How do I delist our public IP range that's blocked on Azure?

Question

Our public IP range seems to be blocked from accessing Azure Web Apps. How can I delist it?

Answer 1

Hello Jaco Carlson

While you cannot directly "delist" a public IP range from being blocked from accessing Azure Web Apps, there are a few potential causes and solutions you can explore:

1. Azure Firewall:

• Check Firewall Rules: It's possible your public IP range has been accidentally blocked by an Azure Firewall rule associated with your web app.
  • Access the Azure portal and navigate to the resource group containing your web app.
    • Locate the Azure Firewall resource associated with the web app (if any).
      • Review the inbound rules and search for any rules blocking your specific public IP range.
        • If you find a blocking rule, disable it or modify it to allow access from your desired IP range.

2. Application Gateway WAF (Web Application Firewall):

• Check WAF Rules: If your web app uses an Application Gateway with a Web Application Firewall (WAF) configured, it might have rules blocking specific IP ranges, including yours.
  • Access the resource group containing your web app and locate the Application Gateway resource.
    • Under the Application Gateway, navigate to the WAF configuration.
      • Review the configured rules and search for any rules blocking your specific public IP range.
        • If you find a blocking rule, disable it or modify it to allow access from your desired IP range.

3. IP Allow List:

• Review Allow List Configuration: Some Azure Web App instances might be configured with an allow list restricting access to specific IP addresses or ranges.
  • Contact the owner or administrator of the web app to see if an allow list is in place and if your IP range can be added.

4. Temporary Blocking:

• Azure Security Measures: Azure might temporarily block IP addresses exhibiting suspicious activity to protect its services. This is usually a temporary measure, and the block should be lifted automatically after some time.
  • If you believe this might be the case, wait for some time and try accessing the web app again later.

5. Network Security Group (NSG) Rules:

• Check NSG Rules: If your web app's subnet is associated with a Network Security Group (NSG), there might be inbound rules blocking traffic from your public IP range.
  • Navigate to the resource group containing your web app and locate the NSG associated with the subnet where the web app resides.
    • Review the inbound security rules and search for any rules blocking traffic from your specific public IP range.
      • If you find a blocking rule, adjust or disable it to allow access from your desired IP range.

Recommendation:

• Start by reviewing the firewall rules, WAF configuration, and any potential allow list restrictions associated with your web app. This will help determine if a specific configuration is causing the issue and allow you to take direct action.
• If the issue persists, reach out to the owner or administrator of the web app for further assistance. They might have deeper insights into the specific security configuration and access controls in place.