Azure Firewall SNAT private IP address ranges

Azure Firewall provides SNAT capability for all outbound traffic to public IP addresses. By default, Azure Firewall doesn't use SNAT with network rules when the destination IP address is in a private IP address range per IANA RFC 1918 or shared address space per IANA RFC 6598. Application rules always use SNAT through a transparent proxy regardless of the destination IP address.

This default behavior is suitable when routing traffic directly to the Internet. However, there are scenarios where you might need to override the default SNAT behavior:

• If you enable forced tunneling, Azure Firewall SNATs Internet-bound traffic to one of the firewall's private IP addresses in AzureFirewallSubnet, hiding the source from your on-premises firewall.
• If your organization uses registered IP address ranges outside of IANA RFC 1918 or IANA RFC 6598 for private networks, Azure Firewall SNATs the traffic to one of the firewall's private IP addresses in AzureFirewallSubnet. You can configure Azure Firewall to not SNAT your public IP address range. For example, specify an individual IP address as x.x.x.x or a range of IP addresses as x.x.x.x/24.

You can change Azure Firewall SNAT behavior in the following ways:

• To configure Azure Firewall to never SNAT traffic processed by network rules regardless of the destination IP address, use 0.0.0.0/0 as your private IP address range. With this configuration, Azure Firewall can't route traffic directly to the Internet.
• To configure the firewall to always SNAT traffic processed by network rules regardless of the destination address, use 255.255.255.255/32 as your private IP address range.
• To configure Azure Firewall to automatically learn registered and private IP address ranges at regular intervals, enable auto-learn SNAT routes. Learned address ranges are treated as internal and traffic destined to these ranges isn't SNATed.

Important

• The private address range configuration only applies to network rules. Application rules always use SNAT.
• If you want to specify your own private IP address ranges and keep the default IANA RFC 1918 address ranges, make sure your custom list still includes the IANA RFC 1918 range.

The following table shows the supported configuration methods. Firewalls associated with a firewall policy must specify the range in the policy and not use AdditionalProperties.

Method	Classic rules	Firewall policy
Azure PowerShell	Supported	Not supported
Azure CLI	Supported	Not supported
ARM template	Supported	Supported
Azure portal	Supported	Supported

Configure SNAT private IP address ranges

Choose your configuration method. Azure PowerShell and Azure CLI only support classic rules. To configure SNAT ranges with a firewall policy, use an ARM template or the Azure portal.

Azure PowerShell

Use Azure PowerShell to specify private IP address ranges for the firewall.

Note

The firewall PrivateRange property is ignored for firewalls associated with a Firewall Policy. You must use the SNAT property in firewallPolicies as described on the ARM template tab.

New firewall

For a new firewall that uses classic rules, create the firewall by using New-AzFirewall:

$azFw = @{
   Name               = '<fw-name>'
   ResourceGroupName  = '<resourcegroup-name>'
   Location           = '<location>'
   VirtualNetworkName = '<vnet-name>'
   PublicIpName       = '<public-ip-name>'
   PrivateRange       = @("IANAPrivateRanges", "192.168.1.0/24", "192.168.1.10")
}

New-AzFirewall @azFw

Note

• Deploying Azure Firewall by using New-AzFirewall requires an existing virtual network and public IP address. For a full deployment guide, see Deploy and configure Azure Firewall using Azure PowerShell.
• IANAPrivateRanges expands to the current defaults on Azure Firewall while the other ranges are added to it. To keep the IANAPrivateRanges default in your private range specification, it must remain in your PrivateRange specification as shown in the example.

Existing firewall

To configure an existing firewall that uses classic rules, get the firewall by using Get-AzFirewall and update it by using Set-AzFirewall:

$azfw = Get-AzFirewall -Name '<fw-name>' -ResourceGroupName '<resourcegroup-name>'
$azfw.PrivateRange = @("IANAPrivateRanges", "192.168.1.0/24", "192.168.1.10")
Set-AzFirewall -AzureFirewall $azfw

Azure CLI

Use Azure CLI to specify private IP address ranges for the firewall.

