Getting 403 Ip forbidden

Question

Getting 403 Ip forbidden

Anant 60

I have two app services ( frontend and backend ) in same virtual network. I want to make private of backend app service .

Below are the configurations -

Frontend app - Vnet Integration enabled
Backend application - IP restriction enabled and Vnet integration enabled with same vnet
Added frontend webapp subnet in app service site access rule and added all outbound address of app services as well
In backend web app subnet NSG - allow all traffic inside the vnet

With above configuration .When I hit request from frontend application to backend app service. I m getting 403 IP forbidden error.( backend ip address:443 )

And when I allow all public access in backend , its working fine ....

Can you pls suggest, how can I configure the networking rules to fix this issue so that my backend webapp will work as private.

Thanks !!

User's image

1 answer

Your answer

Answer 1

brtrach-MSFT 17,476 Microsoft Employee

@Anant Based on the information you provided, it seems like you have correctly configured the VNet Integration and IP Restrictions for your backend app service. However, it's possible that the IP address of your frontend app service is not being correctly recognized by the IP Restrictions rule.

To troubleshoot this issue, you can try the following steps:

Check the IP address of your frontend app service by going to the "Properties" section of the app service in the Azure portal. Make sure that this IP address is added to the IP Restrictions rule for your backend app service.

Check the logs for your backend app service to see if there are any errors related to IP Restrictions. You can access the logs by going to the "Log stream" section of the app service in the Azure portal.

If the above steps do not resolve the issue, you can try disabling the IP Restrictions rule temporarily to see if the backend app service is accessible from the frontend app service. If it is, then you can try re-creating the IP Restrictions rule with the correct IP address for the frontend app service.

Anant 60 Reputation points

2023-11-23T05:21:24.97+00:00

Hi @brtrach-MSFT Thanks for reply !!

I configured frontend app service IP in backend restriction rules correctly. Still I am getting 403 ip forbidden ( backendappserviceIPaddress:443)

I got below findings -

When I add my laptop public IP in backend app service restriction rule . The app work properly for me only.It seems like need to be add Ip address of Users in backend app service who will access the application. That is not possible to me to add IP address of particular user.

So can you pls suggest how can I configure the rules in backend app services. That would only be allow traffic from frontend app service rest no one can access the backend app service.

below are my configuration -

Application gateway --> fronted app service (angular) --> Backend App service ( dotnet core) --> DB
brtrach-MSFT 17,476 Reputation points Microsoft Employee

2023-11-28T01:18:06.19+00:00

Thank you for the additional details. One way to achieve this is by using a private endpoint for your backend app service.

A private endpoint is a network interface that connects your backend app service to a private IP address in your VNet. With a private endpoint, traffic to your backend app service is automatically routed through your VNet and is not exposed to the public internet. You can also use IP Restrictions to further restrict access to your backend app service to only the private IP address of your frontend app service.

To configure a private endpoint for your backend app service, you can follow the steps mentioned in the Azure documentation here. Once you have configured the private endpoint, you can use a private IP address from your VNet to access your backend app service. Your backend app service will be integrated into your VNet, and as a result, it will no longer be available to the public internet, and will only be accessible from machines within your Azure VNet.

To further restrict access to your backend app service to only the private IP address of your frontend app service, you can use IP Restrictions. You can add the private IP address of your frontend app service to the IP Restrictions rule for your backend app service and remove any other IP addresses from the rule. This will ensure that only traffic from your frontend app service is allowed to access your backend app service.

Share via

Getting 403 Ip forbidden

1 answer

Your answer