Take the 2-minute tour ×

I would like to use my internal exchange servers for email notifications from an azure Web Role. The role is set up on the west us region. I need to allow this role, with multiple instances, access my corporate smtp server on port 25. IS there an appropriate range of IPs that I could open up on my corporate firewall, or is there a more secure option.

We have experience setting up networks in Azure as well as VPN gateways, I am not sure that this would be part of the solution as my understanding is not broad enough to see how I could implement something that would allow secure access to corporate networks while continuing to be publicly available.

Any help or direction would be appreciated.


share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

Your web role has a single (and fairly static) ip address of the load balancer, but this is of no use to you as the source ip address for outgoing data will be the ip address of the particular instance. You can get hold of this address, but not easily, and it is subject to change — every time an instance recycles, or is added, the ip address will change (although the incoming ip address, of the load balancer, remains static). So you can't provide instance public ip address ranges for the corporate firewall.

If you are familiar with VPNs and private networks on Azure, then that will be your simplest option. Your worker role ip addresses will still change, but the range is more predictable, and is defined by your subnet configuration. A worker role on a private network (VPN) will have both public and private ip addresses, so will be publicly accessible, but will send to a VPN ip address via the gateway.

Another option is to do some sort of smtp relay, either on a VM in Azure, or a managed hosting service, where the ip address is more static. This would require that a machine is setup, maintained, and running, but could probably be easily done on an extra small linux vm.

share|improve this answer
I am chooseing to setup an SMTP server on my instances to relay the mail. Thank you.. community.adxstudio.com/products/adxstudio-portals/… –  NoMoCouch Apr 22 '13 at 16:52
add comment

Your web roles will be part of an Azure Cloud Service. That cloud service is assigned a static public IP address by Azure. No matter how many roles you add/remove from the service the public IP will remain unchanged. You can set your SMTP server to only allow requests from that IP address.

share|improve this answer
Is this this case for all outgoing traffic? If you open a tcp socket from an instance is the return port and ip address the public ip of the NLB? So does the NLB also do NAT on behalf of the instances? I've seen the addresses on VPNs, but never looked at the tcp data on public addresses. –  Simon Munro Apr 22 '13 at 18:26
I don't know if it is the NLB for sure, but something is doing NAT. For example, if you remote into an azure VM and open IE and hit something like what's my IP it will show up as the public IP. –  Nathan Apr 22 '13 at 20:14
Hmmm. Good point. I'll have to try that one day with lower-level tcp to see what happens. –  Simon Munro Apr 22 '13 at 20:40
add comment

Your Answer


