SFTP Services

Question

Dear All,

We need to set up an SFTP solution that has a gateway and IP blacklist function. However, the public traffic passes through Azure Firewall, due to the DNAT on the firewall the client IP is removed. This hinders the blacklist functionality as the SFTP only sees the firewall’s internal IP. This feature is essential because this SFTP server is exposed to the internet for client/application access.

Need advice on any alternative approach.

 

Answer 1

@Rakesh

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to configure a SFTP server VM in Azure behind an Azure Firewall.

Per your verbatim,

• You are using Azure Firewall DNAT for connectivity to the SFTP VM.
• And the source IP the SFTP VM sees belongs to the Firewall.

Now,

• Per my understanding, SFTP does not require two ports unlike FTP and thus does not suffer the traditional FTP limitations.
• If you'd like to achieve IP restrictions, you can do so in the DNAT rules directly.
• This way, only the required sources can access the server via DNAT
• Or, you can exclude the server from Firewall and directly use Public IP with NSGs.
• Or, as per @AdamJudd , you can go ahead with Azure Load Balancer and use NSG (this supports InBound NAT as well)
• P.S: App gateway currently supports HTTP, HTTPS, HTTP/2, and WebSocket only.

Kindly let us know if the above helps or you need further assistance on this issue.

Thanks,

Kapil