Home / server / Questions / 872627
In Process
askvictor
Asked: 2017-09-08 22:03:48 +0800 CST

Routing in Azure with internal and external IPs

  • 772

I have a VNet with some VMs in Azure. The VNet has a site-to-site VPN connection back to my premises. From on-prem clients, I can successfully connect to the private IP addresses of the VMs. However, on-prem clients cannot connect to the public IP address of a VM. On the other hand, if I try to connect to a VM from different internet connection (3g on phone, or from home), then I can connect to the public address without problems. There are no network ACLs on network equipment on-prem that could be blocking this traffic (in fact a traceroute to the public IP address cuts out at a ntwk.msn.net address). Any thoughts on what the issue might be?

UPDATE 2: I have spun up a new vnet on a seperate IP range, and a new VM with a public IP. Connecting to the public IP of this VM works fine. Something in the VPN/routing of the original VNET seems to be part of the problem, as without a VPN everything is fine.

UPDATE: I'm beginning to think this has to do with the NIC on the VM. Azure NICs have a private and public IP on the same NIC, but the VM doesn't see the public IP address. Now, the vNet that the NIC is on has certain routing rules that specify certain traffic should route to on-prem via our VPN. I'm thinking that a request from on-prem gets to the VM's public IP successfully via public internet, but the reply is sent from the private IP over the VPN, and the client discards it as it came from a different IP. Since the OS on the VM is unaware of the public IP address, I have no idea how to fix this.

UPDATE 3: I used Wireshark to sniff packets on the the VM, and found that when I connect to the external IP from on-prem, no packets are received by the VM. So the problem might lie in the VNet, the SNAT of the Public IP, or the routing on the VM itself.

routing

1 Answers

  1. Your issue may caused by your Client or on-prem organization intranet edge device, such as Firewall, Proxy, NAT. I think it possible caused by local firewall or On-premise firewall.

    However , you should still check some points.The following example steps are for Windows VM(the troubleshoot thought is also fit for Linux VM):

    1. Your Client Guest or Public network Firewall has whether block the RDP triffic.

    2. Check your organization intranet edge device for:

      a.An internal firewall blocking HTTPS connections or RDP to the Internet.

      b.A proxy server preventing Remote Desktop connections.

      c.Intrusion detection or network monitoring software running on devices in your edge network that is preventing Remote Desktop connections.

    3. Your NSG blocking RDP traffic from internet.

    For Detailed RDP troubleshooting steps for issues connecting to a Windows VM in Azure, refer to this document.

    For Detailed SSH troubleshooting steps for issues connecting to a Linux VM in Azure, refer to this document.

    • 0