Edit

Route traffic through a network virtual appliance - Azure CLI script sample

  • Article
  • 6 minutes to read

This script sample creates a virtual network with front-end and back-end subnets. It also creates a VM with IP forwarding enabled to route traffic between the two subnets. After running the script you can deploy network software, such as a firewall application, to the VM.

If you don't have an Azure subscription, create an Azure free account before you begin.

Prerequisites

Sample script

Launch Azure Cloud Shell

The Azure Cloud Shell is a free interactive shell that you can use to run the steps in this article. It has common Azure tools preinstalled and configured to use with your account.

To open the Cloud Shell, just select Try it from the upper right corner of a code block. You can also launch Cloud Shell in a separate browser tab by going to https://shell.azure.com.

When Cloud Shell opens, verify that Bash is selected for your environment. Subsequent sessions will use Azure CLI in a Bash environment, Select Copy to copy the blocks of code, paste it into the Cloud Shell, and press Enter to run it.

Sign in to Azure

Cloud Shell is automatically authenticated under the initial account signed-in with. Use the following script to sign in using a different subscription, replacing <Subscription ID> with your Azure Subscription ID. If you don't have an Azure subscription, create an Azure free account before you begin.

subscription="<subscriptionId>" # add subscription here

az account set -s $subscription # ...or use 'az login'

For more information, see set active subscription or log in interactively

Run the script

# Route traffic through NVA

# Variable block
let "randomIdentifier=$RANDOM*$RANDOM"
location="East US"
resourceGroup="msdocs-virtual-network-rg-$randomIdentifier"
tag="route-traffic-through-nva-virtual-networks"
vNet="msdocs-vNet-$randomIdentifier"
addressPrefixVNet="10.0.0.0/16"
subnetFrontEnd="msdocs-frontend-subnet-$randomIdentifier"
subnetPrefixFrontEnd="10.0.1.0/24"
nsgFrontEnd="msdocs-nsg-frontend-$randomIdentifier"
subnetBackEnd="msdocs-backend-subnet-$randomIdentifier"
subnetPrefixBackEnd="10.0.2.0/24"
dmzSubnet="msdocs-dmz-$randomIdentifier"
dmzPrefix="10.0.0.0/24"
publicIpFirewall="msdocs-publicIpFirewall-$randomIdentifier"
nicFirewall="msdocs-nic-firewall-$randomIdentifier"
vmFirewall="msdocs-vm-$randomIdentifier"
sku="BASIC"
image="UbuntuLTS"
login="azureuser"
routeTableFrontEndSubnet="msdocs-route-table-frontend-subnet-$randomIdentifier"
routeToBackEnd="msdocs-route-backend-$randomIdentifier"
routeToInternetFrontEnd="msdocs-route-internet-frontend-$randomIdentifier"
routeToInternetPrefix="0.0.0.0/0"
routeTableBackEndSubnet="msdocs-route-table-backend-subnet-$randomIdentifier"
routeToFrontEnd="msdocs-route-frontend-$randomIdentifier"
routeToInternetBackEnd="msdocs-route-internet-backend-$randomIdentifier"

echo "Using resource group $resourceGroup with login: $login"

# Create a resource group
echo "Creating $resourceGroup in $location..."
az group create --name $resourceGroup --location "$location" --tags $tag

# Create a virtual network and a front-end subnet.
echo "Creating $vNet and $subnetFrontEnd"
az network vnet create --resource-group $resourceGroup --name $vNet --address-prefix $addressPrefixVNet  --location "$location" --subnet-name $subnetFrontEnd --subnet-prefix $subnetPrefixFrontEnd

# Create a network security group (NSG) for the front-end subnet.
echo "Creating $nsgFrontEnd for $subnetFrontEnd"
az network nsg create --resource-group $resourceGroup --name $nsgFrontEnd --location "$location"

# Create NSG rules to allow HTTP & HTTPS traffic inbound.
echo "Creating NSG rules in $nsgFrontEnd to allow HTTP and HTTPS inbound traffic"
az network nsg rule create --resource-group $resourceGroup --nsg-name $nsgFrontEnd --name Allow-HTTP-All --access Allow --protocol Tcp --direction Inbound --priority 100 --source-address-prefix Internet --source-port-range "*" --destination-address-prefix "*" --destination-port-range 80
az network nsg rule create --resource-group $resourceGroup --nsg-name $nsgFrontEnd --name Allow-HTTPS-All --access Allow --protocol Tcp --direction Inbound --priority 200 --source-address-prefix Internet --source-port-range "*" --destination-address-prefix "*" --destination-port-range 443

# Associate the front-end NSG to the front-end subnet.
echo "Associate $nsgFrontEnd to $subnetFrontEnd"
az network vnet subnet update --vnet-name $vNet --name $subnetFrontEnd --resource-group $resourceGroup --network-security-group $nsgFrontEnd

# Create a backend subnet.
echo "Creating $subnetBackEnd for $vNet"
az network vnet subnet create --address-prefix $subnetPrefixBackEnd --name $subnetBackEnd --resource-group $resourceGroup --vnet-name $vNet

