Tutorial: Filter inbound Internet traffic with Azure Firewall policy DNAT using the Azure portal

Article
03/14/2023

You can configure Azure Firewall policy Destination Network Address Translation (DNAT) to translate and filter inbound Internet traffic to your subnets. When you configure DNAT, the rule collection action is set to DNAT. Each rule in the NAT rule collection can then be used to translate your firewall public IP address and port to a private IP address and port. DNAT rules implicitly add a corresponding network rule to allow the translated traffic. For security reasons, the recommended approach is to add a specific Internet source to allow DNAT access to the network and avoid using wildcards. To learn more about Azure Firewall rule processing logic, see Azure Firewall rule processing logic.

In this tutorial, you learn how to:

Set up a test network environment
Deploy a firewall and policy
Create a default route
Configure a DNAT rule
Test the firewall

Prerequisites

If you don't have an Azure subscription, create a free account before you begin.

Create a resource group

Sign in to the Azure portal.
On the Azure portal home page, select Resource groups, then select Add.
For Subscription, select your subscription.
For Resource group name, type RG-DNAT-Test.
For Region, select a region. All other resources that you create must be in the same region.
Select Review + create.
Select Create.

Set up the network environment

For this tutorial, you create a two peered VNets:

VN-Hub - the firewall is in this VNet.
VN-Spoke - the workload server is in this VNet.

First, create the VNets and then peer them.

Create the Hub VNet

From the Azure portal home page, select All services.
Under Networking, select Virtual networks.
Select Add.
For Resource group, select RG-DNAT-Test.
For Name, type VN-Hub.
For Region, select the same region that you used before.
Select Next: IP Addresses.
For IPv4 Address space, accept the default 10.0.0.0/16.
Under Subnet name, select default.
Edit the Subnet name and type AzureFirewallSubnet.

The firewall will be in this subnet, and the subnet name must be AzureFirewallSubnet.

Note

The size of the AzureFirewallSubnet subnet is /26. For more information about the subnet size, see Azure Firewall FAQ.
For Subnet address range, type 10.0.1.0/26.
Select Save.
Select Review + create.
Select Create.

Create a spoke VNet

From the Azure portal home page, select All services.
Under Networking, select Virtual networks.
Select Add.
For Resource group, select RG-DNAT-Test.
For Name, type VN-Spoke.
For Region, select the same region that you used before.
Select Next: IP Addresses.
For IPv4 Address space, edit the default and type 192.168.0.0/16.
Select Add subnet.
For the Subnet name type SN-Workload.
For Subnet address range, type 192.168.1.0/24.
Select Add.
Select Review + create.
Select Create.

Peer the VNets

Now peer the two VNets.

Select the VN-Hub virtual network.
Under Settings, select Peerings.
Select Add.
Under This virtual network, for the Peering link name, type Peer-HubSpoke.
Under Remote virtual network, for Peering link name, type Peer-SpokeHub.
Select VN-Spoke for the virtual network.
Accept all the other defaults, and then select Add.

Create a virtual machine

Create a workload virtual machine, and place it in the SN-Workload subnet.

From the Azure portal menu, select Create a resource.
Under Popular, select Windows Server 2016 Datacenter.

Basics

For Subscription, select your subscription.
For Resource group, select RG-DNAT-Test.
For Virtual machine name, type Srv-Workload.
For Region, select the same location that you used previously.
Type a username and password.
Select Next: Disks.

Disks

Select Next: Networking.

Networking

For Virtual network, select VN-Spoke.
For Subnet, select SN-Workload.
For Public IP, select None.
For Public inbound ports, select None.
Leave the other default settings and select Next: Management.

Management

For Boot diagnostics, select Disable.
Select Review + Create.

Review + Create

Review the summary, and then select Create. This will take a few minutes to complete.

After deployment finishes, note the private IP address for the virtual machine. It will be used later when you configure the firewall. Select the virtual machine name, and under Settings, select Networking to find the private IP address.

Deploy the firewall and policy

From the portal home page, select Create a resource.
Search for Firewall, and then select Firewall.
Select Create.

On the Create a Firewall page, use the following table to configure the firewall:

Setting	Value
Subscription	<your subscription>
Resource group	Select RG-DNAT-Test
Name	FW-DNAT-test
Region	Select the same location that you used previously
Firewall management	Use a Firewall Policy to manage this firewall
Firewall policy	Add new: fw-dnat-pol your selected region
Choose a virtual network	Use existing: VN-Hub
Public IP address	Add new, Name: fw-pip.

Accept the other defaults, and then select Review + create.
Review the summary, and then select Create to create the firewall.

This takes a few minutes to deploy.
After deployment completes, go to the RG-DNAT-Test resource group, and select the FW-DNAT-test firewall.
Note the firewall's private and public IP addresses. You'll use them later when you create the default route and NAT rule.

Create a default route

For the SN-Workload subnet, you configure the outbound default route to go through the firewall.

Important

You do not need to configure an explicit route back to the firewall at the destination subnet. Azure Firewall is a stateful service and handles the packets and sessions automatically. If you create this route, you'll create an asymmetrical routing environment that interrupts the stateful session logic and results in dropped packets and connections.

From the Azure portal home page, select All services.
Under Networking, select Route tables.
Select Add.
For Subscription, select your subscription.
For Resource group, select RG-DNAT-Test.
For Region, select the same region that you used previously.
For Name, type RT-FW-route.
Select Review + create.
Select Create.
Select Go to resource.
Select Subnets, and then select Associate.
For Virtual network, select VN-Spoke.
For Subnet, select SN-Workload.
Select OK.
Select Routes, and then select Add.
For Route name, type fw-dg.
For Address prefix, type 0.0.0.0/0.
For Next hop type, select Virtual appliance.

Azure Firewall is actually a managed service, but virtual appliance works in this situation.
For Next hop address, type the private IP address for the firewall that you noted previously.
Select OK.

Configure a NAT rule

This rule allows you to connect a remote desktop to the Srv-Workload virtual machine through the firewall.

Open the RG-DNAT-Test resource group, and select the fw-dnat-pol firewall policy.
Under Settings, select DNAT rules.
Select Add a rule collection.
For Name, type rdp.
For Priority, type 200.
For Rule collection group, select DefaultDnatRuleCollectionGroup.
Under Rules, for Name, type rdp-nat.
For Source type, select IP address.
For Source, type *.
For Protocol, select TCP.
For Destination Ports, type 3389.
For Destination Type, select IP Address.
For Destination, type the firewall public IP address.
For Translated address, type the Srv-Workload private IP address.
For Translated port, type 3389.
Select Add.

Test the firewall

Connect a remote desktop to firewall public IP address. You should be connected to the Srv-Workload virtual machine.
Close the remote desktop.

Clean up resources

You can keep your firewall resources for the next tutorial, or if no longer needed, delete the RG-DNAT-Test resource group to delete all firewall-related resources.

Next steps

Deploy and configure Azure Firewall Premium