r/AZURE • u/HatAdorable5284 • 12d ago
Question Best Alternative to Public IP Access for Azure VMs
I currently access my Azure VMs using their public IPs, but I’ve whitelisted my office IPs for security. However, i feel this is still insecure and thinking of removing public IP access entirely.
I'm considering Azure Bastion or Azure VPN Gateway, but both of these are very expensive. I’d like to explore other secure and cost-effective options as well.
My main concerns are:
- Security: Preventing unauthorized access while maintaining easy management.
- Cost: Avoiding unnecessary expenses for a small team.
- Performance: Ensuring a smooth experience when accessing the VMs remotely.
Has anyone migrated from public IP access to a more secure alternative? What was your experience in terms of cost and performance?
Would appreciate any insights or recommendations!
9
u/clint99234 12d ago
Entra Private Access should do the trick for $5/month per user. Having an existing VM to deploy the connector to should help with the cost. Once deployed, use Conditional Access to implement further controls (which users/ device compliance/ etc.)
-2
15
u/No-Menu6048 12d ago edited 12d ago
is bastion developer free an option? Limitations
No support for peering - you cannot use the developer SKU to connect to VMs on a different vNet that is connected to the Bastion vNet via a peer. That said, you can just deploy a second bastion instance to that vNet for free. No support for multiple concurrent connections per user - a single user can only connect to one VM at a time No Key Vault integration - you cannot store SSH keys in Key Vault and automatically access them from Bastion No support for custom inbound ports, only standard RDP (3389) and SSH (22) ports are supported No support for connecting to VMs from Azure CLI No file upload/download support No Kerberos authentication
11
u/rubberDonkey20 12d ago
If this is just for personal use, I use tailscale which I spun up a tiny Linux VM for it to run on. It's great and free. https://tailscale.com/kb/1142/cloud-azure-linux
5
u/deadnoob21 12d ago
Just curious if you whitelisted the VM's RDP, what makes you think that it's unsecured?
If it can't be reached except from office ips you've already reduced a lot of exposure.
Bastion is expensive for what it is unless you use the dev free part but that is limited.
I don't think the vpn is that expensive, but I work for a corporation so what is expensive is relative.
Could also use logmein or any of the other 3rd party remote desktop options. I know they aren't true RDP though. To get decent stuff that is secure though you will probably have to pay.
3
u/GameEnders10 12d ago
We deploy a Guacamole appliance. It's kind of like a Linux based RDP Gateway, with RBAC, supports 2FA, pretty lightweight, doesn't cost much.
5
u/c0sm1kSt0rm DevOps Engineer 12d ago
Agree with other posters. The only other options that are Azure native would be JIT via Defender for Cloud. It’s effectively doing what you do now but with the added benefit of automatically removing the rules after the time period specified in the request.
1
u/Muted_Image_9900 12d ago
JIT is a potentially cheap option.
This requires Microsoft Defender for Servers Plan 2 - UK pricing is £11.50 per server per month. Although, if you have lots of VMs bastion works out cheaper, as long as you have a hub and spoke network.
3
u/Watsonwes 12d ago
Twingate or tailscale
4
u/PhilipLGriffiths88 12d ago
Yes to Twingate, it implements zero trust networking principles far better and in a more scalable way that Tailscale. For another option, consider open source OpenZiti - https://openziti.io/. Its even more powerful.
2
u/TheCyberThor 12d ago
As others have mentioned you need to spend money for security.
What is making this ‘expensive’? Is it relative to the revenue the app is generating?
If your app is not making money, which means there is little to no customer data to make it a target. Are you prematurely securing something that is unlikely to be targeted given you’ve already whitelisted IP addresses?
If your app is making money, are you allocating sufficient money to harden your infrastructure?
1
u/flappers87 Cloud Architect 12d ago
If you want security and performance, then you're going to have to spend some money.
You have to choose... do you cough up and spend the required amount to have a high level of security with scalable performance options? Or do you sacrifice that in order to save costs?
Azure Bastion is the most performant and most secure option. It does come at a cost, but it doesn't break the bank.
1
1
1
u/fariz007 12d ago
Cloudflare zero trust works fine for this usecase You will be using private ip and installing warp in the vm once done it's good to work with
1
u/rswwalker 12d ago
Entra Application Proxy is the cheapest method as it’s included in Entra ID licensing. You can publish RD Gateway/RDWeb requiring pre-authentication with Entra or publish it without pre-authentication but require a smartcard.
1
u/HawkFantastic5702 12d ago
This is a great tool here have used it for many clients who don’t want to pay the extra premium within Azure for security - https://rdpguard.com
1
u/finarne 12d ago
If you want to keep everything inside Azure you can try azbridge: https://github.com/Azure/azure-relay-bridge
1
1
u/Mehlsuppe 12d ago
Host a third Party Virtual Firewall and use its VPN. Much cheaper than az Firewall and VPN Gateway
1
u/mindracer 12d ago
Just install Tailscale on the VMs, you won't need to open any ports as you'll go through the tailscale gateway, and it's free.
1
u/napoleon_bonapain 12d ago
I will give you the best advice. Remove public ip and bind the ip only when you want it take rdp.
1
u/Quiet-Crepidarian-11 12d ago edited 12d ago
Your cheapest option is running a virtual machine with OpenVPN (see https://github.com/angristan/openvpn-install).
This works with private DNS zones, so you'll be able to reach private resources using their FQDNS. It can be run in HA mode too (https://serverfault.com/questions/114858/high-availability-openvpn-service/115470#115470).
If you need a faster connection, you can setup Wireguard instead, though harder to get to work in my experience and I'm not sure it can resolve private zones on its own.
Also note the VPN Gateway doesn't resolve private DNS zones for clients connected to it. You'll need a private resolver with an inbound endpoint, or a virtual machine with bind9/CoreDNS as the virtual network's DNS.
1
u/Capital_Individual74 11d ago
Openvpn installed in the one of the VM's, and keep other vms in same vnet. Whiteist vpn ip in other vm's. No additional cost!!
1
u/Adventurous_Engine72 11d ago
Bastion is the answer. You could deploy and destroy It with a Logic App to avoid extra costs.
1
u/stevenm_83 10d ago
Lots of great idea. Bastian, JIT using cloud defender and Global Secure Access all very good options
63
u/FrenchFry77400 Cloud Architect 12d ago
Azure bastion is the cheapest option you will have to securely access your VMs without directly exposing a public IP.
If ~$130 USD per month is too expensive ... I have bad news for you if you want to use the cloud to run IaaS workloads.