Storage Account with Private Endpoint. Can it be accessed from Public IPs through Azure Firewall?

Question

I have a Storage Account with Private Endpoint. My Vnet is protected with Azure Firewall. Storage Account is accessible from On-premises or other (through Azure VPN GW) and from other peered Vnets. All traffic to the Storage Account Private Endpoint is filtered by the Azure Firewall.

If we want to allow access to the storage account from specific Internet IP Addresses, can we filtered these I Ps with the Azure Firewall and how ? Which FQDN to use? Do we NAT the private IP to a Public IP ? What certificate do we use?

Or we have to do it through the Storage Account public network access filter?

Answer 1

Hello Charis Chari,

Thank you for posting your query here!

To control access via Azure Firewall, you would generally need to filter network traffic by source and destination IP addresses, protocols, and ports, but not by Internet IP addresses directly to a Private Endpoint because Private Endpoints are not accessible from the public internet.

Azure Firewall does not support NAT (Network Address Translation) from public IP to private IP for incoming traffic. Azure Firewall is primarily used to control outbound and inbound network traffic rules between protected subnets.

Since your storage account uses a Private Endpoint, it likely has a DNS configuration that resolves to private IP addresses within your virtual network. Public internet users cannot use this DNS to reach the storage account.

A much easier way to let specific internet IPs into your storage account is to use the network access controls that come with Azure Storage:

· You need to configure the storage account to allow public network access. This can be done by setting the Allow option for public network access on the storage account configuration.

· Under the Firewalls and virtual networks settings of the storage account, you can specify which public IP addresses or IP ranges are allowed to access the storage account.

· As for FQDN, in case of public access, the storage account can be accessed via its public endpoint, typically in the format https://<account_name>.blob.core.windows.net. If you enable public access only for specific IPs, this would be the endpoint they use.

· Also, please note that when connecting to Azure Storage, the SSL/TLS certificate is managed by Azure, and you don’t need to handle certificates specifically for Azure Firewall.

Do let us know if you have any further queries. I’m happy to assist you further.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.