Azure Firewall SNAT one-to-one

Question

Azure Firewall SNAT one-to-one

Anonymous

Hello,

I have an Azure firewall configured with one public IP address. But I need to do a SNAT one-to-one for a particular server that must has another public IP address in addition to the already configured public IP address of the AZ FW.

This feature is available on AZ FW?

Regards,

Rogerio.

Anonymous

2025-05-29T08:25:08.7833333+00:00

Hello Sai,

Thank you for your quick and precise answer.

Microsoft has any date on roadmap to release this SNAT one-to-one feature?

Regards,

Rogerio.
Anonymous

2025-05-29T08:41:36.91+00:00

Hi @Ferreira, Rogério

Unfortunately, it is not on the roadmap at the moment as we have NAT gateway and SLB as workarounds.

But I would suggest you post this idea at the Azure Feedback Portal, which is monitored by the product team for feature enhancements.

If the above helps, please take a moment to click 'Accept answer'.If you still have questions, please let us know what is needed in the comments so the question can be answered.
Anonymous

2025-05-29T08:54:15.3333333+00:00

Hi Sai,

I'm working for several years in networking, but its first time I work with Azure. And I don't know if I can continue the discussion in this thread on open a new one. Please clarify me.

But NAT Gateway doesn't allow inbound traffic.

Load balancers I'm not sure will solve my problem.

But a simple question: how can we inspect the inbound traffic to a particular internal server, we can have multiple servers (not web servers) without exposing them with a public IP address.

Regards,

Rogerio.
Anonymous

2025-05-29T09:21:21.56+00:00
Hi @Ferreira, Rogério

Your Azure Firewall, with its public IP address, can receive inbound traffic from the internet. You configure DNAT rules on the Azure Firewall. These rules translate the public IP address and port to the private IP address and port of your specific internal server. This way, external clients connect to the Firewall's public IP, and the Firewall forwards the traffic to your internal server's private IP. Your internal server never sees the internet directly.

The Azure Firewall itself provides extensive logging capabilities. You can send these logs to Azure Log Analytics. These logs will show you:

Source IP addresses of incoming connections.

Destination IP (the Firewall public IP) and port.

Translated destination IP (your internal server private IP) and port.

Whether the connection was allowed or denied by the Firewall rules.

You also define Network Rules on the Firewall to explicitly allow or deny inbound traffic based on source IP, destination IP (your server private IP), and port. This provides granular control and logging.

While not directly for inbound traffic from the internet to your application, a bastion host is important for your secure administrative access to these internal servers. You connect to the bastion host, and from there, you establish connections to your internal servers using their private IP addresses.

On the bastion host, you can run packet capture tools like tcpdump. If you need to inspect traffic originating from a specific external source that is reaching your internal server via the Firewall DNAT, you can initiate a tcpdump on the internal server itself.

The NSG are applied to network interfaces or subnets where your internal servers reside, while NSGs primarily filter traffic, you can enable NSG Flow Logs for the subnets containing your internal servers. These logs provide metadata about all IP traffic flowing through the NSG rules, including:

Source and destination IPs.

Source and destination ports.

Protocol.

Traffic direction.

Whether traffic was allowed or denied.

If all your questions about the posted issue have been answered, please take a moment to click 'Accept answer' so that other community members facing the same issues can find the right answers.

Answer accepted by question author

0 additional answers

Your answer

Anonymous

2025-05-29T08:25:08.7833333+00:00

Hello Sai,

Thank you for your quick and precise answer.

Microsoft has any date on roadmap to release this SNAT one-to-one feature?

Regards,

Rogerio.
Anonymous

2025-05-29T08:41:36.91+00:00

Hi @Ferreira, Rogério

Unfortunately, it is not on the roadmap at the moment as we have NAT gateway and SLB as workarounds.

But I would suggest you post this idea at the Azure Feedback Portal, which is monitored by the product team for feature enhancements.

If the above helps, please take a moment to click 'Accept answer'.If you still have questions, please let us know what is needed in the comments so the question can be answered.
Anonymous

2025-05-29T08:54:15.3333333+00:00

Hi Sai,

I'm working for several years in networking, but its first time I work with Azure. And I don't know if I can continue the discussion in this thread on open a new one. Please clarify me.

But NAT Gateway doesn't allow inbound traffic.

Load balancers I'm not sure will solve my problem.

But a simple question: how can we inspect the inbound traffic to a particular internal server, we can have multiple servers (not web servers) without exposing them with a public IP address.

Regards,

Rogerio.

Answer 1

Hi @Ferreira, Rogério

It sounds like you're looking to configure a one-to-one SNAT for a specific server in your Azure Firewall setup, allowing it to use a different public IP address alongside the existing one.

Currently, Azure Firewall supports SNAT but it typically SNATs all outbound traffic to its public IP address. In projects with multiple public IP addresses, any public IP can be chosen for outbound connections, and it doesn’t support individual SNAT setups for distinct servers directly.

However, if you need a more granular setup, you might want to consider integrating an Azure NAT Gateway. Here's how it could help you out:

Use NAT Gateway: You can associate a NAT Gateway with your virtual network/subnet alongside the Azure Firewall. This gateway allows for multiple public IP addresses and can allocate SNAT ports dynamically for outbound connections, giving you greater flexibility.

Configuration: Once a NAT Gateway is associated with the Azure Firewall subnet, all outbound internet traffic will utilize the public IP addresses of the NAT Gateway for SNAT. However, the selection of which public IP is used for each session is randomized, meaning you can’t explicitly assign a single public IP to a specific internal server.

Limitations: If a one-to-one mapping is critical, you may need to look into using a Load Balancer or another architecture as NAT Gateway doesn't provide static IP assignment per server for outbound traffic.

For detailed steps on how to integrate a NAT Gateway with Azure Firewall, you can refer to this documentation.

If the "one-to-one SNAT" requirement is specifically for inbound traffic and then outbound responses related to an application (e.g., a web server), you might consider using a Standard Load Balancer with outbound rules. This can expose a public IP and manage connections to backend servers. However, this is for application-specific scenarios, not general outbound internet access from a server.

Your feedback is important so please take a moment to click 'Accept answer'.

If you still have questions, please let us know what is needed in the comments so the question can be answered.

Anonymous

2025-05-30T08:01:13.7733333+00:00

Hi Sai,

A great thanks for all your support.

Rogerio.