Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you would like to configure a SFTP server VM in Azure behind an Azure Firewall.
Per your verbatim,
- You are using Azure Firewall DNAT for connectivity to the SFTP VM.
- And the source IP the SFTP VM sees belongs to the Firewall.
Now,
- Per my understanding, SFTP does not require two ports unlike FTP and thus does not suffer the traditional FTP limitations.
- If you'd like to achieve IP restrictions, you can do so in the DNAT rules directly.
- This way, only the required sources can access the server via DNAT
- Or, you can exclude the server from Firewall and directly use Public IP with NSGs.
- Or, as per @AdamJudd , you can go ahead with Azure Load Balancer and use NSG (this supports InBound NAT as well)
- P.S: App gateway currently supports HTTP, HTTPS, HTTP/2, and WebSocket only.
Kindly let us know if the above helps or you need further assistance on this issue.
Thanks,
Kapil