How to Set-up Outbound Firewall in Windows to Block All Outbound Connections Except the DataGateway?

Question

I am attempting to configure outbound firewall rules to block all outbound connections except those required for the Microsoft Fabric Data Gateway to function. However, I am encountering the following challenges:

1. Identifying Specific IP Ranges for Data Gateway:
   • The JSON file provided for Azure service IP ranges (link) appears too broad and does not explicitly detail the IP ranges required for the Fabric Data Gateway.
   • Since IP allocation may depend on the geographical region of my license or resource deployment, I need guidance on how to pinpoint the specific IP ranges necessary for the Data Gateway in my region.
2. Firewall Rule Configuration Priority:
   • When configuring Windows Firewall, I have found that broader "Block all outbound connections" rules often override specific "Allow connections" rules.
   • To mitigate this, I considered manually blocking all IPs except for the necessary IP ranges by splitting the blocked ranges (e.g., blocking 0.0.0.0 to just before the required IP and then blocking from just after the required IP to the end of the range). Is there an alternative or more efficient approach to achieve this?

Answer 1

To set up an outbound firewall in Windows to block all outbound connections except for your Data Gateway, follow these steps:

Open Windows Firewall with Advanced Security:

Press Win + S and type "Windows Firewall with Advanced Security", then select it from the search results.

Configure Outbound Rules:

  In the left panel, select "Outbound Rules".
  
     Click on "New Rule..." in the right panel.
     

1. Create a New Rule:

Select "Program" and click "Next".

Select "This program path" and click "Browse".

• Navigate to the executable file of your Data Gateway and select it, then click "Next".

Allow the Connection:

  Select "Allow the connection" and click "Next".
  
  **Apply the Rule to All Profiles**:
  
     Select all three profiles (Domain, Private, and Public) and click "Next".
     
        Give your rule a name (e.g., "Allow DataGateway") and click "Finish".
        
        **Block All Other Outbound Connections**:
        
           Go back to the main "Outbound Rules" section.
           
              Right-click on the "All Programs" rule and select "Properties".
              
                 Change the action to "Block the connection" and click "OK".
                 
                 **Enable Logging (Optional)**:
                 
                    Right-click on the "All Programs" rule and select "Properties".
                    
                       Go to the "General" tab and check "Log" to enable logging for successful connections.
                       

This setup will block all outbound connections except for those made by your DataGateway. If you encounter any issues, feel free to ask for more help!