id}"

  private_ip = "10.102.128.20"

  associate_public_ip_address = true # not needed, but connection only works through public one

  vpc_security_group_ids = ["${aws_security_group.sg.id}"]

  user_data = <<EOF
<powershell>
netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow
netsh advfirewall firewall add rule name="WinRM in" protocol=TCP dir=in profile=any localport=5985 remoteip=any localip=any action=allow
netsh advfirewall firewall add rule name="RDP TCP in" protocol=TCP dir=in profile=any localport=3389 remoteip=any localip=any action=allow
netsh advfirewall firewall add rule name="RDP UDP in" protocol=UDP dir=in profile=any localport=3389 remoteip=any localip=any action=allow

net user ${local.admin_username} "${local.admin_password}" /add /y
net localgroup administrators ${local.admin_username} /add
</powershell>
EOF
}

My company's VPN routes to 10.102.0.0/16 (works for FreeBSD/Linux hosts). If I however try to connect/ping to this Windows machine on port 3389, using the private IP (here: 10.102.128.20), no connection happens. Via the assigned public IP, I can connect and ping without issues, and get a remote desktop. The Windows network settings clearly show the services are listening on the private IP (in fact only one NIC is displayed). I definitely don't want to assign a public IP to an instance which is only used for private purposes.

Connections from the Windows instance to other instances in the VPC work fine.

Anything I'm missing?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.