Set Up SFTP/Applicaion Server On Azure VM behind Firewall

Scenario:

Set Up SFTP Server On Azure VM behind FortiGate Firewall.

1. Business request

Set up a file transfer server with public internet access.

2. security concern

The common ways are FTP, FTPS, or SFTP:

SET p
TCP 22
port
Sepration connections for command and file data
Encrypted command and file data connection
Key-based authentication
Host identity verification
TCP 21
Yes
Typically runs over TCP port 21 or 990
Yes
Yes
Through 3-Party Certificate

The FTPS requires applying the certificates to the FTP service, So I deceived to go for SFTP.
SolarWinds SFTP & SCP Server is a Free SFTP server App.

3. Deployment

3.1 Set up SFTP on VM

Download the software to Server and install it

https://www.solarwinds.com/free-tools/free-sftp-server

Redirect the Root Directory

TCP 、 5 L , 一冖 Tray
40W1 」 P1010Cd
R81
心一 Delete 「亠 e '
「 Ditedory Cont '
5 「 TP/SCP ServerSettings
C 「 TP Pmt
一 A m 一「、 renam 為 ! 一 f 5 」 ova-mite
S 「一 $ trat ero 「 , 3 : 一 lat the SFTP/SCP severwa allow
' Criyapp : 。 SFTP

Create user to login

SVTP/SCP r , Settings
Conf 亡「一 2 一 1 刂一 d 「 or 宁 5 「 T 「、 SC 「 sewer

verify the SFTP service is running on localhost $Command Prompt sftp 127.0.0.1 •licrosoft Windows [Version 18.8.17763.1697] 2818 microsoft Corporation. All rights reserved . : : \ Users >sftp 127 .ø.ø.l 127 .ø.ø.l's password:$

3.2 Config Host firewall and Azure NSG to allow SFTP service

Add Port 22 TCP into host firewall

Add Port 22 TCP into Azure NSG FTPSFTP
'SVR.CSG
Source O
Source port ranges
Destination
x
Delete
Destination IP addresses/ClDR ranges
10.11.44
Service @
Custom
Destination port ranges • O
Protocol
@ TCP
C) u0P
Action
@ Allow
O Deny
Priority* O

Verify the SFTP service is reachable for internal user

3.3 Config Fortigate firewall to allow external access

Firewall Port Fording

Firewall policy rule with Whitelist control

Test SFTP connection from approved external IP

Contributed by Trevor Shi.

Search This Blog

Aim higher