Note

The CLI --private-ranges option only applies to firewalls that use classic rules. For firewalls associated with a firewall policy, use an ARM template or the Azure portal to configure SNAT ranges.

New firewall

For a new firewall that uses classic rules, create the firewall by using az network firewall create:

az network firewall create \
-n <fw-name> \
-g <resourcegroup-name> \
--private-ranges 192.168.1.0/24 192.168.1.10 IANAPrivateRanges

Note

• Deploying Azure Firewall by using the Azure CLI command az network firewall create requires extra configuration steps to create public IP addresses and IP configuration. For a full deployment guide, see Deploy and configure Azure Firewall using Azure CLI.
• Azure Firewall expands IANAPrivateRanges to the current defaults and adds the other ranges to it. To keep the IANAPrivateRanges default in your private range specification, include it in your private-ranges specification as shown in the example.

Existing firewall

To configure an existing firewall that uses classic rules, update the firewall by using az network firewall update:

az network firewall update \
-n <fw-name> \
-g <resourcegroup-name> \
--private-ranges 192.168.1.0/24 192.168.1.10 IANAPrivateRanges

ARM template

Classic rules

To configure SNAT during ARM template deployment, add the following code to the additionalProperties property:

"additionalProperties": {
   "Network.SNAT.PrivateRanges": "IANAPrivateRanges, IPRange1, IPRange2"
},

Firewall policy

Azure Firewalls associated with a firewall policy support SNAT private ranges starting with API version 2020-11-01. Use a template to update the SNAT private range on the Firewall Policy. The following sample configures the firewall to always SNAT network traffic:

{
   "type": "Microsoft.Network/firewallPolicies",
   "apiVersion": "2024-05-01",
   "name": "[parameters('firewallPolicies_DatabasePolicy_name')]",
   "location": "eastus",
   "properties": {
      "sku": {
         "tier": "Standard"
      },
      "snat": {
         "privateRanges": "[255.255.255.255/32]"
      }
   }
}

Azure portal

Classic rules

Use the Azure portal to specify private IP address ranges for the firewall.

1. Select your resource group, and then select your firewall.

2. On the Overview pane, under Private IP Ranges, select the default value IANA RFC 1918.

   The Edit Private IP Prefixes page opens:

3. By default, Azure Firewall configures IANAPrivateRanges.

4. Edit the private IP address ranges for your environment and then select Save.

Firewall policy

1. Select your resource group, and then select your firewall policy.
2. Select Private IP ranges (SNAT) in the Settings column.
3. Select the conditions to perform SNAT for your environment under Perform SNAT to customize the SNAT configuration.
4. Select Apply.

Auto-learn SNAT routes

You can configure Azure Firewall to auto-learn both registered and private ranges every 30 minutes. These learned address ranges are internal to the network, so traffic to destinations in the learned ranges isn't SNATed. Both virtual network (VNet) deployments and secured virtual hub (vHub) deployments support auto-learn SNAT routes.

Note

• Auto-learn SNAT requires Azure Firewall to be associated with Azure Route Server.
• For VNet deployments, you must deploy Azure Route Server in the same virtual network as Azure Firewall.
• For vHub deployments, Azure Route Server is already deployed and associated by default.
• For both deployment models, you must enable auto-learn SNAT in the Azure Firewall Policy after the association is complete.
• For more information about Azure Firewall architecture options, see What are the Azure Firewall Manager architecture options?

VNet firewall

For VNet deployments, you need to deploy and associate Azure Route Server before enabling auto-learn SNAT routes.

Prerequisites:

• A subnet named RouteServerSubnet in your firewall virtual network with a size of at least /27.
• Azure Route Server deployed in the same virtual network as your firewall. For deployment steps, see Quickstart: Create and configure Route Server by using the Azure portal.

Azure CLI

Azure CLI doesn't support configuring auto-learn SNAT routes. Use an ARM template, Azure PowerShell, or the Azure portal.

