Azure Web App access to on-premise file server

Question

Azure Web App access to on-premise file server

Bertrand Pons 36

Hello,

I have an Azure Web app connected to a VNet that includes a Virtual Network Gateway that sets a S2S connection to an on-premise network. The Vnet DNS server is set with an on-premise DNS server.

How is it possible to reach a file server hosted on-premise ? It does not work when I try to get \fileshare\example\photo.jpg from app service. Is it possible ? If yes, how to do so ?

Thank you

Bertrand Pons

Didier3001 1,021 Reputation points Microsoft Employee

2020-08-10T10:01:50.613+00:00

Hi anonymous user

Just to be sure we are on the same page, how did you connect your Web App to your VNet?

Did you check the NSG configuration attached to the VNet?

Regards,
Didier3001
Bertrand Pons 36 Reputation points

2020-08-10T10:08:14.217+00:00

Hi @Didier3001

I connected the web app to the VNet thanks to the VNet integration module in the settings of the app service.

Regards,
Didier3001 1,021 Reputation points Microsoft Employee

2020-08-10T10:31:13.867+00:00

Excellent. Can you confirm all NSG (VPN Gateway subnet + App Service Subnet) have been configured correctly to allow SMB? Does it work with IP address?
Bertrand Pons 36 Reputation points

2020-08-10T11:56:45.953+00:00

As it is all internal, I assume default NSG rules AllowVnetInBound and AllowVnetOutBound are enough.

It does work with IP address yes (although it may require authentication as the app service is not included in my local domain)
Ryan Hill 30,281 Reputation points Microsoft Employee Moderator

2020-08-12T23:13:04.777+00:00

@brigitte ponsin have you tried any of the Troubleshooting steps line nameresolver from the app service console? Have ran of the sync operations?

2 answers

Your answer

Didier3001 1,021 Reputation points Microsoft Employee

2020-08-10T10:01:50.613+00:00

Hi anonymous user

Just to be sure we are on the same page, how did you connect your Web App to your VNet?

Did you check the NSG configuration attached to the VNet?

Regards,
Didier3001
Bertrand Pons 36 Reputation points

2020-08-10T10:08:14.217+00:00

Hi @Didier3001

I connected the web app to the VNet thanks to the VNet integration module in the settings of the app service.

Regards,
Didier3001 1,021 Reputation points Microsoft Employee

2020-08-10T10:31:13.867+00:00

Excellent. Can you confirm all NSG (VPN Gateway subnet + App Service Subnet) have been configured correctly to allow SMB? Does it work with IP address?
Bertrand Pons 36 Reputation points

2020-08-10T11:56:45.953+00:00

As it is all internal, I assume default NSG rules AllowVnetInBound and AllowVnetOutBound are enough.

It does work with IP address yes (although it may require authentication as the app service is not included in my local domain)
Ryan Hill 30,281 Reputation points Microsoft Employee Moderator

2020-08-12T23:13:04.777+00:00

@brigitte ponsin have you tried any of the Troubleshooting steps line nameresolver from the app service console? Have ran of the sync operations?

Answer 1

Ryan Hill 30,281 Microsoft Employee Moderator

anonymous user have a look at https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances. It states

Customer-managed DNS servers (on-premises domain controller, local read-only domain controller, or a DNS secondary synced using zone transfers, for example). See Name resolution using your own DNS server.

You'll have to setup a custom DNS server that will forward the queries to your on-prem DNS.

Bertrand Pons 36 Reputation points

2020-08-21T07:26:26.42+00:00

Hi @Ryan Hill

Thank you for your reply. In my case, the DNS server is set up at vnet level, using custom field to provide the ip address of my on-prem DNS server.

Therefore, if I understand well, my app service which is integrated to the vnet should be able to resolve name against my local DNS server.

What do I miss?
Ryan Hill 30,281 Reputation points Microsoft Employee Moderator

2020-08-24T14:24:58.657+00:00

Did you run the sync operations anonymous user?
Bertrand Pons 36 Reputation points

2020-08-27T12:32:22.973+00:00

I don't have this option in VNet integration window.

To be more accurate, my web app is attached to a VNet that is peered to another VNet which hosts the VPN gateway.
Ryan Hill 30,281 Reputation points Microsoft Employee Moderator

2020-08-27T13:23:10.853+00:00

Any chance you have an on-prem firewall that could be blocking traffic from the VPN Gateway or VNet?
Bertrand Pons 36 Reputation points

2020-09-21T13:09:01.037+00:00

As far as I know, there is not blocking rule, as I can reach file server from within a VM in the same VNet.

Answer 2

According to: https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/internet-firewalls-prevent-browsing-file-sharing
The following protocols and ports are required to access the files:
Microsoft file sharing SMB: User Datagram Protocol (UDP) ports from 135 through 139 and Transmission Control Protocol (TCP) ports from 135 through 139.
Direct-hosted SMB traffic without a network basic input/output system (NetBIOS): port 445 (TCP and UPD).

And according to: https://github.com/projectkudu/kudu/wiki/Azure-Web-App-sandbox
Regardless of address, applications cannot connect to anywhere using ports 445, 137, 138, and 139. In other words, even if connecting to a non-private IP address or the address of a virtual network, connections to ports 445, 137, 138, and 139 are not permitted.

And therefore I guess it is technically not possible to access the file share (unless the file share could run on different ports which I guess is technically as well not possible).

Share via

Azure Web App access to on-premise file server

2 answers

Your answer