How would I allow connections from my V-NET hosts to .azurewebsites.net/?

Question

How would I allow connections from my V-NET hosts to .azurewebsites.net/?

JohnSebastian-3934 556

I've tried using a Network rule that allows traffic to AppService tag. My clients in the V-NET attempt to connect to something.azurewebsites.net/restofpath

So far I just get 403 errors.

ChaitanyaNaykodi-MSFT 27,666 Reputation points Microsoft Employee Moderator

2024-03-05T00:51:04.7266667+00:00

@JohnSebastian-3934

Thank you for reaching out.

Using Azure Firewall you can implement application rules to allow a particular FQDN as shown here.

Using service tag for AppService does allow communication to IP addresses used by an Azure Web App but depending on how the web app is designed there can be redirects lets suppose to Azure Entra for authentication etc. which will not work with Network rules.

I think it will help if you can run a fiddler trace for the web app and determine if any access to any other FQDNs is required.

Please let me know if you have any other question. Thank you!
JohnSebastian-3934 556 Reputation points

2024-03-05T14:18:02.59+00:00

Thank you. Yes I am using Azure Firewall with an Application Rule. In the rule I have the following FQDNs specified: .microsoft.com,login.microsoftonline.com,.azurewebsites.net

I'm still unable to reach the App Services web application.
ChaitanyaNaykodi-MSFT 27,666 Reputation points Microsoft Employee Moderator

2024-03-08T04:31:48.98+00:00
@JohnSebastian-3934

Thank you for getting back and apologies for the delay here.I understand that you have already defined application rule allowing specific FQDN's

In order to troubleshoot it will help if you could run the query below to look for logs within

AZFWNetworkRule and AZFWApplicationRule table, this way you will get to know if any network rule is blocking the connectivity or any other FQDN needs to be added to the

AZFWNetworkRule | where Action contains "Deny" | where DestinationPort == "443"

AZFWApplicationRule | where Action contains "Deny"

Please let me know if you have any questions. Thank you!

Your answer

ChaitanyaNaykodi-MSFT 27,666 Reputation points Microsoft Employee Moderator

2024-03-05T00:51:04.7266667+00:00

@JohnSebastian-3934

Thank you for reaching out.

Using Azure Firewall you can implement application rules to allow a particular FQDN as shown here.

Using service tag for AppService does allow communication to IP addresses used by an Azure Web App but depending on how the web app is designed there can be redirects lets suppose to Azure Entra for authentication etc. which will not work with Network rules.

I think it will help if you can run a fiddler trace for the web app and determine if any access to any other FQDNs is required.

Please let me know if you have any other question. Thank you!
JohnSebastian-3934 556 Reputation points

2024-03-05T14:18:02.59+00:00

Thank you. Yes I am using Azure Firewall with an Application Rule. In the rule I have the following FQDNs specified: .microsoft.com,login.microsoftonline.com,.azurewebsites.net

I'm still unable to reach the App Services web application.
ChaitanyaNaykodi-MSFT 27,666 Reputation points Microsoft Employee Moderator

2024-03-08T04:31:48.98+00:00

@JohnSebastian-3934

Thank you for getting back and apologies for the delay here.I understand that you have already defined application rule allowing specific FQDN's

In order to troubleshoot it will help if you could run the query below to look for logs within

AZFWNetworkRule and AZFWApplicationRule table, this way you will get to know if any network rule is blocking the connectivity or any other FQDN needs to be added to the

AZFWNetworkRule | where Action contains "Deny" | where DestinationPort == "443"

AZFWApplicationRule | where Action contains "Deny"

Please let me know if you have any questions. Thank you!

Share via

How would I allow connections from my V-NET hosts to *.azurewebsites.net/*?