Deploy and configure Azure Firewall using the Azure portal

  • Article

Controlling outbound network access is an important part of an overall network security plan. For example, you might want to limit access to web sites. Or, you might want to limit the outbound IP addresses and ports that can be accessed.

One way you can control outbound network access from an Azure subnet is with Azure Firewall. With Azure Firewall, you can configure:

  • Application rules that define fully qualified domain names (FQDNs) that can be accessed from a subnet.
  • Network rules that define source address, protocol, destination port, and destination address.

Network traffic is subjected to the configured firewall rules when you route your network traffic to the firewall as the subnet default gateway.

For this article, you create a simplified single virtual network with two subnets for easy deployment.

  • AzureFirewallSubnet - the firewall is in this subnet.
  • Workload-SN - the workload server is in this subnet. This subnet's network traffic goes through the firewall.

Network infrastructure

In this article, you learn how to:

  • Set up a test network environment
  • Deploy a firewall
  • Create a default route
  • Configure an application rule to allow access to www.qq.com
  • Configure a network rule to allow access to external DNS servers
  • Configure a NAT rule to allow a remote desktop to the test server
  • Test the firewall

Note

This article uses classic Firewall rules to manage the firewall. The preferred method is to use Firewall Policy. To complete this procedure using Firewall Policy, see Tutorial: Deploy and configure Azure Firewall and policy using the Azure portal

If you prefer, you can complete this procedure using Azure PowerShell.

Prerequisites

If you don't have an Azure subscription, create a trial subscription before you begin.

Set up the network

First, create a resource group to contain the resources needed to deploy the firewall. Then create a virtual network, subnets, and a test server.

Create a resource group

The resource group contains all the resources used in this procedure.

  1. Sign in to the Azure portal.
  2. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Then select Create.
  3. For Subscription, select your subscription.
  4. For Resource group name, type Test-FW-RG.
  5. For Region, select a region. All other resources that you create must be in the same region.
  6. Select Review + create.
  7. Select Create.

Create a virtual network

This virtual network has two subnets.

Note

The size of the AzureFirewallSubnet subnet is /26. For more information about the subnet size, see Azure Firewall FAQ.

  1. On the Azure portal menu or from the Home page, search for Virtual networks.
  2. Select Virtual networks in the result pane.
  3. Select Create.
  4. For Subscription, select your subscription.
  5. For Resource group, select Test-FW-RG.
  6. For Virtual network name, type Test-FW-VN.
  7. For Region, select the same region that you used previously.
  8. Select Next.
  9. On the Security tab, select Enable Azure Firewall.
  10. For Azure Firewall name, type Test-FW01.
  11. For Azure Firewall public IP address, select Create a public IP address.
  12. For Name, type fw-pip and select OK.
  13. Select Next.
  14. For Address space, accept the default 10.0.0.0/16.
  15. Under Subnet, select default and change the Name to Workload-SN.
  16. For Starting address, change it to 10.0.2.0/24.
  17. Select Save.
  18. Select Review + create.
  19. Select Create.

Note

Azure Firewall uses public IPs as needed based on available ports. After randomly selecting a public IP to connect outbound from, it will only use the next available public IP after no more connections can be made from the current public IP. In scenarios with high traffic volume and throughput, it is recommended to use a NAT Gateway to provide outbound connectivity. SNAT ports are dynamically allocated across all public IPs associated with NAT Gateway. To learn more see integrate NAT Gateway with Azure Firewall.

Create a virtual machine

Now create the workload virtual machine, and place it in the Workload-SN subnet.

  1. On the Azure portal menu or from the Home page, select Create a resource.

  2. Select Windows Server 2019 Datacenter.

  3. Enter these values for the virtual machine:

    Setting Value
    Resource group Test-FW-RG
    Virtual machine name Srv-Work
    Region Same as previous
    Image Windows Server 2019 Datacenter
    Administrator user name Type a user name
    Password Type a password

  4. Under Inbound port rules, Public inbound ports, select None.

  5. Accept the other defaults and select Next: Disks.

  6. Accept the disk defaults and select Next: Networking.

  7. Make sure that Test-FW-VN is selected for the virtual network and the subnet is Workload-SN.

  8. For Public IP, select None.

  9. Accept the other defaults and select Next: Management.

  10. Accept the defaults and select Next: Monitoring.

  11. For Boot diagnostics, select Disable to disable boot diagnostics. Accept the other defaults and select Review + create.

  12. Review the settings on the summary page, and then select Create.

  13. After the deployment is complete, select Go to resource and note the Srv-Work private IP address that you'll need to use later.

Note

Azure provides a default outbound access IP for VMs that either aren't assigned a public IP address or are in the backend pool of an internal basic Azure load balancer. The default outbound access IP mechanism provides an outbound IP address that isn't configurable.

