Otdfbt

Nunc est bibendum: gerund or gerundive?

Can diplomats be allowed on the flight deck of a commercial European airline?

Are clauses with "который" restrictive or non-restrictive by default?

Is being an extrovert a necessary condition to be a manager?

csname in newenviroment

Negative impact of having the launch pad away from the Equator

What does `LOGFILE=$1:-/var/log/syslog` do?

Way of refund if scammed?

How could the B-29 bomber back up under its own power?

Congruence, Equal, and Equivalence

How would a physicist explain this starship engine?

Why did Nick Fury not hesitate in blowing up the plane he thought was carrying a nuke?

Why is this python script running in background consuming 100 % CPU?

amsmath: How can I use the equation numbering and label manually and anywhere?

Why is 'additive' EQ more difficult to use than 'subtractive'?

Why do testers need root cause analysis?

What was the primary motivation for a historical figure like Xenophon to create an extensive collection of written material?

Shell builtin `printf` line limit?

Does science define life as "beginning at conception"?

If I arrive in the UK, and then head to mainland Europe, does my Schengen visa 90 day limit start when I arrived in the UK, or mainland Europe?

Department head said that group project may be rejected. How to mitigate?

How to safely discharge oneself

Existence of a model of ZFC in which the natural numbers are really the natural numbers

How did the Allies achieve air superiority on Sicily?

NAT or Proxy to an Azure Container Instance in a VNET for SSH

Is my gateway a fixed or a dynamic IP?What is the difference between an Azure network security group and a VNET?Add Azure SQL Server in to Azure VNETAzure S2S VPN Routing to Another Region VNETConnecting Azure to VPN site to siteAzure Virtual Machine has no public IP yet can access the internetAccess control with Azure Load Balancer VMs having individual public IP addressesVirtual Kubelet: node selection on scale-out and scale-inEnable communication between Azure virtual networksAzure VNet + VPN setup

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

0

i have deployed an ACI that has a small sftp server on it to a virtual network in azure. So this works great when you vpn into the network and access the sftp via something like 10.0.0.2.

i want to publicly expose this now and control access via NAT and a Network Security Group to limit access to a predefined IP. I tried the azure app gateway, but this does not allow SSH according to microsoft.

i then tried a load balancer hoping i could just NAT this but it seems Azure LB's only want to go to Virtual machines or scale sets. Not an arbitrary internal IP address.

is there any way to map a public ip via some kind of NAT tool in azure to achieve what i am looking for? my only other alternatives at this point seem to be creating a VM and putting a SFTP server on that, or exposing the ACI with a public IP (outside the VNET) and using like IPTables in linux to control access - and i dont even know if that is possible w/ this build since it's essentially a docker image.

appreciate any advice! simply want to secure sftp.

thanks,

azure nat azure-networking

share|improve this question

asked May 8 at 14:02

Mike MMike M

1

add a comment | 

0

i have deployed an ACI that has a small sftp server on it to a virtual network in azure. So this works great when you vpn into the network and access the sftp via something like 10.0.0.2.

i want to publicly expose this now and control access via NAT and a Network Security Group to limit access to a predefined IP. I tried the azure app gateway, but this does not allow SSH according to microsoft.

i then tried a load balancer hoping i could just NAT this but it seems Azure LB's only want to go to Virtual machines or scale sets. Not an arbitrary internal IP address.

is there any way to map a public ip via some kind of NAT tool in azure to achieve what i am looking for? my only other alternatives at this point seem to be creating a VM and putting a SFTP server on that, or exposing the ACI with a public IP (outside the VNET) and using like IPTables in linux to control access - and i dont even know if that is possible w/ this build since it's essentially a docker image.

appreciate any advice! simply want to secure sftp.

thanks,

azure nat azure-networking

share|improve this question

asked May 8 at 14:02

Mike MMike M

1

add a comment | 

i have deployed an ACI that has a small sftp server on it to a virtual network in azure. So this works great when you vpn into the network and access the sftp via something like 10.0.0.2.

i want to publicly expose this now and control access via NAT and a Network Security Group to limit access to a predefined IP. I tried the azure app gateway, but this does not allow SSH according to microsoft.

i then tried a load balancer hoping i could just NAT this but it seems Azure LB's only want to go to Virtual machines or scale sets. Not an arbitrary internal IP address.

