Azure ARM VM Configuration Management Series (PART 1)

We recommend the use of site-to-site *** or point-to-site *** Remote Access Port Access Management (RDP, SQL host, etc.). Security group or the network configuration, the DMZ is divided

Another method is the default port change to a larger range. This is not very good security, because the port is still fully exposed to the Internet, but better than the direct use of 3389.

The following procedure will update the RDP port, create inbound firewall rules and updated Windows Azure Security Group (NSG).

Note: As with any change, this change in production before, make sure you fully understand the contents of changes to be made, and there is a rollback plan.

Windows firewall and registry changes #PS Code:

# Write-host "What Port would you like to set for RDP: " -ForegroundColor Yellow -NoNewline;$RDPPort = Read-Host

 

#  Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-TCP\" -Name PortNumber -Value $RDPPort

 

New-NetFirewallRule -DisplayName "RDP HighPort" -Direction Inbound –LocalPort $RDPPort -Protocol TCP -Action Allow Write-host "port number is $RDPPORT" -ForegroundColor MagentaWrite-host "Launch RDP with IP:$RDPORT or cmdline MSTSC /V [ip]:$RDPORT"

Steps:

# Using Powershell update VM port

1. The administrator runs the Powershell command line

2. Paste command line, type VM Host will use high-end port

3. Configure Windows Firewall policy

RDP and Windows Firewall with the new port configuration update

4. Restart the VM Host

# GUI graphical interface by updating the network security group (NSG).

1. Select Modify VM Host, click on the network interface name

2. Network security group

3. Click Network Group Name

4. Select the default-allow-rdp

5. Click on Advanced

6. Select the port to update the port range we need to customize.

7. Click outside the box, "Save"

8. Wait NSG updated, it was confirmed that the port is listening by Powershell TNC: {TNC IPAddress -Port PORT} confirmed as true.

Start RDP, enter {IPAddress: Port}, a new high verify the configuration access port