The default outbound access IP is disabled when one of the following events happens:

  • A public IP address is assigned to the VM.
  • The VM is placed in the backend pool of a standard load balancer, with or without outbound rules.
  • An Azure NAT Gateway resource is assigned to the subnet of the VM.

VMs that you create by using virtual machine scale sets in flexible orchestration mode don't have default outbound access.

For more information about outbound connections in Azure, see Default outbound access in Azure and Use Source Network Address Translation (SNAT) for outbound connections.

Examine the firewall

  1. Go to the resource group and select the firewall.
  2. Note the firewall private and public IP addresses. You use these addresses later.

Create a default route

When you create a route for outbound and inbound connectivity through the firewall, a default route to 0.0.0.0/0 with the virtual appliance private IP as a next hop is sufficient. This directs any outgoing and incoming connections through the firewall. As an example, if the firewall is fulfilling a TCP-handshake and responding to an incoming request, then the response is directed to the IP address who sent the traffic. This is by design.

As a result, there's no need create another user defined route to include the AzureFirewallSubnet IP range. This might result in dropped connections. The original default route is sufficient.

For the Workload-SN subnet, configure the outbound default route to go through the firewall.

  1. On the Azure portal search for Route tables.
  2. Select Route tables in the results pane.
  3. Select Create.
  4. For Subscription, select your subscription.
  5. For Resource group, select Test-FW-RG.
  6. For Region, select the same location that you used previously.
  7. For Name, type Firewall-route.
  8. Select Review + create.
  9. Select Create.

After deployment completes, select Go to resource.

  1. On the Firewall-route page, select Subnets and then select Associate.

  2. For Virtual network, select Test-FW-VN.

  3. For Subnet, select Workload-SN. Make sure that you select only the Workload-SN subnet for this route, otherwise your firewall won't work correctly.

  4. Select OK.

  5. Select Routes and then select Add.

  6. For Route name, type fw-dg.

  7. For Destination type, select IP Addresses.

  8. For Destination IP addresses/CIDR ranges, type 0.0.0.0/0.

  9. For Next hop type, select Virtual appliance.

    Azure Firewall is actually a managed service, but virtual appliance works in this situation.

  10. For Next hop address, type the private IP address for the firewall that you noted previously.

  11. Select Add.

Configure a network rule

This is the network rule that allows outbound access to two IP addresses at port 53 (DNS).

  1. Select the Network rule collection tab.

  2. Select Add network rule collection.

  3. For Name, type Net-Coll01.

  4. For Priority, type 200.

  5. For Action, select Allow.

  6. Under Rules, IP addresses, for Name, type Allow-DNS.

  7. For Protocol, select UDP.

  8. For Source type, select IP address.

  9. For Source, type 10.0.2.0/24.

  10. For Destination type select IP address.

  11. For Destination address, type 209.244.0.3,209.244.0.4

    These are public DNS servers operated by Level3.

  12. For Destination Ports, type 53.

  13. Select Add.

Configure a DNAT rule

This rule allows you to connect a remote desktop to the Srv-Work virtual machine through the firewall.

  1. Select the NAT rule collection tab.
  2. Select Add NAT rule collection.
  3. For Name, type rdp.
  4. For Priority, type 200.
  5. Under Rules, for Name, type rdp-nat.
  6. For Protocol, select TCP.
  7. For Source type, select IP address.
  8. For Source, type *.
  9. For Destination address, type the firewall public IP address.
  10. For Destination Ports, type 3389.
  11. For Translated address, type the Srv-work private IP address.
  12. For Translated port, type 3389.
  13. Select Add.

Change the primary and secondary DNS address for the Srv-Work network interface

For testing purposes, configure the server's primary and secondary DNS addresses. This isn't a general Azure Firewall requirement.

  1. On the Azure portal menu, select Resource groups or search for and select Resource groups from any page. Select the Test-FW-RG resource group.
  2. Select the network interface for the Srv-Work virtual machine.
  3. Under Settings, select DNS servers.
  4. Under DNS servers, select Custom.
  5. Type 209.244.0.3 and press Enter in the Add DNS server text box, and 209.244.0.4 in the next text box.
  6. Select Save.
  7. Restart the Srv-Work virtual machine.

Test the firewall

Now, test the firewall to confirm that it works as expected.

  1. Connect a remote desktop to firewall public IP address and sign in to the Srv-Work virtual machine.

  2. Open Internet Explorer and browse to https://www.qq.com.

  3. Select OK > Close on the Internet Explorer security alerts.

    You should see the QQ home page.

  4. Browse to https://www.microsoft.com.

    The firewall should block you.

So now you verified that the firewall rules are working:

  • You can connect to the virtual machine using RDP.
  • You can browse to the one allowed FQDN, but not to any others.
  • You can resolve DNS names using the configured external DNS server.

Clean up resources

You can keep your firewall resources to continue testing, or if no longer needed, delete the Test-FW-RG resource group to delete all firewall-related resources.

Next steps

Tutorial: Monitor Azure Firewall logs