#Create the DMZ subnet.
echo "Creating $dmzSubnet for $vNet"
az network vnet subnet create --address-prefix $dmzPrefix --name $dmzSubnet --resource-group $resourceGroup --vnet-name $vNet

# Create a public IP address for the firewall VM.
echo "Creating $publicIpFirewall"
az network public-ip create --resource-group $resourceGroup --name $publicIpFirewall

# Create a NIC for the firewall VM and enable IP forwarding.
echo "Creating $nicFirewall with IP forwarding"
az network nic create --resource-group $resourceGroup --name $nicFirewall --vnet-name $vNet --subnet $dmzSubnet --public-ip-address $publicIpFirewall --ip-forwarding

#Create a firewall VM to accept all traffic between the front and backend subnets.
echo "Creating $vmFirewall"
az vm create --resource-group $resourceGroup --name $vmFirewall --nics $nicFirewall --image $image --admin-username $login --generate-ssh-keys --public-ip-sku $sku

# Get the private IP address from the VM for the user-defined route.
echo "Get the private IP address from $vmFirewall"
Fw1Ip=$(az vm list-ip-addresses --resource-group $resourceGroup --name $vmFirewall --query [].virtualMachine.network.privateIpAddresses[0] --out tsv)

# Create route table for the FrontEnd subnet.
echo "Creating $routeTableFrontEndSubnet"
az network route-table create --name $routeTableFrontEndSubnet --resource-group $resourceGroup

# Create a route for traffic from the front-end to the backend subnet through the firewall VM.
echo "Creating $routeToBackEnd to $subnetPrefixBackEnd in $routeTableFrontEndSubnet"
az network route-table route create --name $routeToBackEnd --resource-group $resourceGroup --route-table-name $routeTableFrontEndSubnet --address-prefix $subnetPrefixBackEnd --next-hop-type VirtualAppliance --next-hop-ip-address $Fw1Ip
  
# Create a route for traffic from the front-end subnet to the Internet through the firewall VM.
echo "Creating route $routeToInternetFrontEnd to Internet in $routeTableFrontEndSubnet"
az network route-table route create --name $routeToInternetFrontEnd --resource-group $resourceGroup --route-table-name $routeTableFrontEndSubnet --address-prefix $routeToInternetPrefix --next-hop-type VirtualAppliance --next-hop-ip-address $Fw1Ip

# Associate the route table to the FrontEnd subnet.
echo "Associate $routeTableFrontEndSubnet to $subnetFrontEnd"
az network vnet subnet update --name $subnetFrontEnd --vnet-name $vNet --resource-group $resourceGroup --route-table $routeTableFrontEndSubnet

# Create route table for the BackEnd subnet.
echo "Creating $routeTableBackEndSubnet"
az network route-table create --name $routeTableBackEndSubnet --resource-group $resourceGroup

# Create a route for traffic from the backend subnet to the front-end subnet through the firewall VM.
echo "Creating $routeToFrontEnd to $subnetPrefixBackEnd in $routeTableBackEndSubnet"
az network route-table route create --name $routeToFrontEnd --resource-group $resourceGroup --route-table-name $routeTableBackEndSubnet --address-prefix $subnetPrefixBackEnd --next-hop-type VirtualAppliance --next-hop-ip-address $Fw1Ip

# Create a route for traffic from the backend subnet to the Internet through the firewall VM.
echo "Creating route $routeToInternetBackEnd to Internet in $routeTableBackEndSubnet"
az network route-table route create --name $routeToInternetBackEnd --resource-group $resourceGroup --route-table-name $routeTableBackEndSubnet --address-prefix $routeToInternetPrefix --next-hop-type VirtualAppliance --next-hop-ip-address $Fw1Ip

# Associate the route table to the BackEnd subnet.
echo "Associate $routeTableBackEndSubnet to $subnetBackEnd"
az network vnet subnet update --name $subnetBackEnd --vnet-name $vNet --resource-group $resourceGroup --route-table $routeTableBackEndSubnet

Clean up deployment

Use the following command to remove the resource group and all resources associated with it using the az group delete command - unless you have an ongoing need for these resources. Some of these resources may take a while to create, as well as to delete.

az group delete --name $resourceGroup

Sample reference

This script uses the following commands to create a resource group, virtual network, and network security groups. Each command in the following table links to command-specific documentation:

Command Notes
az group create Creates a resource group in which all resources are stored.
az network vnet create Creates an Azure virtual network and front-end subnet.
az network subnet create Creates back-end and DMZ subnets.
az network public-ip create Creates a public IP address to access the VM from the internet.
az network nic create Creates a virtual network interface and enable IP forwarding for it.
az network nsg create Creates a network security group (NSG).
az network nsg rule create Creates NSG rules that allow HTTP and HTTPS ports inbound to the VM.
az network vnet subnet update Associates the NSGs and route tables to subnets.
az network route-table create Creates a route table for all routes.
az network route-table route create Creates routes to route traffic between subnets and the internet through the VM.
az vm create Creates a virtual machine and attaches the NIC to it. This command also specifies the virtual machine image to use and administrative credentials.
az group delete Deletes a resource group and all resources it contains.

Next steps

For more information on the Azure CLI, see Azure CLI documentation.

Additional virtual network CLI script samples can be found in Virtual network CLI samples.