Control outbound IP address of internal VMSS in Azure

1
votes

I have a VMSS/svc fabric cluster on internal vnet (not public). The only inbound connections to the VMSS is from on prem through a Azure VPN Gateway.

How do I control the outbound IP address the VMSS go through when accessing the internet? In this case I do not want this traffic routed through a random IP address or through the VPN connection.

Basically I want to secure my Azure SQL so that the outbound internet IPs of the VMSS is whitelisted. And I don't want to add all Azure datacenter IPs.

1
azurevnet
VMSS now supports public IP per VM, so it should be possible to apply the same solution mentioned, but without needing an extra VM. – sendmarsh
@sendmarsh, except that would make the VMSS exposed and I want to avoid doing that. – Dave N
you could assign an NSG to the VMSS and block inbound traffic. – sendmarsh

1 Answers

1
votes

You could look to use Forced Tunneling which would ensure that your control where the data egress occurs in your on-premises environment, however this would force any data in your Virtual Network back over your VPN connection which may not be desirable (or helpful if you don't control egress from there).

Failing this you could add a software-based firewall running on an Azure VM with a public IP onto the same VNet and then use User Defined Routes (UDRs) to force all traffic bound for the Internet to go via that and then use the public IP address in your SQL firewall.

Longer term you will be able to connect Azure SQL DB to VNets (or at least restrict access to it from one) - see the Uservoice site (and add your vote!)