Azure Firewall SNAT private IP address ranges

Azure Firewall provides SNAT capability for all outbound traffic to public IP addresses. By default, Azure Firewall doesn't SNAT with Network rules when the destination IP address is in a private IP address range per IANA RFC 1918 or shared address space per IANA RFC 6598. Application rules are always SNATed using a transparent proxy

This logic works well when you route traffic directly to the Internet. However, there are scenarios where you may want to override the default SNAT behavior.

• If you've enabled forced tunneling, Internet-bound traffic is SNATed to one of the firewall private IP addresses in AzureFirewallSubnet, hiding the source from your on-premises firewall.
• If your organization uses registered IP address ranges outside of IANA RFC 1918 or IANA RFC 6598 for private networks, Azure Firewall SNATs the traffic to one of the firewall private IP addresses in AzureFirewallSubnet. However, you can configure Azure Firewall to not SNAT your public IP address range. For example, to specify an individual IP address you can specify it like this: 192.168.1.10. To specify a range of IP addresses, you can specify it like this: 192.168.1.0/24.

Azure Firewall SNAT behavior can be changed in the following ways:

• To configure Azure Firewall to never SNAT traffic processed by network rules regardless of the destination IP address, use 0.0.0.0/0 as your private IP address range. With this configuration, Azure Firewall can never route traffic directly to the Internet.

• To configure the firewall to always SNAT processed by network rules regardless of the destination address, use 255.255.255.255/32 as your private IP address range.

You can configure the SNAT private IP addresses using the following methods. You must configure the SNAT private addresses using the method appropriate for your configuration. Firewalls associated with a firewall policy must specify the range in the policy and not use AdditionalProperties.

Method	Using classic rules	Using firewall policy
Azure portal	supported	supported
Azure PowerShell	configure PrivateRange	currently unsupported
Azure CLI	configure --private-ranges	currently unsupported
ARM template	configure AdditionalProperties in firewall property	configure snat/privateRanges in firewall policy

Configure SNAT private IP address ranges - Azure PowerShell

Classic rules

You can use Azure PowerShell to specify private IP address ranges for the firewall.

New firewall

For a new firewall using classic rules, the Azure PowerShell cmdlet is:

$azFw = @{
    Name               = '<fw-name>'
    ResourceGroupName  = '<resourcegroup-name>'
    Location           = '<location>'
    VirtualNetworkName = '<vnet-name>'
    PublicIpName       = '<public-ip-name>'
    PrivateRange       = @("IANAPrivateRanges", "192.168.1.0/24", "192.168.1.10")
}

New-AzFirewall @azFw

For more information, see New-AzFirewall.

Existing firewall

To configure an existing firewall using classic rules, use the following Azure PowerShell cmdlets:

$azfw = Get-AzFirewall -Name '<fw-name>' -ResourceGroupName '<resourcegroup-name>'
$azfw.PrivateRange = @("IANAPrivateRanges","192.168.1.0/24", "192.168.1.10")
Set-AzFirewall -AzureFirewall $azfw

Configure SNAT private IP address ranges - Azure CLI

Classic rules

You can use Azure CLI to specify private IP address ranges for the firewall using classic rules.

New firewall

For a new firewall using classic rules, the Azure CLI command is:

az network firewall create \
-n <fw-name> \
-g <resourcegroup-name> \
--private-ranges 192.168.1.0/24 192.168.1.10 IANAPrivateRanges

Existing firewall

To configure an existing firewall using classic rules, the Azure CLI command is:

az network firewall update \
-n <fw-name> \
-g <resourcegroup-name> \
--private-ranges 192.168.1.0/24 192.168.1.10 IANAPrivateRanges

Configure SNAT private IP address ranges - ARM template

Classic rules

To configure SNAT during ARM Template deployment, you can add the following to the additionalProperties property:

"additionalProperties": {
   "Network.SNAT.PrivateRanges": "IANAPrivateRanges , IPRange1, IPRange2"
},

Firewall policy

Azure Firewalls associated with a firewall policy have supported SNAT private ranges since the 2020-11-01 API version. Currently, you can use a template to update the SNAT private range on the Firewall Policy. The following sample configures the firewall to always SNAT network traffic:

{ 

            "type": "Microsoft.Network/firewallPolicies", 
            "apiVersion": "2020-11-01", 
            "name": "[parameters('firewallPolicies_DatabasePolicy_name')]", 
            "location": "chinaeast", 
            "properties": { 
                "sku": { 
                    "tier": "Standard" 
                }, 
                "snat": { 
                    "privateRanges": "[255.255.255.255/32]" 
                } 
            } 

Configure SNAT private IP address ranges - Azure portal

Classic rules

You can use the Azure portal to specify private IP address ranges for the firewall.

1. Select your resource group, and then select your firewall.

2. On the Overview page, Private IP Ranges, select the default value IANA RFC 1918.

   The Edit Private IP Prefixes page opens:

   

3. By default, IANAPrivateRanges is configured.

4. Edit the private IP address ranges for your environment and then select Save.

Firewall policy

1. Select your resource group, and then select your firewall policy.

2. Select Private IP ranges (SNAT) in the Settings column.

3. Select the conditions to perform SNAT for your environment under Perform SNAT to customize the SNAT configuration.

4. Select Apply.

Next steps

• Learn about Azure Firewall forced tunneling.