ARM template

Use the following JSON to enable auto-learn in a firewall policy:

{
   "type": "Microsoft.Network/firewallPolicies",
   "apiVersion": "2024-05-01",
   "name": "[parameters('firewallPolicies_DatabasePolicy_name')]",
   "location": "eastus",
   "properties": {
      "sku": {
         "tier": "Standard"
      },
      "snat": {
         "autoLearnPrivateRanges": "Enabled"
      }
   }
}

Use the following JSON to associate an Azure Route Server with the firewall:

{
   "type": "Microsoft.Network/azureFirewalls",
   "apiVersion": "2024-05-01",
   "name": "[parameters('azureFirewalls_testFW_name')]",
   "location": "eastus",
   "properties": {
      "sku": {
         "name": "AZFW_VNet",
         "tier": "Standard"
      },
      "threatIntelMode": "Alert",
      "additionalProperties": {
         "Network.RouteServerInfo.RouteServerID": "[parameters('virtualHubs_TestRouteServer_externalid')]"
      }
   }
}

Azure PowerShell

In the following examples, replace the variable names ($azureFirewallName, $rgname, $location, etc.) with your own values.

1. Create a new firewall with a Route Server ID by using New-AzFirewall.

   # Specify the Route Server resource ID
   $routeServerId="/subscriptions/your_sub/resourceGroups/testRG/providers/Microsoft.Network/virtualHubs/TestRS"
   
   # Create the firewall
   $azureFirewall = New-AzFirewall -Name $azureFirewallName `
       -ResourceGroupName $rgname `
       -Location $location `
       -RouteServerId $routeServerId
   
   # Verify the Route Server ID is set
   Get-AzFirewall -Name $azureFirewallName -ResourceGroupName $rgname
   

2. Associate a Route Server with an existing firewall by using Get-AzFirewall and Set-AzFirewall.

   # Specify the Route Server resource ID
   $routeServerId="/subscriptions/your_sub/resourceGroups/testRG/providers/Microsoft.Network/virtualHubs/TestRS"
   
   # Get the firewall
   $azFirewall = Get-AzFirewall -Name $azureFirewallName -ResourceGroupName $rgname
   
   # Associate the Route Server and update the firewall
   $azFirewall.RouteServerId = $routeServerId
   Set-AzFirewall -AzureFirewall $azFirewall
   
   # Verify the Route Server ID is updated
   Get-AzFirewall -Name $azureFirewallName -ResourceGroupName $rgname
   

3. Create a new firewall policy with auto-learn enabled by using New-AzFirewallPolicySnat and New-AzFirewallPolicy.

   # Include AutoLearnPrivateRange to enable auto-learn
   $snat = New-AzFirewallPolicySnat -PrivateRange $privateRange -AutoLearnPrivateRange
   
   # Create the firewall policy with SNAT configuration
   $azureFirewallPolicy = New-AzFirewallPolicy -Name $azureFirewallPolicyName `
       -ResourceGroupName $rgname `
       -Location $location `
       -Snat $snat
   
   # Verify the firewall policy
   Get-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname
   

4. Update an existing firewall policy with SNAT by using New-AzFirewallPolicySnat and Set-AzFirewallPolicy.

   $snat = New-AzFirewallPolicySnat -PrivateRange $privateRange2 -AutoLearnPrivateRange
   
   # Update the firewall policy
   $azureFirewallPolicy.Snat = $snat
   Set-AzFirewallPolicy -InputObject $azureFirewallPolicy
   
   # Verify the update
   Get-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname
   

5. Verify the learned prefixes by using Get-AzFirewallLearnedIpPrefix.

   Get-AzFirewallLearnedIpPrefix -Name $azureFirewallName -ResourceGroupName $rgname
   

Azure portal

To configure auto-learn SNAT routes on your VNet firewall by using the Azure portal:

1. Select your firewall, and then select Learned SNAT IP Prefixes. Add the route server.
2. Select your firewall policy, and then select Private IP ranges (SNAT). Enable Auto-learn IP prefixes, and then select Apply.
3. To verify, go back to your firewall and select Learned SNAT IP Prefixes to view the learned routes.

vHub firewall

For vHub deployments, Azure Route Server is already deployed and associated by default. You only need to enable auto-learn in your firewall policy.

