This week while working in my lab, I came across a situation where I wanted to run few commands on my linux server which is running in vCloud Air. To access my lab from outside I have configured a Windows jump server and from there I access my lab components (using SSH or RDP to other server). At times it is annoying to switch back and forth between your home desktop and the RDP session.
I went ahead and configured my main Linux server to access it over SSH directly from my home computer (without logging into my windows jump server).
This process is not difficult, but as a habit I tend to document the new things which I do in my lab, and so I am writing a blog post on the same.
Prerequisite: The only prerequisite for this process is that you should have a Public IP purchased and assigned on your edge gateway.
1: To start with the process, login to vca.vmware.com and navigate to your virtual datacenter.
2: Within your VDC, navigate to Gateways tab and double click on your edge gateway.
3: Add a DNAT rule for access to your server from outside by clicking on Add button.
4: Under External IP, select the Public IP which via which you want to access your server.
You can leave the source and destination port to Any-Any at the moment (we will see later how to modify this rule for a specific port)
Under Translated IP, provide the local IP of your linux server which you want to access.
5: Hit finish button to add the NAT rule to your Edge gateway.
6: It will take a few seconds to apply this config on your edge.
7: After few seconds, you can verify that the newly added rule appears under NAT rule list.
8: Next is to add a firewall rule for the outside access. You can add the rule by navigating to ‘Firewall Rules’ tab and clicking on Add button.
9: You can name this rule as per your choice. Also if you wish you can chose to log the traffic details (a good idea for auditing purpose).
You can select source as ‘ANY’ (if you want to access this server from anywhere) or you can limit the source to an IP or range of IP’s (in case if you want this server to be accessed only from your on-prem production environment and not from home)
Under Destination, select Specific CIDR/IP option and provide the Public IP in the box.
Unfortunately this window do not give you ability to limit this rule to a specific port. But no need to worry about it as we will see in next steps how to achieve that.
Hit Next when you are done with filling the required entries.
10: Hit ‘Finish’ to complete the firewall rule creation process.
11: Now its time to modify the NAT/firewall rules (in order to limit them to a specific port to harden the security)
To do so navigate back to Gateways tab and click on ‘Manage in vCloud Director’
12: From the VCD page, select your edge and right click on it and chose ‘Edge Gateway Services’. A new window will pop-up here (unless you have subscribed to Advance Networking Services where you will be taken to hybridity page)
13: Under NAT, select the DNAT rule created by you and hit edit.
14: You can leave original port to ANY. Change the translated port to 22 (or any other, in case you have changed default ssh port on your server). Hit OK
15: Now from the firewall rule list, select the newly created rule and click edit button.
16: Again you can leave source port to ANY and change the destination port to your SSH port. Make sure you have select allow as Action for this rule. Hit OK.
17: Thats it. You can access your server directly from your source computer now.
I hope this post is informational to you. Feel free to share this on social media if it is worth sharing. Be sociable