Azure CDN - Storage Static Website

Solonas Andreou 75

Hi there ,

We create a storage account with a static website

Also we create a CDN profile with a custom domain and pass our certificate

The problem is that we want a white list for some IP addresses

We make that changes on Storage Firewall ( add the specific IP ) but this not work

Even if i have my IP on white list i can access the custom domain

I also try to go through the *.azureedge.net of CDN , the same response

but when i try to go through the origin hostname *.z6.web.core.windows.net it's working as expected

any ideas what goes wrong ?

KennethML 80 Reputation points

2023-09-21T07:10:56.98+00:00

Hi Solonas.

That is because the caller IP in the request is not your IP, but a CDN endpoint IP.

You should look at the Rules Engine in the CDN Endpoint, maybe you can use that feature to block or redirect other source IPs. I haven't really tried that scenario you want to achieve, but it should be possible.

/Kenneth ML
KapilAnanth-MSFT 45,451 Reputation points Microsoft Employee

2023-09-21T09:25:36.6833333+00:00
@Solonas Andreou

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to whitelist only a certain IPs to access your CDN.

Kenneth ML's answer is correct.

CDN uses it's own IP Address to access the Storage Account

The actual IP of the client making the request would be stored in "X-Forwarded-For" header.

You should consider using Standard rules engine for Azure CDN

Here, you must use the Remote address match condition

Currently, there is no "Allow" or "Block" option available for CDN.

Instead,

you must redirect the request to a custom Error page
or

Rewrite the URL path to a container that stores a static error page in the same storage account.

Cheers,

Kapil
Solonas Andreou 75 Reputation points

2023-09-23T17:31:12.2166667+00:00

i try that and not work for me

i also add the destination '/' but nothing , browser response : The requested content does not exist

my static website is under $web container if that helps
KapilAnanth-MSFT 45,451 Reputation points Microsoft Employee

2023-09-24T06:32:12.6666667+00:00
Hi @Solonas Andreou

The rule is not correct.

The destination should be an error page and not "/".

I take it that you are using "Storage static website" as Origin type and not "Storage"

Let me know if this is incorrect.

You must create a custom error page. Let's say "error.html"

You can give the error message as HTML Content

Upload this "error.html" file in the $web container.

Now, in the CDN, the rule becomes,

When a user from the IP accesses the site (both default index page or any other page) , they will only be redirected to the error page

And the important thing is that the URL will remail fixed

Hope this helps.

Cheers,

Kapil
Solonas Andreou 75 Reputation points

2023-09-24T19:35:21.3366667+00:00

Hi KapilAnanth-MSFT

You are correct i create the Origin Type as Storage Static Website

There is no error.html on $web container

On that container there is an index.html file , i set the rule Destination to that file /index.html

Now the user from that IP is the only user i want to connect to that address

Rule :

Browser:

Storage access level if that helps : Private (no anonymous access)
Storage Firewall : Enabled from selected virtual networks and IP addresses
Here i add the client Public IP that must have access
KapilAnanth-MSFT 45,451 Reputation points Microsoft Employee

2023-09-25T05:16:00.19+00:00
@Solonas Andreou

Wrt, "There is no error.html on $web container"

Please check my previous comment. As stated above, You must create a custom error page on your own. Let's call it "error.html"

The "error.html" will not exist by default.

"index.html" is your static site.

Now, I see you would like to allow only a certain IP. In this case,

The reason why your configuration would not work is:

CDN is allow by default.

So, "explicitly creating a rule and Allowing the IP" does not actually do anything.

Instead, you must URL rewrite everything else except your expected IP to a custom error page.

Wrt Storage Firewall,

Make sure "Allow Azure services on the trusted services list to access this storage account" is enabled.

Hope this helps.

Cheers,

Kapil
KapilAnanth-MSFT 45,451 Reputation points Microsoft Employee

2023-09-26T05:34:48.8566667+00:00

@Solonas Andreou

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,

Kapil
Solonas Andreou 75 Reputation points

2023-09-26T07:11:43.38+00:00

hi @KapilAnanth-MSFT

i create as you said an "error.html" on the $web container

i also modify the CDN rule as you describe:

Firewall settings on Storage (this was from the beginning)

This setup to work i add that IP range 147.243.0.0/16 on Storage Firewall, but look what happens.

https://subadomain.domain.com > can access from any network.
https://subadomain.domain.com/auth/login > CDN work as expected.
Solonas Andreou 75 Reputation points

2023-09-26T07:14:33.5433333+00:00

hi @KapilAnanth-MSFT

Update:

also from my IP i get the same response, CDN redirect my IP to the error.html
KapilAnanth-MSFT 45,451 Reputation points Microsoft Employee

2023-09-27T05:27:11.6633333+00:00

@Solonas Andreou

This could be a cache issue.

Can you please confirm if the issue still persists?

Cheers,

Kapil
KapilAnanth-MSFT 45,451 Reputation points Microsoft Employee

2023-09-28T13:10:48.9833333+00:00

@Solonas Andreou

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil
Solonas Andreou 75 Reputation points

2023-09-28T14:40:34.4133333+00:00

@KapilAnanth-MSFT

no further questions, thank you for your support.
KapilAnanth-MSFT 45,451 Reputation points Microsoft Employee

2023-09-28T16:39:09.3233333+00:00

@Solonas Andreou

You are most welcome.

I have summarized my comments and posted it as a new answer.

I would highly appreciate if you could Accept the answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Thanks,

Kapil
KapilAnanth-MSFT 45,451 Reputation points Microsoft Employee

2023-10-03T10:38:27.32+00:00

@Solonas Andreou

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil

Accepted answer

KapilAnanth-MSFT 45,451 Reputation points Microsoft Employee

2023-09-28T16:38:15.54+00:00
@Solonas Andreou

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to whitelist only a certain IPs to access your CDN.

CDN uses it's own IP Address to access the Storage Account

The actual IP of the client making the request would be stored in "X-Forwarded-For" header.

You should consider using Standard rules engine for Azure CDN

Here, you must use the Remote address match condition

Currently, there is no "Allow" or "Block" option available for CDN.

Instead,

you must redirect the request to a custom Error page
or

Rewrite the URL path to a container that stores a static error page in the same storage account.

Wrt, "Rewrite the URL path to the $web container that stores a static error page "

As stated above, You must create a custom error page on your own. Let's call it "error.html"

The "error.html" will not exist by default.

"index.html" is your static site.

Now, I see you would like to allow only a certain IP. In this case,

The reason why we should use this configuration is:

CDN is allow by default.

So, "explicitly creating a rule and Allowing the IP" does not actually do anything.

Instead, you must URL rewrite everything else except your expected IP to a custom error page.

Wrt Storage Firewall,

Make sure "Allow Azure services on the trusted services list to access this storage account" is enabled.

Cheers,

Kapil

Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure CDN - Storage Static Website

0 additional answers

Your answer