How do I make a VM with public IP accessible on port 5432 to WVD VMs under my company's private network?

Ritika Laddha 90

Public IP VM is the server where postgresSQL is deployed.

I want to connect to this database from WVD VM which is under private network and has private IP. Creating Public IP for this VM is violating company policies.

I cannot add inbound rule for Postgres server with Any source as I want to open port 5432 which is a database port, so that is also violating company policies. I have tried adding inbound by adding private IP of WVD VMs, but that is not working. I am not even able to ssh to this server from my WVD VM.

I wanted to know if there is any solution to connet to that server?

KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee

2024-07-05T11:59:53.59+00:00
@Ritika Laddha ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you have AVD (formerly WVD) machines from which you would like to access another VM on Port 5432

Per your verbatim,

The VM cannot have a NSG that allows incoming connections on Port 5432 with "Source" as Any

The AVD machine cannot be attached a Public IP (Fixed IP)

In this case,

You have to connect privately to the VM on Port 5432

The best way I can think of is to Peer the AVD Vnet and the VM's VNET

Once done, traffic from AVD Vnet can access resources in the VM's VNET

See : Network topology and connectivity for Azure Virtual Desktop

Hope this helps.

Cheers

Kapil
Ritika Laddha 90 Reputation points

2024-07-05T12:22:04.8733333+00:00

@KapilAnanth-MSFT
Thanks for the solution

could you please tell me how to do that in the best and secure way?
I do not quite understand below settings
Remote virtual network peering settings
Local virtual network peering settings
Vinodh247 12,741 Reputation points

2024-07-05T12:33:59.6933333+00:00
you can use Network Security Groups (NSGs) to restrict access only to specific private IP addresses.

Verify that PostgreSQL is configured to listen on the public IP and port 5432

Apply an NSG to the VM's network interface or subnet to control inbound and outbound traffic

Create an inbound security rule in the NSG to allow traffic on port 5432 only from the private IP range of your WVD VMs.reate an inbound security rule in the NSG to allow traffic on port 5432 only from the private IP range of your WVD VMs

can you try this and let me know?
KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee

2024-07-05T15:50:58.7633333+00:00
@Ritika Laddha ,

Azure Virtual Network peering is just extending your Virtual Network to connect to another Virtual network.

Once virtual networks are peered, resources in both virtual networks can communicate with each other over a low-latency, high-bandwidth connection using Microsoft backbone network.

For best practises, see here

You can let those fields have the default value as mentioned here : Create virtual network peer

To understand the fields and what they do, refer : VNET Peering and it's properties

This explains Local virtual network and Remote virtual network peering settings

Hope this helps.

Cheers,

Kapil
Ritika Laddha 90 Reputation points

2024-07-08T08:12:52.6333333+00:00

Hello @KapilAnanth-MSFT

On Public IP VM's vnet : vent peering is initiated

But getting below error on Private WVD VM's vnet,
So is it my creds or the scope is invalid?
KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee

2024-07-08T11:10:00.8133333+00:00
@Ritika Laddha ,

Thanks for the update.

This means, you do not have appropriate permissions to initiate a VNET Peering from "WVD VM's vnet".

You can either request your Admin to do the peering from this VNET

or request your Admin to assign you the necessary permissions so that you can go ahead and do the peering yourself

Let me know how it goes.

Cheers,

Kapil

Share via

How do I make a VM with public IP accessible on port 5432 to WVD VMs under my company's private network?