Azure CLI

Azure CLI doesn't support configuring auto-learn SNAT routes. Use an ARM template, Azure PowerShell, or the Azure portal.

ARM template

Use the following JSON to enable auto-learn in a firewall policy. For vHub deployments, you don't need to manually associate Azure Route Server.

{
   "type": "Microsoft.Network/firewallPolicies",
   "apiVersion": "2024-05-01",
   "name": "[parameters('firewallPolicies_DatabasePolicy_name')]",
   "location": "eastus",
   "properties": {
      "sku": {
         "tier": "Standard"
      },
      "snat": {
         "autoLearnPrivateRanges": "Enabled"
      }
   }
}

Azure PowerShell

In the following examples, replace the variable names ($azureFirewallName, $rgname, $location, etc.) with your own values.

1. Create a new firewall policy with auto-learn enabled by using New-AzFirewallPolicySnat and New-AzFirewallPolicy.

   # Include AutoLearnPrivateRange to enable auto-learn
   $snat = New-AzFirewallPolicySnat -PrivateRange $privateRange -AutoLearnPrivateRange
   
   # Create the firewall policy with SNAT configuration
   $azureFirewallPolicy = New-AzFirewallPolicy -Name $azureFirewallPolicyName `
       -ResourceGroupName $rgname `
       -Location $location `
       -Snat $snat
   
   # Verify the firewall policy
   Get-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname
   

2. Update an existing firewall policy with SNAT by using New-AzFirewallPolicySnat and Set-AzFirewallPolicy.

   $snat = New-AzFirewallPolicySnat -PrivateRange $privateRange2 -AutoLearnPrivateRange
   
   # Update the firewall policy
   $azureFirewallPolicy.Snat = $snat
   Set-AzFirewallPolicy -InputObject $azureFirewallPolicy
   
   # Verify the update
   Get-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname
   

3. Get the virtual hub by using Get-AzVirtualHub and the firewall policy by using Get-AzFirewallPolicy.

   $Hub = Get-AzVirtualHub -ResourceGroupName $rgname -Name $virtualHubName
   $azureFirewallPolicy = Get-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname
   

4. Create a public IP configuration by using New-AzFirewallHubPublicIpAddress and New-AzFirewallHubIpAddress.

   $azureFirewallPIPs = New-AzFirewallHubPublicIpAddress -Count 1
   $azureFirewallHubIPs = New-AzFirewallHubIpAddress -PublicIP $azureFirewallPIPs
   

5. Create the vHub firewall with the auto-learn policy by using New-AzFirewall.

   $azureFirewall = New-AzFirewall -Name $azureFirewallName `
       -ResourceGroupName $rgname `
       -Location $location `
       -VirtualHubId $Hub.Id `
       -FirewallPolicyId $azureFirewallPolicy.Id `
       -SkuName "AZFW_Hub" `
       -HubIPAddress $azureFirewallHubIPs `
       -SkuTier $FirewallTier
   

6. Verify the learned prefixes by using Get-AzFirewallLearnedIpPrefix.

   Get-AzFirewallLearnedIpPrefix -Name $azureFirewallName -ResourceGroupName $rgname
   

Azure portal

Because Azure Route Server is already deployed in secured virtual hub environments, you only need to enable the feature in your firewall policy:

1. Select your firewall policy, and then select Private IP ranges (SNAT). Enable Auto-learn IP prefixes, and then select Apply.
2. To verify, go back to your firewall and select Learned SNAT IP Prefixes to view the learned routes.

Next steps

• Azure Firewall forced tunneling
• What is Azure Route Server?
• What are the Azure Firewall Manager architecture options?