I have an application on google app engine servers and private master server behind firewall. Accesss to master server closed by default. So I want to open access for my GAE app. Application sends by XML-RPC requests to master server. How can I do what? How to add GAE servers to my firewall access list?
From http://code.google.com/appengine/docs/python/urlfetch/overview.html#Secure_Data_Connection:
"Your application can connect to systems behind your company's firewall using the Google Secure Data Connector (SDC). With the SDC Agent set up on your network, App Engine applications running on your Google Apps domain can authenticate with the Agent and access URLs on your intranet. The SDC Agent ensures that only your applications can connect to your intranet, and that they will do so only for users signed in using an Apps account on your domain."
If not for GAE, you could use Reverse Port Forwarding Wizard:
http://www.upredsun.com/reverse-port-forwarding/reverse-port-forwarding.html
Related
I am trying to make a web page that is going to make an API call to query data in our existing remote SQL Server. When I am testing it now, my code can access the database using windows authentication, but when I deploy this web page on Azure, will my code be able to still access the remote SQL Server using windows authentication? If not, what do I need to do in order for my web page to query the data in the existing remote SQL Server?
Hybrid Connections is both a service in Azure and a feature in Azure App Service. As a service, it has uses and capabilities beyond those that are used in App Service. To learn more about Hybrid Connections and their usage outside App Service, see Azure Relay Hybrid Connections.
Within App Service, Hybrid Connections can be used to access application resources in other networks. It provides access from your app to an application endpoint. It does not enable an alternate capability to access your application. As used in App Service, each Hybrid Connection correlates to a single TCP host and port combination. This means that the Hybrid Connection endpoint can be on any operating system and any application, provided you are accessing a TCP listening port. The Hybrid Connections feature does not know or care what the application protocol is, or what you are accessing. It is simply providing network access.
https://learn.microsoft.com/en-us/azure/app-service/app-service-hybrid-connections
I have a Google Cloud project with an app and a Cloud SQL Instance. SQL requests from the app time out. Private IP connectivity is enabled. If I explicitly add the app instances' IPs to the SQL Instance's public authorized networks, it works. This is obviously a bad solution since these IPs change on every deployment. How do I permanently grant access to the app?
Private IP's are only accessible by other services on the same Virtual Private Cloud (VPC). App Engine apps don't currently have access to VPC networks.
Edit: App Engine has recently released Serverless VPC Access, meaning that the can now be configured to connect via Private IP.
App Engine Standard does provide a unix domain socket to interface with Cloud SQL instances. Just tell your app to use the socket at /cloudsql/<INSTANCE_CONNECTION_NAME>; (with your instance's connection name), and it should be able to connect. If you are using a cross product or cross regional setup, there are more instructions here.
I have set up 2 projects in my Google Cloud console. The following are the two projects that I have set up in my console.
1. Cloud SQL + App Engine
2. App Engine (New)
So the idea is App Engine (1) is running the same database as App Engine (2). I have already set up the IAM Permission Page and IAM Admin and Project Page.
I have given both projects as Project Editor role too, but still my (2) still can't connect to my (1) database.
Any help please?
Granting access to an application does not automatically enable a database user account to connect to the instance.
You may connect through a proxy, in which case you should follow these steps:
Enable the API
Install the proxy client on your local machine
Determine how you will authenticate the proxy
If required by your authentication method, create a service account
Determine how you will specify your instances for the proxy
Start the proxy
Update your application to connect to Cloud SQL using the proxy
You can find related details on the Connecting to Cloud SQL from External Applications.
This documents provides steps that cover configuring access for IP connections as well.
If you connect from within the app engine environment, you may have a look at Connecting from App Engine.
We've been experimenting with hosting our ASP.NET + SQL Server application in Azure. We've tried two ways so far:
App Service for ASP.NET, VM for SQL Server, both in the same data-centre, so I imagine a LAN connection is possible, but currently the connection string lists the public IP
A single VM for both IIS ASP.NET and SQL Server (an interim solution - we will eventually move SQL behind a firewall)
We'd prefer the first option because of costs and manageability. But it seems slower (I guess because of the public IP in the connection string).
Question
Can the App Service - SQL connection be LAN rather than WAN/internet? Are there any specific tricks during setup to achieve this?
What I've tried
The SQL VM is in a VNet. I've tried adding the App Service into the VNet (based on the guess that it'll then be able to see the SQL VM's internal IP), but the existing VNet is not selectable in the App Service's VNet configuration options.
Can the App Service - SQL connection be LAN rather than WAN/internet?
According to your description, maybe we can use VPN to integrate your app with an Azure Virtual Network.
When we want to select one Vnet for Azure app service, we should setup a point-to-site VPN with a Dynamic routing gateway.
Getting started
Here are some things to keep in mind before connecting your web app to
a virtual network:
•VNet Integration only works with apps in a
Standard, Premium, or Isolated pricing plan. If you enable the
feature, and then scale your App Service Plan to an unsupported
pricing plan your apps lose their connections to the VNets they are
using.
•If your target virtual network already exists, it must have
point-to-site VPN enabled with a Dynamic routing gateway before it can
be connected to an app. If your gateway is configured with Static
routing, you cannot enable point-to-site Virtual Private Network
(VPN).
•The VNet must be in the same subscription as your App Service
Plan(ASP).
•The apps that integrate with a VNet use the DNS that is
specified for that VNet.
•By default your integrating apps only route
traffic into your VNet based on the routes that are defined in your
VNet.
More information about integrate App with an Azure virtual network, please refer to this link.
I have hosted a webapp in azure cloud.
My MS sql database is in rackspace which only allows a selected ip to access.
I can add more IPs to allow access to the rackspace database.
Which IP address of the Azure webapp should I add in rackspace?
Is it the customDomain's IP address or something else.
There isn't just one - check out this doc - basically Azure Web Apps run in a server farm that's managed by Microsoft. Unless you use an ASE (app service environment) you can't change this. There are a couple of ways you can do what you're trying to do - either
1 - connect over the internet by opening up the ports on your rackspace VM - this will work, but opens you up to the possibility of a network layer attack from any app that someone hosts in Azure. (so you're relying on authentication rather than network level protection).
2 - use a hybrid connection - this is an app service feature that allows you to download a gateway exe app that runs in your VM in rackspace, and then connects to the app service and creates a secure tunnel to it. Hence, its outbound from your rackspace DC, you don't need to change firewall settings. You can read about it and download the app from the azure portal (in app services). You then configure the connection in your azure web app just as if the rackspace VM was on the same network. (eg. you can use "localhost" if the gateway exe is running on the sql server). This is the approach I'd recommend if you can't move your SQL estate to Azure SQL and hence locate it alongside your web apps.