Whitelist URL for Azure VM

Question

We have a very close environment with some Data Science resources and DSVM with some software and no Internet, for each of our group of users we create everything new on a new Resource Group.
What we need is to allow traffic only to specifics URLs from the DSVM, to be able to connect or install things on the Software inside VM.
Taking in account that with a NSG we cannot whitelist URLs, only IP and there is no Application hosted, which solution is recommended? And could be applied for every Resource Group or should be duplicated for every existing one?
Any help would be appreciated, Thanks in advance!

Answer 1

@marcos quiroga

Welcome to Microsoft Q&A Platform, thanks for posting your query here.

For any filtering of URL, the only option is Firewall.

There is a cost-effective Firewall (Azure Firewall Basic) that is currently in preview. Please check this document Azure Firewall Basic.

If Firewall is the only option, could be configured serving 1 Firewall to multiples Resource Groups/VNet/Subnet or should be one per RG.
-It's one per VNet
-It can serve multiple VNets, as long as these VNets are peered to the VNet where the Firewall is deployed

Hope this helps.
If you need further help on this, tag me in a comment.
If the suggested response helped you resolve your issue, please 'Accept as answer', so that it can help others in the community looking for help on similar topics.

Answer 2

If you configure your network to route all traffic via Azure Firewall, and enable DNS Proxy, you can allow only specific FQDNs as required.

This will require route tables on all subnets, and a comprehensive set of Network rules on Azure Firewall.

Answer 3

Hi @Joe Carlyle thank you for your quick reply. Question, I do consider that Firewall is probably the robust solution for this, but also taking in account that what we need is only whitelist URL and we will not use most of the features of the Firewall:
-Is there any other option/configuration (like NATGateway) that could suits for the solution? Taking in account the price of the Firewall and that we need to replicate in big amount of Resource Groups
-If Firewall is the only option, could be configured serving 1 Firewall to multiples Resource Groups/VNet/Subnet or should be one per RG.

Thanks in advance!