Secure RDP and other endpoints in Azure

Question

So we are starting to move to the cloud and our biggest concern is security, as it should be. The thing that I am not sure about is how to secure the end points from public (interent) access? Is this even possible or is there something else we can do to keep the environments in Azure out of the public eye?

Answer 1

This question is likely better suited to server fault. But until then...

In Azure IaaS V1, you can specify IP based ACLs (access control lists) to restrict inbound traffic.

In both IaaS v2, you can leverage NSG (network security groups) to help restriction trick into and out of specific VMs or virtual network sub-nets.

If you are using Azure Express Route (a leased line into an Azure facility), the VMs can be addressed directly from within the virtual network connection and don't need to have publically exposed endpoint.

Then there's also all the usual options such as securing the connections on the VMs themselves. :)

Answer 2

If you are using Azure Resource Groups along with your VMs (which is available on the new portal) you cannot use endpoints because it's not available there, so you should do the following to open up the HTTP port or ANY other port:

(Sign in to your account on the new portal)

1- Select the VM that you want to manage ports on.

2- In settings, click on Network Interfaces and select your network.

3- Go to Network Security Group and select your group.

4- Add Inbound or Outbound security rules depending on what you need.