is there any way to map a public ip via some kind of NAT tool in azure to achieve what i am looking for? my only other alternatives at this point seem to be creating a VM and putting a SFTP server on that, or exposing the ACI with a public IP (outside the VNET) and using like IPTables in linux to control access - and i dont even know if that is possible w/ this build since it's essentially a docker image.

appreciate any advice! simply want to secure sftp.

thanks,

azure nat azure-networking

share|improve this question

asked May 8 at 14:02

Mike MMike M

1

share|improve this question

asked May 8 at 14:02

Mike MMike M

1

share|improve this question

asked May 8 at 14:02

Mike MMike M

1

asked May 8 at 14:02

Mike MMike M

1

asked May 8 at 14:02

Mike MMike M

1

1 Answer
1

active

oldest

votes

0

You can assign a custom domain to your ACI instance, or use the out of the box "customlabel.azureregion.azurecontainer.io". When you assign a custom domain, it'll provide you with a PIP, or you can use DNS via a CNAME to map to your instance.

For confirmation, see the following Microsoft docs.microsoft.com article under the heading "Public IP connectivity and DNS name".

---

Moreover, there is a new preview that allows ACI's to be deployed in a VNET: see this article for reference.

share|improve this answer

edited May 9 at 7:50

Community♦

1

answered May 8 at 23:24

Lucian FranghiuLucian Franghiu

15

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for the answer but i am looking to ensure i can use at least an NSG to control access from a specific IP. What you have described is the same as deploying the ACI using a public IP - which i can do. I want to keep it inside my virtual network but this does not seem possible right now. I will likely implement SFTP via a standard VM.
  
  – Mike M
  May 9 at 1:11
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f966395%2fnat-or-proxy-to-an-azure-container-instance-in-a-vnet-for-ssh%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

You can assign a custom domain to your ACI instance, or use the out of the box "customlabel.azureregion.azurecontainer.io". When you assign a custom domain, it'll provide you with a PIP, or you can use DNS via a CNAME to map to your instance.

For confirmation, see the following Microsoft docs.microsoft.com article under the heading "Public IP connectivity and DNS name".

---

Moreover, there is a new preview that allows ACI's to be deployed in a VNET: see this article for reference.

share|improve this answer

edited May 9 at 7:50

Community♦

1

answered May 8 at 23:24

Lucian FranghiuLucian Franghiu

15

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for the answer but i am looking to ensure i can use at least an NSG to control access from a specific IP. What you have described is the same as deploying the ACI using a public IP - which i can do. I want to keep it inside my virtual network but this does not seem possible right now. I will likely implement SFTP via a standard VM.
  
  – Mike M
  May 9 at 1:11
  

  
  
  
  

add a comment | 

0

You can assign a custom domain to your ACI instance, or use the out of the box "customlabel.azureregion.azurecontainer.io". When you assign a custom domain, it'll provide you with a PIP, or you can use DNS via a CNAME to map to your instance.

For confirmation, see the following Microsoft docs.microsoft.com article under the heading "Public IP connectivity and DNS name".

---

Moreover, there is a new preview that allows ACI's to be deployed in a VNET: see this article for reference.

share|improve this answer

edited May 9 at 7:50

Community♦

1

answered May 8 at 23:24

Lucian FranghiuLucian Franghiu

15

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for the answer but i am looking to ensure i can use at least an NSG to control access from a specific IP. What you have described is the same as deploying the ACI using a public IP - which i can do. I want to keep it inside my virtual network but this does not seem possible right now. I will likely implement SFTP via a standard VM.
  
  – Mike M
  May 9 at 1:11
  

  
  
  
  

add a comment | 

You can assign a custom domain to your ACI instance, or use the out of the box "customlabel.azureregion.azurecontainer.io". When you assign a custom domain, it'll provide you with a PIP, or you can use DNS via a CNAME to map to your instance.

For confirmation, see the following Microsoft docs.microsoft.com article under the heading "Public IP connectivity and DNS name".

---

Moreover, there is a new preview that allows ACI's to be deployed in a VNET: see this article for reference.

share|improve this answer

edited May 9 at 7:50

Community♦

1

answered May 8 at 23:24

Lucian FranghiuLucian Franghiu

15

share|improve this answer

edited May 9 at 7:50

Community♦

1

answered May 8 at 23:24

Lucian FranghiuLucian Franghiu

15

edited May 9 at 7:50

Community♦

1

edited May 9 at 7:50

Community♦

1

answered May 8 at 23:24

Lucian FranghiuLucian Franghiu

15

answered May 8 at 23:24

Lucian FranghiuLucian Franghiu

15