Azure Firewall SNAT private IP address ranges

Azure Firewall provides SNAT capability for all outbound traffic to public IP addresses. By default, Azure Firewall doesn't SNAT with Network rules when the destination IP address is in a private IP address range per IANA RFC 1918 or shared address space per IANA RFC 6598. Application rules are always SNATed using a transparent proxy

This default behavior is suitable when routing traffic directly to the Internet. However, there are scenarios where you might need to override the default SNAT behavior:

• If you enable forced tunneling, Azure Firewall SNATs Internet-bound traffic to one of the firewall's private IP addresses in AzureFirewallSubnet, hiding the source from your on-premises firewall.
• If your organization uses registered IP address ranges outside of IANA RFC 1918 or IANA RFC 6598 for private networks, Azure Firewall SNATs the traffic to one of the firewall's private IP addresses in AzureFirewallSubnet. You can configure Azure Firewall to not SNAT your public IP address range. For example, specify an individual IP address as x.x.x.x or a range of IP addresses as x.x.x.x/24.

You can change Azure Firewall SNAT behavior in the following ways:

• To configure Azure Firewall to never SNAT traffic processed by network rules regardless of the destination IP address, use 0.0.0.0/0 as your private IP address range. With this configuration, Azure Firewall can't route traffic directly to the Internet.
• To configure the firewall to always SNAT traffic processed by network rules regardless of the destination address, use 255.255.255.255/32 as your private IP address range.
• You can configure Azure Firewall to autolearn registered and private ranges every hour and use the learned routes for SNAT. This preview capability requires Azure Route Server deployed in the same virtual network as the Azure Firewall.

You can configure the SNAT private IP addresses by using the following methods. Use the method appropriate for your configuration. Firewalls associated with a firewall policy must specify the range in the policy and not use AdditionalProperties.

Configure SNAT private IP address ranges - Azure PowerShell

Classic rules

Use Azure PowerShell to specify private IP address ranges for the firewall.

New firewall

For a new firewall that uses classic rules, use the following Azure PowerShell cmdlet:

$azFw = @{
   Name               = '<fw-name>'
   ResourceGroupName  = '<resourcegroup-name>'
   Location           = '<location>'
   VirtualNetworkName = '<vnet-name>'
   PublicIpName       = '<public-ip-name>'
   PrivateRange       = @("IANAPrivateRanges", "192.168.1.0/24", "192.168.1.10")
}

New-AzFirewall @azFw

For more information, see New-AzFirewall.

Existing firewall

To configure an existing firewall that uses classic rules, use the following Azure PowerShell cmdlets:

$azfw = Get-AzFirewall -Name '<fw-name>' -ResourceGroupName '<resourcegroup-name>'
$azfw.PrivateRange = @("IANAPrivateRanges", "192.168.1.0/24", "192.168.1.10")
Set-AzFirewall -AzureFirewall $azfw

az network firewall create \
-n <fw-name> \
-g <resourcegroup-name> \
--private-ranges 192.168.1.0/24 192.168.1.10 IANAPrivateRanges

az network firewall update \
-n <fw-name> \
-g <resourcegroup-name> \
--private-ranges 192.168.1.0/24 192.168.1.10 IANAPrivateRanges

"additionalProperties": {
   "Network.SNAT.PrivateRanges": "IANAPrivateRanges, IPRange1, IPRange2"
},

{
   "type": "Microsoft.Network/firewallPolicies",
   "apiVersion": "2024-05-01",
   "name": "[parameters('firewallPolicies_DatabasePolicy_name')]",
   "location": "chinaeast2",
   "properties": {
      "sku": {
         "tier": "Standard"
      },
      "snat": {
         "privateRanges": "[255.255.255.255/32]"
      }
   }
}