Azure Service Fabric Cluster Behind A Firewall

Hosting a Service Fabric cluster on Azure for internet hosted clients requires it to be deployed behind a load balancer with public IP. By default the services will not have any network listeners configured; so, each service needs to implement its own listener by overriding CreateCommunicationListener() defined in StatefulServiceBase and StatelessServiceBase classes; the signature is shown below:

protected override ICommunicationListener CreateCommunicationListener() { ... } 

See Service Communications Model for guidance on implementing your own communications stack.

WcfCommunicationListner is provided by the Service Fabric SDK for hosting WCF endpoints inside stateful and stateless services. The usage of the listener is documented at WCF Communication Listener.

Current implementation of WcfCommunicationListener is not aware of the public IP address/FQDN; so, for NetTcpBinding it generates the following communication endpoint with private IP address:

net.tcp://10.0.0.5/7854ce3f-4e30-4949-b5e4-22cdcbd477c1/8f4106a5-0d38-4f30-aaf0-e435688e5ed6-130808019994632301 

This will work fine if the client also located in the same network; however, for internet based access the local IP address will have to be replaced with the load balancer's public IP/FQDN.

To fix this issue, I used the following listener implementation that extended WcfCommunicationListener:

 //WcfFabricCommunicationsListener.cs 
using Microsoft.ServiceFabric.Services.Wcf;
using System;
using System.Collections.Generic;  
using System.Linq; 
using System.Text; 
using System.Threading.Tasks; 
using System.Fabric; 
using System.Threading; 
using System.ServiceModel; 
using System.ServiceModel.Description; 
public class WcfFabricCommunicationsListener: WcfCommunicationListener
{
  private string _gatewayFQDN;
  public WcfFabricCommunicationsListener(Type communicationInterfaceType, object service) : base(communicationInterfaceType, service) { }
  public WcfFabricCommunicationsListener(Type communicationInterfaceType, Type communicationImplementationType) : base(communicationInterfaceType, communicationImplementationType) { } 
  public override void Initialize(ServiceInitializationParameters serviceInitializationParameters) 
  { 
     ConfigurationPackage configPackage = serviceInitializationParameters.CodePackageActivationContext.GetConfigurationPackageObject("Config"); 
     var infrastructureSection = configPackage.Settings.Sections["Infrastructure"]; 
     _gatewayFQDN = infrastructureSection.Parameters["Gateway"].Value; 
     base.Initialize(serviceInitializationParameters); 
} 
public async override Task<string> OpenAsync(CancellationToken cancellationToken) 
{ 
  string partitionUrl = await base.OpenAsync(cancellationToken); 
  if (_gatewayFQDN == null) 
  { 
   return partitionUrl; 
  } 
  UriBuilder ub = new UriBuilder(partitionUrl); 
   ub.Host = _gatewayFQDN; 
   return ub.ToString(); 

  }
}

Initialize() expects the definition of the FQDN of the gateway through Config package as shown in the following snippet of Settings.xml: <!-- Settings.xml located in the Config directory of the service project --> 

<Settings> 
<!-- other stuff --> 
   <Section Name="Infrastructure"> 
   <Parameter Name="Gateway" Value="mycluster.cloudapp.net" /> 
  </Section> 
</Settings>

OpenAsync() merely replaces the host IP address with the FQDN of the load balancer.