46,181 questions
Azure DevOps Pipeline SSH Access Issue - Need Firewall Configuration Assistance
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(48, 14.000000000000002%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIJ%3C/text%3E%3C/svg%3E)
Izhan Jamal
5
Reputation points
Hello,
I am currently facing an issue with my Azure DevOps pipeline. My pipeline needs to SSH into a Linux machine for deployment purposes. When I allow inbound traffic on port 22 from all networks, the pipeline works correctly. However, for security reasons, I do not want to allow SSH access from all IP addresses.
I have attempted to use Azure DevOps service tags in the firewall settings to restrict access, but I am still unable to establish an SSH connection from the pipeline to my Linux machine.
Could you please provide guidance on the correct firewall settings to allow my Azure DevOps pipeline to SSH into my machine securely? Specifically, I need to know how to configure the firewall to allow only the necessary Azure DevOps IP ranges or service tags.
Thank you for your assistance.
Community Center Not monitored
{count} votes
-
KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator2024-08-02T10:23:50.7933333+00:00 Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.Azure DevOps related queries/issues are currently not supported on this Microsoft Q&A platform.
I would request you to please post your queries in dedicated forums as in below links:
https://developercommunity.visualstudio.com/spaces/21/index.html
https://developercommunity.visualstudio.com/t/get-unique-id-from-devops-organization/756710
https://stackoverflow.com/questions/tagged/azure-devops
With that said, I see you are using Azure Firewall with **AzureDevOps **service tag.
- Can you confirm if you are using Azure Firewall DNAT rules?
From the doc, what I see is
The Service Tag or previously mentioned inbound IP addresses don't apply to Microsoft Hosted agents. Customers are still required to allow the entire geography for the Microsoft Hosted agents. If allowing the entire geography is a concern, we recommend using the Azure Virtual Machine Scale Set agents.
- Can you confirm if you are not using Microsoft Hosted agents?
- If you're not using Microsoft Hosted agent, may I ask what is the IP you see in the Firewall Logs when you set allow all
- You can use Azure Firewall Diagnostic logs to identify this.
Cheers,
Kapil
-
Izhan Jamal 5 Reputation points
2024-08-02T13:58:12.1266667+00:00 I am not using Azure Firewall DNAT rules. I am simply allowing inbound traffic from azure devops tags in my NSG.
-
KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator
2024-08-02T14:04:52.33+00:00 Are you using Microsoft Hosted agents?
From the docs, I see the Service tag mentioned inbound IP addresses don't apply to Microsoft Hosted agents.
-
Izhan Jamal 5 Reputation points
2024-08-05T07:37:04.7166667+00:00 I am using azure VMs and azure pipelines to deploy my build on server via SSH.
Sign in to comment
Sign in to answer