Skip to content

Commit 3a1cd85

Browse files
Merge pull request #275067 from vhorne/fw-fresh
freshness review
2 parents f5e65eb + 558a519 commit 3a1cd85

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

articles/firewall/fqdn-filtering-network-rules.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,27 +5,27 @@ services: firewall
55
author: vhorne
66
ms.service: firewall
77
ms.topic: article
8-
ms.date: 10/28/2022
8+
ms.date: 05/10/2024
99
ms.author: victorh
1010
ms.custom: engagement-fy23
1111
---
1212

1313
# Use FQDN filtering in network rules
1414

15-
A fully qualified domain name (FQDN) represents a domain name of a host or IP address(es). You can use FQDNs in network rules based on DNS resolution in Azure Firewall and Firewall policy. This capability allows you to filter outbound traffic with any TCP/UDP protocol (including NTP, SSH, RDP, and more). You must enable DNS Proxy to use FQDNs in your network rules. For more information see [Azure Firewall DNS settings](dns-settings.md).
15+
A fully qualified domain name (FQDN) represents a domain name of a host or one or more IP addresses. You can use FQDNs in network rules based on DNS resolution in Azure Firewall and Firewall policy. This capability allows you to filter outbound traffic with any TCP/UDP protocol (including NTP, SSH, RDP, and more). You must enable DNS Proxy to use FQDNs in your network rules. For more information, see [Azure Firewall DNS settings](dns-settings.md).
1616

1717
> [!NOTE]
1818
> By design, FQDN filtering in network rules doesn’t support wildcards
1919
2020
## How it works
2121

22-
Once you define which DNS server your organization needs (Azure DNS or your own custom DNS), Azure Firewall translates the FQDN to an IP address(es) based on the selected DNS server. This translation happens for both application and network rule processing.
22+
Once you define which DNS server your organization needs (Azure DNS or your own custom DNS), Azure Firewall translates the FQDN to an IP address or addresses based on the selected DNS server. This translation happens for both application and network rule processing.
2323

24-
When a new DNS resolution takes place, new IP addresses are added to firewall rules. Old IP addresses that are no longer returned by the DNS server expire in 15 minutes. Azure Firewall rules are updated every 15 seconds from DNS resolution of the FQDNs in network rules.
24+
When a new DNS resolution takes place, new IP addresses are added to firewall rules. Old IP addresses expire in 15 minutes when the DNS server no longer returns them. Azure Firewall rules are updated every 15 seconds from DNS resolution of the FQDNs in network rules.
2525

2626
### Differences in application rules vs. network rules
2727

28-
- FQDN filtering in application rules for HTTP/S and MSSQL is based on an application level transparent proxy and the SNI header. As such, it can discern between two FQDNs that are resolved to the same IP address. This is not the case with FQDN filtering in network rules.
28+
- FQDN filtering in application rules for HTTP/S and MSSQL is based on an application level transparent proxy and the SNI header. As such, it can discern between two FQDNs that are resolved to the same IP address. This isn't the case with FQDN filtering in network rules.
2929

3030
Always use application rules when possible:
3131
- If the protocol is HTTP/S or MSSQL, use application rules for FQDN filtering.

0 commit comments

Comments
 (0)