Direct outbound webapp traffic through Azure Front Door w/o a vNet.

Question

I have a standalone webapp behind an Azure Front Door (AFD). The web app can bypass the AFD and connect with Internet services. I want to force all outbound traffic through the AFD instead.

This is a simple setup and I do not want to add a virtual network and a bunch of other services to perform one simple task.

Is there a simple way to create a default gateway for the webapp?

Answer 1

@Matthew Barrett

Thank you for reaching out.

I understand you wish restrict the access of your web-app to Azure Front Door and send all the outbound traffic using Azure Front Door.

I think you can achieve this using Front Door identifier and App Service access restrictions.

Azure generates a unique identifier for each Front Door profile. You can find the identifier in the Azure portal, by looking for the Front Door ID value in the Overview page of your profile.

When Front Door makes a request to your origin, it adds the X-Azure-FDID request header. Your origin should inspect the header on incoming requests, and reject requests where the value doesn't match your Front Door profile's identifier.

In you web app you can set access restriction in the following manner using AzureFrontDoor.Backend service tag and X-Azure-FDID so that the web can be accessed only using your Azure Front Door profile as shown below.

Hope this helps! Please let me know if you have any additional questions. Thank you!

---

​​Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hi Matthew,

If you go into your Web app > networking > access restrictions > add an 'allow' rule, selecting service tag as the type, with a service tag for Azure Front Door. In the X-Azure-FDID you can then specify your Front Door instance so it is locked down to your instance only. See here: https://learn.microsoft.com/en-gb/azure/app-service/app-service-ip-restrictions?tabs=azurecli#restrict-access-to-a-specific-azure-front-door-instance

Then make sure you set the unmatched rule option to 'deny' ion your main site access restrictions, so you can no longer browse directly to the web app. Instead this will allow only your front door traffic to the web app.

If this helped you please mark the answer as accepted!

Answer 3

I was hoping to be able to minimize the setup and costs by having the webapp on its own. However, it does not appear possible to direct the outbound traffic without the use of a vNetwork, Security Groups, & a Default Gateway setting.

Thank you everyone for your input.