How to route cross-tenant traffic through Azure Firewall to Azure Event Hub (FQDN required, Private Endpoint ruled out)

Question

Hi all,

We are currently exploring secure cross-tenant connectivity to an Azure Event Hub instance, and we would appreciate guidance on the best way to route traffic through Azure Firewall.

Current Setup:

• Azure Event Hub is deployed in Tenant A and currently accessible via its public endpoint (<namespace>.servicebus.windows.net)

We are able to connect to it from a VM in Tenant B when the public IP is whitelisted in the Azure Event Hub's integrated firewall

However, for security and logging purposes, we would prefer to route traffic through Azure Firewall in Tenant A, instead of allowing direct public access

Constraints:

Private Endpoint is ruled out

VNet Peering and Site-to-Site VPN are also not allowed due to network segregation policies

We attempted to create a DNAT rule in Azure Firewall, forwarding traffic from its public IP to the Event Hub FQDN on port 5671 (AMQP over TLS). While the TCP connection works, the SSL handshake fails — likely because Event Hub expects the client to connect using its original FQDN due to TLS certificate name validation.

Questions:

1. Is there any supported way to force traffic from Tenant B to go through Azure Firewall to access the Event Hub in Tenant A, ?
2. Is it possible to assign a public FQDN to Azure Firewall (e.g., via Azure DNS or public domain), and use it to forward traffic transparently to Event Hub?

---

Addiitonally what are all the Security Measures can be considered part of using Azure eventhub integrated firewall We considered so far:

Enforce TLS 1.2+ on all Event Hub communications

Use SAS tokens scoped by namespace or Event Hub

Restrict source IPs in Event Hub firewall (only trusted IPs)

• Enable diagnostic logs to Log Analytics / Sentinel Any guidance or alternative architecture recommendations would be highly appreciated.

Answer 1

Hello @Suki Azure

In addition to Suwarna S Kale's response, I am adding a few points as outlined below.

As you mentioned that you want to connect Azure Event Hub in Tenant A from a VM in Tenant B through Azure Firewall in Tenant A, the recommended approach is to create a User Defined Route (0.0.0.0/0 -> Next Hop to Azure Firewall) on the VM Subnet in Tenant B. This will force the traffic to Azure Firewall in Tenant A via VNet peering. Additionally, create an application rule on the Azure Firewall to allow the traffic to Azure Event Hub.

Since you mentioned that Private Endpoint, VNet Peering, and Site-to-Site VPN are not allowed due to network segregation policies, creating a DNAT rule in Azure Firewall and forwarding the traffic from the VM public IP to the Event Hub FQDN through the Firewall would be the best option.

However, I replicated the same scenario and successfully connected to the Azure Event Hub using the Azure Firewall DNAT rule, as shown in the screenshot below.

Azure Firewall DNAT Rule

You need to configure your own DNS server on the VNet to forward DNS queries to the appropriate endpoint. I used the Host file on the Azure VM to test this scenario.


Whitelisted Azure Firewall public IP on the Azure Event Hub

To enhance security, consider adding layers such as IP whitelisting and SAS token authentication, alongside logging to Azure Monitor or Azure Sentinel.

Regarding general security for Azure Event Hub, your current measures (TLS enforcement, SAS token usage, IP restriction, enabling Azure Defender for threat detection, implementing NSGs to restrict access, using Service Tags for firewall rules, and logging) are robust.

Refer these articles:

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design
https://learn.microsoft.com/en-us/azure/sentinel/connect-services-diagnostic-setting-based

I hope this has been helpful!

If above is unclear and/or you are unsure about something add a comment below.

---

Please click "Accept" the answer, if any answer/reply helped, so that others in the community facing similar issues can easily find the solution. This can be beneficial to other community members.

Answer 2

Hello Suki Azure,

Thank you for posting your question in the Microsoft Q&A forum. 

To enable secure access from Tenant B to Event Hub in Tenant A while routing traffic through Azure Firewall, consider a DNS-based forwarding approach with SNI preservation. Assign a custom public FQDN (e.g., eventhub-proxy.contoso.com) to Azure Firewall’s public IP and configure Layer 7 application rules (not DNAT) to forward traffic to Event Hub’s original FQDN (namespace.servicebus.windows.net) while preserving the TLS handshake. This ensures certificate validation succeeds without exposing Event Hub directly. 

If SNI preservation is insufficient, deploy a reverse proxy (Nginx/HAProxy) behind Azure Firewall to terminate and re-encrypt TLS while rewriting the Host header. For enhanced security, combine this with IP whitelisting, SAS token authentication, and Azure Sentinel logging. While Private Link or ExpressRoute would be ideal, they are ruled out here making DNS-based routing with Azure Firewall the most viable option. Always validate performance impact and compliance requirements before implementation.

For detailed guidance, refer to Microsoft’s documentation below:

https://learn.microsoft.com/en-us/azure/firewall/features#application-fqdn-filtering

https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/event-hubs-security-baseline

If the above answer helped, please do not forget to "Accept Answer" as this may help other community members to refer the info if facing a similar issue. Your contribution to the Microsoft Q&A community is highly appreciated.