Azure VM Access to the Internet via Azure Firewall

Question

Dear Azure Team

I am very careful to mess around with our firewalls. We have a number of private VMs in a subnet. The subnet is protected by firewall and there is no direct access to the internet. There is one server in this subnet that needs to connect to the internet. The server is not allowed to move away from the subnet. How can I get this done without causing disruption to the existing settings. Below is my routes and 10.10.22.4 is the private IP of the firewall instance. This is associated with my subnet 172.18.0.0/24

Regards,
Sam

Answer 1

Hi @Seun Ore

To allow your server in the subnet to access the internet through the Azure Firewall, you need to configure a network rule on the Azure Firewall.
As your traffic is controlled by the firewall, you need to create an exception rule to allow the outbound to the internet ( DNAT)

In the Azure Firewall settings, go to Rules and then select Network rule collection.

Click on Add network rule collection.

Add a Network Rule:

Name: Provide a name for the rule collection, such as Allow-Server-Internet.

Priority: Set a priority for the rule collection. Lower numbers have higher priority.

Action: Set the action to Allow.

Name: Provide a name for the rule, such as Allow-Internet-Access.

Source: Set the source IP to the private IP address of your server.

Destination: Set the destination to * or 0.0.0.0/0 to match all internet-bound traffic.

Protocol: Select the appropriate protocols (e.g., Any, TCP, UDP) based on your requirements.

Destination Ports: Specify the destination ports (e.g., 80, 443 for HTTP and HTTPS traffic, or * for all ports).

Example Configuration:
Rule Collection Configuration:

Name: Allow-Server-Internet

Priority: 100

Action: Allow

Rule Configuration:

Name: Allow-Internet-Access

Source: 172.18.0.5 (Replace with the IP address of your server)

Destination: * (or 0.0.0.0/0)

Protocol: Any

Destination Ports: *

Reference: https://learn.microsoft.com/en-us/azure/firewall/policy-rule-sets