Azure client IP address - powershell

Question

I haven't been able to find any documentation on how to predict the IP address that Azure sees you as.
Here's the IP that I'm referring to, in red:
I'm trying to implement CURRENT CLIENT IP ADDRESS xxx.xxx.xxx.xxx ADD TO ALLOWED IP ADDRESSES programmatically.

Answer 1

Here is what worked for me: There is a "AutoDetectClientIP" Management API call that updates an existing Firewall Exception to the caller's IP address.
But you need access to a Management Certificate that is valid for the given subscription, the subscription ID, the name of the SQL Azure Server and the name of the Firewall Exception.
public static bool SetFirewallRuleAutoDetect(string certFilename, string certPassword, string subscriptionId, string serverName, string ruleName)
{
try
{
string url = string.Format("https://management.database.windows.net:8443/{0}/servers/{1}/firewallrules/{2}?op=AutoDetectClientIP",
subscriptionId,
serverName,
ruleName);
HttpWebRequest webRequest = HttpWebRequest.Create(url) as HttpWebRequest;
webRequest.ClientCertificates.Add(new X509Certificate2(certFilename, certPassword));
webRequest.Method = "POST";
webRequest.Headers["x-ms-version"] = "1.0";
webRequest.ContentLength = 0;
// call the management api
// there is no information contained in the response, it only needs to work
using (WebResponse response = webRequest.GetResponse())
using (Stream stream = webResponse.GetResponseStream())
using (StreamReader sr = new StreamReader(stream))
{
Console.WriteLine(sr.ReadToEnd());
}
// the firewall was successfully updated
return true;
}
catch
{
// there was an error and the firewall possibly not updated
return false;
}
}

Answer 2

Your IP address is determined by the NATting of the network that you are on, unless you are coming from a machine that has a fixed public IP address. Unless you have client machines connecting from the same network, and you understand the network in detail, it is unlikely that you can reliably predict the client IP addresses. The only solution is to add a range from say 86.0.0.0 to 86.255.255.255 and hope that it covers the network that you are connecting from - but a whole lot of 'undesirables' will land up in that range too.
The client IP address functionality should not be used for anything other than direct admin access, which can be manually set from time to time as needed. It can also be locked down using local firewall rules too, by restricting access over port 1433 to specific local network machines. Any more general access should be restricted to a service of sorts - such as OData style, mobile services, or using some sort of port bridge, which can be facilitated by VPNs, VMs and other IaaS services.
I suggest you think strongly about your use case first - direct SQL access is not a viable pattern for cloud computing. Many alternatives exist that are faster, more secure, and more manageable. Besides, at the very least you are entering a world of pain trying to get the guys in security to poke holes in their firewalls for SQL ports.