How to set up a simple cheap container that is publicly accessible (non-HTTP)

Question

How to set up a simple cheap container that is publicly accessible (non-HTTP)

Mease, Darren Thomas 86

Hi,

Although I can appreciate the groans when seeing the title, I can confirm I have been looking at this for quite a while now, and if I have missed something simple, apologies!

I have set up a container instance previously, behind a WAF/Application Gateway, and accessed the container via the public IP of the gateway - this I have working just fine. As a basic user, however - the app gateway can be quite expensive overall.

If I set a public IP directly on a container instance, I cannot seem to figure out how to restrict traffic to it. I cannot seem to add an NSG, and I am unable to do anything from inside the container (such as iptables) as the access is managed at the kernel level, and trying to use iptables would be rejected.

I have looked at NAT gateway, but it looks like that is for outbound traffic only.

Ultimately - if I want to access a container using a public IP, is it possible to restrict access without using an application gateway. Another constraint is the access is not web traffic - it is SSH. Also looked at Bastion hosts, but again this can get quite expensive over time.

Hope this makes sense - I usually provide references of everything I have looked at, however it is a looooong list.

Any thoughts appreciated,

Cheers,

AirGordon 7,150 Reputation points

2023-06-20T18:47:49.18+00:00

Simple public container hosting is indeed Azure Container Instances, however as you've pointed out restricting access to the container means using another service in combination.

Container Apps now support non http traffic, and also supports Ingress restrictions.
You should therefore be able to create a TCP IP restriction that meets your requirement (although I haven't tried this exact combination, as I've only used Container Apps Ingress for web apps - it looks like it'll work for you) .

https://learn.microsoft.com/en-us/azure/container-apps/ip-restrictions?pivots=azure-portal#manage-ip-ingress-restrictions
Mease, Darren Thomas 86 Reputation points

2023-06-22T09:15:19.5533333+00:00

That is fantastic, chap, and thanks for the swift response.
Mease, Darren Thomas 86 Reputation points

2023-06-22T09:17:03.2933333+00:00

There seems to be a restriction on non-HTTP traffic when allowing Ingress.
In the images below, when restricting ingress to Container Apps environment, any port can be specified, however when you select Accepting traffic from anywhere, you can only select HTTP.

Will do some further digging, and update!

Accepted answer

0 additional answers

Your answer

AirGordon 7,150 Reputation points

2023-06-20T18:47:49.18+00:00

Simple public container hosting is indeed Azure Container Instances, however as you've pointed out restricting access to the container means using another service in combination.

Container Apps now support non http traffic, and also supports Ingress restrictions.
You should therefore be able to create a TCP IP restriction that meets your requirement (although I haven't tried this exact combination, as I've only used Container Apps Ingress for web apps - it looks like it'll work for you) .

https://learn.microsoft.com/en-us/azure/container-apps/ip-restrictions?pivots=azure-portal#manage-ip-ingress-restrictions
Mease, Darren Thomas 86 Reputation points

2023-06-22T09:15:19.5533333+00:00

That is fantastic, chap, and thanks for the swift response.
Mease, Darren Thomas 86 Reputation points

2023-06-22T09:17:03.2933333+00:00

There seems to be a restriction on non-HTTP traffic when allowing Ingress.
In the images below, when restricting ingress to Container Apps environment, any port can be specified, however when you select Accepting traffic from anywhere, you can only select HTTP.

Will do some further digging, and update!

Answer 1

AirGordon 7,150

I think the simple answer that will work for you is just using a Public Load Balancer in front of a Private Azure Container Instance.

I've just tried it, and it works well for your scenario.

These are the resource you will need;

enter image description here

The Public IP address is used by the load balancer, which is configured with a backend pool that is your ACI private IP address. The NSG is applied to your ACI subnet, and restricts inbound traffic to specific IP & ports.

I hope this is useful to you, please upvote and mark as answered if so 🤓

Mease, Darren Thomas 86 Reputation points

2023-06-26T20:39:03.0633333+00:00

Thats fantastic, cheers! Looking at the pricing [1], Inbound NAT is free, and you are charged for rules (first 5 at 2.1p per hour - and I think I will only need 2 - one for outbound rules [2]), and 0.5p per GB for data processed.

QQ - Did you also mention AKS at some point? As the mail notification that come through to me included:

"This might seem like a complex way to solve a simple problem, however simplicity, privacy and low-cost does seem to be an iron triangle. The Azure Kubernetes Service is a Container Orchestrator that have a full feature set. You also only pay for the…"

Thanks for all of your help, I will update this thread with how I get on!

[1] https://azure.microsoft.com/en-gb/pricing/details/load-balancer/

[2] https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections
AirGordon 7,150 Reputation points

2023-06-27T08:51:10.7633333+00:00

Good spot, yes i did suggest AKS before realising that there was an even more straight forward solution 🤪

I saved the response here if you did want to read it: https://github.com/Gordonby/Snippets/blob/master/LearnAnswers/Shelved/SimpleAks.md
Mease, Darren Thomas 86 Reputation points

2023-07-17T17:46:28.6766667+00:00

Update: Still trying to get this to work (I have just got back around to looking at this). When creating a public container instance, I can SSH to the container and log in fine.

When placing it behind a load balancer, I cannot seem to connect. To test, the NSG permits 22/tcp from anywhere - when I test with port 22 in either load balancing rule or NAT rule, I dont get any response.

Interestingly, MS doc [1] advises that NAT rules are meant to send to a specific resource (hence why they are different to load balancing rules), but.... when configuring a NAT rule, if I am not specifying a VM, I am forced to select a pool.... Something I am missing here - will keep digging, and when I find the issue I will follow up to make sure this helps others if they are doing random craziness like this.

[1] https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/azure-load-balancer-security-baseline
Mease, Darren Thomas 86 Reputation points

2023-09-11T14:56:06.17+00:00

Hi,

Update on the above, apologies for the delay, time flies when you are having fun....

Issue turned out to be my health probe - deleted the probe for 22/tcp and then re-added, and for some reason that appears to have worked...!

Thanks for all of the assistance here - great responses and feedback!

Share via

How to set up a simple cheap container that is publicly accessible (non-HTTP)

0 additional answers

Your answer