Internal private IPs are getting SNAT'd due to NAT rule in firewall

David Beitler 31

Have what I believe should be a simple question. New to Azure Firewall. In "rules (classic)" i have a NAT rule:
Allow any IP to enter on a specific public IP, get translated to an internal private IP, keeping the port the same.
Unfortunately when I add this rule, other internal private IP space servers (that also pass through the firewall) get their source IPs NAT'd, even though their destination is the private IP of the end server, and not the public one in the NAT rule.

To keep the internal ones from getting SNAT'd, I have to change the NAT rule in the firewall rule from source=any, to specific public IP addresses or spaces.

All I am needing to do is create a rule in the firewall, to allow public access to a private server. And I don't understand why the rule is getting applied, when the destination IP does not match what is in the rule.

There is not much in the firewall at the moment, as this is a new installation.

David Beitler 31 Reputation points

2021-04-28T03:25:29.98+00:00

An example:
Given the following NAT/Dnat rule:

Name=dmz
Protocol=TCP
Source Type=IP Address
Source=Any
Destination=250.2.25.21
Destination Port=7444
Translated to=10.30.3.33
Translated Port=7444

With the above rule, internal private IP traffic that passed through the firewall from 10.30.2.13 and going to 10.30.3.33 also gets source nat'd to one of the firewall private IPs
If "Source" is changed into a public IP address or range, the internal traffic stops getting source nat'd

Why does the Dnat rule affect other firewall traffic that does not have a destination of 250.2.25.21????

I need to allow public traffic in through the firewall without having to specify individual ranges, without affecting internal private IP address traffic going to the same destination..
David Beitler (A) 1 Reputation point

2021-04-30T03:49:23.267+00:00

I've looked at this again. And it is definitely converting the Source IP address, when coming from a private IP, to a private IP unless I change the NAT rule for the source to be from specific public IP address spaces. I've read numerous times in various documentation that Private IP address should not get source NATd. but they are. If someone could at least let me know how to raise this issue with support, I really need to find a solution to this (portal support page does not seem to support issues regarding Azure Firewall). I have a port that I need to open up to the Internet, going to an internal server, and while I can think of a couple of workarounds, but none of them are really acceptable true solutions.

2 answers

Pablo Varela 6 Reputation points

2022-06-27T13:29:44.813+00:00

The same issue is happening to us with public IP addresses.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
GitaraniSharma-MSFT 49,481 Reputation points Microsoft Employee

2021-05-03T10:04:24.43+00:00

Hello @David Beitler ,

Apologies for the delay in response. Thank you for reaching out & hope you are doing well.

This was found to be a known issue already identified by Azure Firewall Product Group team and they are working on the fix but we do not have a definite ETA.

Symptom:
DNAT Rules don't seem to be working as expected in Azure Firewall, Source NAT is applied to private IPs when DNAT rule has source IP as a wildcard.

Workaround:
For now, the workaround is to add "Public IP Range" as the source (everything minus private ranges) as you are doing it.

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
David Beitler (A) 1 Reputation point

2021-05-03T13:56:14.067+00:00

The workaround works for small groups of public IP ranges. But I don't see a way to add the larger public space. Shame I can't use the Internet service tag. Is there a simple way to manually add the public IP ranges as the source, and just exclude the private ranges. Sort of like saying, everything "but" the private space. Basically we just need to exclude the 10/8 private space for now.

GitaraniSharma-MSFT 49,481 Reputation points Microsoft Employee

2021-05-03T14:39:48.56+00:00

Hello @David Beitler ,

Let me check with Azure Firewall PG on this and get back to you with an update.

Thanks,
Gita

GitaraniSharma-MSFT 49,481 Reputation points Microsoft Employee

2021-05-12T14:07:04.16+00:00

Hello @David Beitler ,

Apologies for the delay in my response.

Below is the update from PG team:

This issue is a by-design approach. Unfortunately, we don’t support a source range called “Internet”. However, there is a plan to support integration with Virtual Router and perhaps we can add “Internet” service tag with this feature.

For now, you can consider creating an IPGroup resource to represent the list of IP Prefixes.
Refer: https://learn.microsoft.com/en-us/azure/firewall/ip-groups

Thanks,
Gita

GitaraniSharma-MSFT 49,481 Reputation points Microsoft Employee

2021-05-25T13:16:13.563+00:00

Hello @David Beitler , do you have any updates on my last comment?

GitaraniSharma-MSFT 49,481 Reputation points Microsoft Employee

2021-06-01T13:43:32.33+00:00

Hello @David Beitler , any updates on this post?

Manuel Astua (Tek Experts) 0 Reputation points Microsoft Vendor

2023-03-29T23:04:27.03+00:00

Hello @GitaraniSharma-MSFT may I know if this issue is resolved or not. Is still necessary the workaround?

GitaraniSharma-MSFT 49,481 Reputation points Microsoft Employee

2023-03-30T05:26:04.77+00:00

Hello @Manuel Astua (Tek Experts) , this is still a limitation and is documented in the Azure Firewall Known issues section as below:
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Internal private IPs are getting SNAT'd due to NAT rule in firewall

2 answers

Your answer