How to protect an Azure Vm from dynamic source IPs

Anthony 20 Reputation points
2023-02-01T18:05:23.83+00:00

Hi to all, I have an Azure Vm where is hosted an application of badge readers. This application needs an UDP and TCP ports opened to work. This application receive requests from dynamic Public IPs of the badge readers devices (15 devices in total) that are all located in Italy outside the Azure Virtual Network. I'm trying to find a solution to protect this Vm from malicious attacks without expose the Vm. If I assign a public IP to this Vm and I open these UDP and TCP ports (using NSGs) it works. But in "Source IP" I selected "Any" because the Ip addresses of the badge readers are dynamic and this is not so much secure. Do you know another solution (Azure and not) to solve this type of error without expose the TCP and UDP port? Thanks 🙏

Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,138 questions
Accepted answer
  1. KapilAnanth-MSFT 34,766 Reputation points Microsoft Employee
    2023-02-02T05:52:23.0766667+00:00

    @Anthony

    Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

    I understand that you would like to protect your Azure resource from external malicious attacks.

    I see that you would like to make use of TCP and UDP connections.

    This means, we cannot use Azure App Gateway or Azure Front Door, which offer the users with WAF Protection.

    However, if you are infrastructure is using HTTP, HTTPS, WebSocket, and HTTP/2 over TCP/UDP, you may consider the above.

    You can consider the DDoS IP Protection for better security over the Public IP of the VM.

    Please note that this feature is still in preview

    DDoS IP Protection is a pay-per-protected IP model. DDoS IP Protection contains the same core engineering features as DDoS Network Protection, but will differ in the following value-added services: DDoS rapid response support, cost protection, and discounts on WAF.

    Refer to this for SKU Comparison

    In case you can get static IPs of the remote resources, you can go ahead with NSGs as well.

    Please feel free to let me know should you have any further queries on this.

    Cheers,

    Kapil

    Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest