Edit

Share via

Tutorial: Deploy and configure Azure Firewall and policy using the Azure portal

Controlling outbound network access is an important part of an overall network security plan. For example, you may want to limit access to web sites. Or, you may want to limit the outbound IP addresses and ports that can be accessed.

One way you can control outbound network access from an Azure subnet is with Azure Firewall and Firewall Policy. With Azure Firewall and Firewall Policy, you can configure:

  • Application rules that define fully qualified domain names (FQDNs) that can be accessed from a subnet.
  • Network rules that define source address, protocol, destination port, and destination address.

Network traffic is subjected to the configured firewall rules when you route your network traffic to the firewall as the subnet default gateway.

For this tutorial, you create a simplified single VNet with two subnets for easy deployment.

  • AzureFirewallSubnet - the firewall is in this subnet.
  • Workload-SN - the workload server is in this subnet. This subnet's network traffic goes through the firewall.

Diagram of Firewall network infrastructure.

For production deployments, a hub and spoke model is recommended, where the firewall is in its own VNet. The workload servers are in peered VNets in the same region with one or more subnets.

In this tutorial, you learn how to:

  • Set up a test network environment
  • Deploy a firewall and firewall policy
  • Create a default route
  • Configure an application rule to allow access to www.google.com
  • Configure a network rule to allow access to external DNS servers
  • Configure a NAT rule to allow inbound HTTP access to the test server
  • Test the firewall

If you prefer, you can complete this procedure using Azure PowerShell.

Prerequisites

If you don't have an Azure subscription, create a free account before you begin.

Set up the network

First, create a resource group to contain the resources needed to deploy the firewall. Then create a VNet, subnets, and a test server.

Create a resource group

The resource group contains all the resources for the tutorial.

  1. Sign in to the Azure portal.

  2. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page, then select Create. Enter or select the following values:

    Setting Value
    Subscription Select your Azure subscription.
    Resource group Enter Test-FW-RG.
    Region Select a region. All other resources that you create must be in the same region.

  3. Select Review + create.

  4. Select Create.

Create a VNet

This VNet has two subnets.

Note

The size of the AzureFirewallSubnet subnet is /26. For more information about the subnet size, see Azure Firewall FAQ.

  1. On the Azure portal menu or from the Home page, select Create a resource.

  2. Select Networking.

  3. Search for Virtual network and select Create.

  4. Enter or select the following values:

    Setting Value
    Subscription Select your Azure subscription.
    Resource group Select Test-FW-RG.
    Name Enter Test-FW-VN.
    Region Select the same location that you used previously.

  5. Select Next.

  6. On the Security tab, select Next.

  7. For IPv4 Address space, accept the default 10.0.0.0/16.

  8. Under Subnets, select default.

  9. On the Edit subnet page, for Subnet purpose, select Azure Firewall.

    The firewall is in this subnet, and the subnet name must be AzureFirewallSubnet.

  10. For Starting address, type 10.0.1.0.

  11. Select Save.

Next, create a subnet for the workload server.

  1. Select Add subnet.
  2. For Subnet name, type Workload-SN.
  3. For Starting address, type 10.0.2.0/24.
  4. Select Add.
  5. Select Review + create.
  6. Select Create.

Deploy Azure Bastion

Deploy Azure Bastion Developer edition to securely connect to the Srv-Work virtual machine for testing.

  1. In the search box at the top of the portal, enter Bastion. Select Bastions from the search results.

  2. Select Create.

  3. On the Create a Bastion page, enter or select the following values:

    Setting Value
    Project details
    Subscription Select your Azure subscription.
    Resource group Select Test-FW-RG.
    Instance details
    Name Enter Test-Bastion.
    Region Select the same location that you used previously.
    Tier Select Developer.
    Virtual network Select Test-FW-VN.
    Subnet The AzureBastionSubnet is created automatically with address space 10.0.0.0/26.

  4. Select Review + create.

  5. Review the settings and select Create.

    The deployment takes a few minutes to complete.

Create a virtual machine

Now create the workload virtual machine, and place it in the Workload-SN subnet.

  1. In the search box at the top of the portal enter Virtual machine, select Virtual machines in the search results.

  2. Select Create > Virtual machine.

  3. Enter or select these values for the virtual machine:

    Setting Value
    Project details
    Subscription Select your Azure subscription.
    Resource group Select Test-FW-RG.
    Instance details
    Virtual machine name Enter Srv-Work.
    Region Select the same location that you used previously.
    Availability options Select No infrastructure redundancy required.
    Security type Select Standard.
    Image Select Ubuntu Server 24.04 LTS -x64 Gen2
    Size Select a size for the virtual machine.
    Administrator account
    Username Enter azureuser.
    SSH public key source Select Generate new key pair.
    Key pair name Enter Srv-Work_key.

  4. Under Inbound port rules, Public inbound ports, select None.

  5. Accept the other defaults and select Next: Disks.

  6. Accept the disk defaults and select Next: Networking.

  7. Make sure that Test-FW-VN is selected for the virtual network and the subnet is Workload-SN.

  8. For Public IP, select None.

  9. Select Review + create.

  10. Review the settings on the summary page, and then select Create.

  11. When prompted, select Download private key and create resource. Save the private key file to your computer.

  12. After the deployment completes, select the Srv-Work resource and note the private IP address for later use.

Install a web server

Connect to the virtual machine and install a web server for testing.

  1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.

  2. Select the Srv-Work virtual machine.

  3. Select Operations > Run command > RunShellScript.

  4. In the script box, enter the following commands:

    sudo apt-get update
sudo apt-get install -y nginx
echo "<html><body><h1>Azure Firewall DNAT Test</h1><p>If you can see this page, the DNAT rule is working correctly!</p></body></html>" | sudo tee /var/www/html/index.html

  5. Select Run.

  6. Wait for the script to complete successfully.

Deploy the firewall and policy

Deploy the firewall into the VNet.

  1. On the Azure portal menu or from the Home page, select Create a resource.

  2. Type firewall in the search box and press Enter.

  3. Select Firewall and then select Create.

  4. On the Create a Firewall page, use the following table to configure the firewall:

    Setting Value
    Project details
    Subscription Select your Azure subscription.
    Resource group Select Test-FW-RG.
    Instance details
    Name Enter Test-FW01.
    Region Select the same location that you used previously.
    Firewall SKU Select Standard.
    Firewall management Select Use a Firewall Policy to manage this firewall.
    Firewall policy Select Add new, and enter fw-test-pol.
    Select the same region that you used previously. Select OK.
    Choose a virtual network Select Use existing, and then select Test-FW-VN. Ignore the warning about the Force Tunneling. The warning is resolved in a later step.
    Public IP address Select Add new, and enter fw-pip for the Name. Select OK.

  5. Clear the Enable Firewall Management NIC check box.

  6. Accept the other default values, then select Next: Tags.

  7. Select Next : Review + create.

  8. Review the summary, and then select Create to create the firewall.

    This takes a few minutes to deploy.

  9. After deployment completes, go to the Test-FW-RG resource group, and select the Test-FW01 firewall.

  10. Note the firewall private and public IP addresses. You use these addresses later.

Create a default route

For the Workload-SN subnet, configure the outbound default route to go through the firewall.

  1. On the Azure portal menu, select All services or search for and select All services from any page.

  2. Under Networking, select Route tables.

  3. Select Create, then enter or select the following values:

    Setting Value
    Project details
    Subscription Select your Azure subscription.
    Resource group Select Test-FW-RG.
    Instance details
    Name Enter Firewall-route.
    Region Select the same location that you used previously.

  4. Select Review + create.

  5. Select Create.

After deployment completes, select Go to resource.

  1. On the Firewall-route page, under Settings, select Subnets and then select Associate.

  2. For Virtual network select Test-FW-VN.

  3. For Subnet, select Workload-SN.

  4. Select OK.

  5. Select Routes and then select Add.

  6. For Route name, enter fw-dg.

  7. For Destination type select IP Addresses.

  8. For Destination IP addresses/CIDR ranges prefix, enter 0.0.0.0/0.

  9. For Next hop type, select Virtual appliance.

    Azure Firewall is actually a managed service, but virtual appliance works in this situation.

  10. For Next hop address, enter the private IP address for the firewall that you noted previously.

  11. Select Add.

Configure an application rule

This is the application rule that allows outbound access to www.google.com.

  1. Open the Test-FW-RG resource group, and select the fw-test-pol firewall policy.
  2. Under Settings > Rules, Select Application rules.
  3. Select Add a rule collection.
  4. For Name, enter App-Coll01.
  5. For Priority, enter 200.
  6. For Rule collection action, select Allow.
  7. Under Rules, for Name, enter Allow-Google.
  8. For Source type, select IP address.
  9. For Source, enter 10.0.2.0/24.
  10. For Protocol:port, enter http, https.
  11. For Destination Type, select FQDN.
  12. For Destination, enter www.google.com
  13. Select Add.

Azure Firewall includes a built-in rule collection for infrastructure FQDNs that are allowed by default. These FQDNs are specific for the platform and can't be used for other purposes. For more information, see Infrastructure FQDNs.

Wait for the application rule deployment to complete before creating the network rule in the next steps.

Configure a network rule

This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).

  1. Select Network rules.
  2. Select Add a rule collection.
  3. For Name, enter Net-Coll01.
  4. For Priority, enter 200.
  5. For Rule collection action, select Allow.
  6. For Rule collection group, select DefaultNetworkRuleCollectionGroup.
  7. Under Rules, for Name, enter Allow-DNS.
  8. For Source type, select IP Address.
  9. For Source, enter 10.0.2.0/24.
  10. For Protocol, select UDP.
  11. For Destination Ports, enter 53.
  12. For Destination type select IP address.
  13. For Destination, enter 209.244.0.3,209.244.0.4.
    These are public DNS servers operated by CenturyLink.
  14. Select Add.

Wait for the network rule deployment to complete before creating the DNAT rule in the next steps.

Configure a DNAT rule

This rule allows you to connect to the web server on the Srv-Work virtual machine through the firewall.

  1. Select the DNAT rules.
  2. Select Add a rule collection.
  3. For Name, enter HTTP.
  4. For Priority, enter 200.
  5. For Rule collection group, select DefaultDnatRuleCollectionGroup.
  6. Under Rules, for Name, enter http-nat.
  7. For Source type, select IP address.
  8. For Source, enter *.
  9. For Protocol, select TCP.
  10. For Destination Ports, enter 80.
  11. For Destination, enter the firewall public IP address.
  12. For Translated type, select IP Address.
  13. For Translated address, enter the Srv-work private IP address.
  14. For Translated port, enter 80.
  15. Select Add.

Change the primary and secondary DNS address for the Srv-Work network interface

For testing purposes in this tutorial, configure the server's primary and secondary DNS addresses. This isn't a general Azure Firewall requirement.

  1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.
  2. Select the network interface for the Srv-Work virtual machine.
  3. Under Settings, select DNS servers.
  4. Under DNS servers, select Custom.
  5. Enter 209.244.0.3 in the Add DNS server text box, and 209.244.0.4 in the next text box.
  6. Select Save.
  7. Restart the Srv-Work virtual machine.

Test the firewall

Now, test the firewall to confirm that it works as expected.

Test the DNAT rule

  1. Open a web browser on your local computer.
  2. In the address bar, enter http://<firewall-public-ip-address>, where <firewall-public-ip-address> is the public IP address of the firewall you noted earlier.
  3. You should see the custom web page: Azure Firewall DNAT Test. This confirms that the DNAT rule is working and traffic is being forwarded to the Srv-Work virtual machine.

Test the application and network rules

Use Azure Bastion to securely connect to the Srv-Work virtual machine and test the firewall rules.

  1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.

  2. Select the Srv-Work virtual machine.

  3. Select Connect > Connect via Bastion.

  4. On the Bastion page, enter or select the following values:

    Setting Value
    Authentication Type Select SSH Private Key from Local File.
    Username Enter azureuser.
    Local File Select Browse and select the Srv-Work_key.pem file that you downloaded during VM creation.

  5. Select Connect.

    A new browser tab opens with an SSH session to the Srv-Work virtual machine.

  6. In the SSH session, enter the following command to test access to Google:

    curl -I https://www.google.com

    You should see a successful HTTP response (200 OK), indicating that the application rule is allowing access to Google.

  7. Now test access to Microsoft, which should be blocked. Enter:

    curl -I https://www.microsoft.com

    The command should time out or fail after approximately 60 seconds, indicating that the firewall is blocking access.

So now you've verified that the firewall rules are working:

  • You can access the web server through the DNAT rule.
  • You can browse to the one allowed FQDN, but not to any others.
  • You can resolve DNS names using the configured external DNS server.

Clean up resources

You can keep your firewall resources for the next tutorial, or if no longer needed, delete the Test-FW-RG resource group to delete all firewall-related resources.

Next steps

Deploy and configure Azure Firewall Premium

  • Last updated on