{"id":381,"date":"2020-10-03T20:04:35","date_gmt":"2020-10-03T19:04:35","guid":{"rendered":"http:\/\/192.168.8.14\/?p=381"},"modified":"2020-10-18T00:09:20","modified_gmt":"2020-10-17T23:09:20","slug":"vcloud-allow-inbound-access","status":"publish","type":"post","link":"https:\/\/www.jasonstreet.com\/?p=381","title":{"rendered":"vCloud, Allow inbound access"},"content":{"rendered":"\n

In this post I will allow inbound access to a VM. I will be allowing windows RDP on TCP port 3389 but it could be any protocol an any port.<\/p>\n\n\n\n

First I need to create a filewall rule allowing any traffic hitting the edge with a destination port of 3389 to be accepted.
Then a DNAT rule to forward any traffic on the external IP of the edge on port 3389 to be forwarded to the VM on the same port. <\/p>\n\n\n\n

Go to the Edge gateway that we will configure the rules on.
We will need the external IP of the edge but this time we can get that from the SNAT rule.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Select the edge and click the SERVICES link to open the config winodw.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Looking at the Edge firewall rules, I have hidden the system rules and I can see the outbound rule from the last post.
Click the Plus button to create a new rule<\/p>\n\n\n\n

\"\"
Firewall rule list<\/figcaption><\/figure>\n\n\n\n

Double click on the new rule box to name the rule.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Hover the mouse over the Source box and select the Plus icon.
Select the External object and click the right arrow to move it to the selected list. Click Keep to add it to the rule.<\/p>\n\n\n\n

\"\"
Source is now set to external<\/figcaption><\/figure>\n\n\n\n

Hover the mouse over the Destination box and click the IP icon.
A dialog window pops up. Enter the external IP of the edge and click Keep.<\/p>\n\n\n\n

\"\"
Allowing traffic to reach the external IP of the Edge<\/figcaption><\/figure>\n\n\n\n

Now hover the mouse over the Service box and click the Plus icon.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The Service window pops up. Select the Protocol (in this case TCP), leave the source port as any and set the destination port to the port to listen on, in this case 3389.
Click Keep<\/p>\n\n\n\n

\"\"
Setting the edge to listen on a specific port<\/figcaption><\/figure>\n\n\n\n

The inbound rule is now complete. Click Save changes.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Go to the NAT tab and click the DNAT Rule button.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The Add DNAT rule window will open.
This rule is equivalent to a “port forward” or “IP publishing” rule.
The original IP will be the external IP of the edge.
The Translated IP will be the IP on the VM we are forwarding the port traffic to.
The Original and translated port are the port we are forwarding and the port that hits the VM (in this case RDP on 3389)
Click Keep<\/p>\n\n\n\n

\"\"
Configuring a DNAT rule<\/figcaption><\/figure>\n\n\n\n

Finally, Click the Save changes link to commit the rule. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

If you now point an RDP client at the external IP of the edge it will be forwarded to the VM. If the VM has RDP enabled you will be prompted for logon credentials.<\/p>\n\n\n\n

Posts in this series<\/p>\n\n\n\n

vCloud Series<\/a>
Creating a Network<\/a>
Creating a vApp<\/a>
Creating Edge gateway outbound rules<\/a>
Creating Edge gateway inbound rules (This Post)<\/p>\n","protected":false},"excerpt":{"rendered":"

In this post I will allow inbound access to a VM. I will be allowing windows RDP on TCP port 3389 but it could be any protocol an any port. First I need to create a filewall rule allowing any traffic hitting the edge with a destination port of 3389 to be accepted.Then a DNAT…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[27,69],"tags":[83,78,80,81,72,84,71],"class_list":["post-381","post","type-post","status-publish","format-standard","hentry","category-tutorial","category-vcloud","tag-dnat","tag-edge","tag-firewall","tag-nat","tag-nsx","tag-port","tag-vcloud-director"],"_links":{"self":[{"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=\/wp\/v2\/posts\/381","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=381"}],"version-history":[{"count":5,"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=\/wp\/v2\/posts\/381\/revisions"}],"predecessor-version":[{"id":494,"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=\/wp\/v2\/posts\/381\/revisions\/494"}],"wp:attachment":[{"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jasonstreet.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}