Skip to content

Commit 4d1b383

Browse files
duongauduongau
committed
freshness review - March 2025
1 parent 8e80441 commit 4d1b383

File tree

1 file changed

+107
-108
lines changed

1 file changed

+107
-108
lines changed

‎articles/firewall/tutorial-firewall-dnat.md

Lines changed: 107 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -5,84 +5,82 @@ services: firewall
55
author: duongau
66
ms.service: azure-firewall
77
ms.topic: how-to
8-
ms.date: 08/31/2023
8+
ms.date: 03/17/2025
99
ms.author: duau
1010
ms.custom: mvc
1111
#Customer intent: As an administrator, I want to deploy and configure Azure Firewall DNAT so that I can control inbound Internet access to resources located in a subnet.
1212
---
1313

1414
# Filter inbound Internet or intranet traffic with Azure Firewall DNAT using the Azure portal
1515

16-
You can configure Azure Firewall Destination Network Address Translation (DNAT) to translate and filter inbound Internet traffic to your subnets or intranet traffic between private networks (preview). When you configure DNAT, the NAT rule collection action is set to **Dnat**. Each rule in the NAT rule collection can then be used to translate your firewall public or private IP address and port to a private IP address and port. DNAT rules implicitly add a corresponding network rule to allow the translated traffic. For security reasons, the recommended approach is to add a specific source to allow DNAT access to the network and avoid using wildcards. To learn more about Azure Firewall rule processing logic, see [Azure Firewall rule processing logic](rule-processing.md).
16+
You can configure Azure Firewall Destination Network Address Translation (DNAT) to translate and filter inbound Internet traffic to your subnets or intranet traffic between private networks (preview). When you configure DNAT, the NAT rule collection action is set to **DNAT**. Each rule in the NAT rule collection can then be used to translate your firewall's public or private IP address and port to a private IP address and port. DNAT rules implicitly add a corresponding network rule to allow the translated traffic. For security reasons, it's recommended to add a specific source to allow DNAT access to the network and avoid using wildcards. To learn more about Azure Firewall rule processing logic, see [Azure Firewall rule processing logic](rule-processing.md).
1717

1818
> [!NOTE]
19-
> This article uses classic Firewall rules to manage the firewall. The preferred method is to use [Firewall Policy](../firewall-manager/policy-overview.md). To complete this procedure using Firewall Policy, see [Tutorial: Filter inbound Internet traffic with Azure Firewall policy DNAT using the Azure portal](tutorial-firewall-dnat-policy.md)
19+
> This article uses classic Firewall rules to manage the firewall. The preferred method is to use [Firewall Policy](../firewall-manager/policy-overview.md). To complete this procedure using Firewall Policy, see [Tutorial: Filter inbound Internet traffic with Azure Firewall policy DNAT using the Azure portal](tutorial-firewall-dnat-policy.md).
2020
2121
## Prerequisites
2222

2323
If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
2424

25-
26-
2725
## Create a resource group
2826

2927
1. Sign in to the [Azure portal](https://portal.azure.com).
3028
2. On the Azure portal home page, select **Resource groups**, then select **Create**.
31-
4. For **Subscription**, select your subscription.
32-
1. For **Resource group**, type **RG-DNAT-Test**.
29+
3. For **Subscription**, select your subscription.
30+
4. For **Resource group**, type **RG-DNAT-Test**.
3331
5. For **Region**, select a region. All other resources that you create must be in the same region.
3432
6. Select **Review + create**.
35-
1. Select **Create**.
33+
7. Select **Create**.
3634

3735
## Set up the network environment
3836

39-
For this article, you create a two peered VNets:
37+
For this article, you create two peered VNets:
4038

41-
- **VN-Hub** - the firewall is in this VNet.
42-
- **VN-Spoke** - the workload server is in this VNet.
39+
- **VN-Hub** - the firewall is in this virtual network.
40+
- **VN-Spoke** - the workload server is in this virtual network.
4341

4442
First, create the VNets and then peer them.
4543

46-
### Create the Hub VNet
44+
### Create the Hub virtual network
4745

4846
1. From the Azure portal home page, select **All services**.
4947
2. Under **Networking**, select **Virtual networks**.
5048
3. Select **Create**.
51-
7. For **Resource group**, select **RG-DNAT-Test**.
52-
1. For **Name**, type **VN-Hub**.
53-
1. For **Region**, select the same region that you used before.
54-
1. Select **Next**.
55-
1. On the **Security** tab, select **Next**.
56-
1. For **IPv4 Address space**, accept the default **10.0.0.0/16**.
57-
1. Under **Subnets**, select **default**.
58-
1. For **Subnet template**, select **Azure Firewall**.
49+
4. For **Resource group**, select **RG-DNAT-Test**.
50+
5. For **Name**, type **VN-Hub**.
51+
6. For **Region**, select the same region that you used before.
52+
7. Select **Next**.
53+
8. On the **Security** tab, select **Next**.
54+
9. For **IPv4 Address space**, accept the default **10.0.0.0/16**.
55+
10. Under **Subnets**, select **default**.
56+
11. For **Subnet template**, select **Azure Firewall**.
5957

60-
The firewall will be in this subnet, and the subnet name **must** be AzureFirewallSubnet.
61-
> [!NOTE]
62-
> The size of the AzureFirewallSubnet subnet is /26. For more information about the subnet size, see [Azure Firewall FAQ](firewall-faq.yml#why-does-azure-firewall-need-a--26-subnet-size).
58+
The firewall is in this subnet, and the subnet name **must** be AzureFirewallSubnet.
59+
> [!NOTE]
60+
> The size of the AzureFirewallSubnet subnet is /26. For more information about the subnet size, see [Azure Firewall FAQ](firewall-faq.yml#why-does-azure-firewall-need-a--26-subnet-size).
6361
64-
11. Select **Save**.
65-
1. Select **Review + create**.
66-
1. Select **Create**.
62+
12. Select **Save**.
63+
13. Select **Review + create**.
64+
14. Select **Create**.
6765

68-
### Create a spoke VNet
66+
### Create a spoke virtual network
6967

7068
1. From the Azure portal home page, select **All services**.
7169
2. Under **Networking**, select **Virtual networks**.
7270
3. Select **Create**.
73-
1. For **Resource group**, select **RG-DNAT-Test**.
74-
1. For **Name**, type **VN-Spoke**.
75-
1. For **Region**, select the same region that you used before.
76-
1. Select **Next**.
77-
1. On the **Security** tab, select **Next**.
78-
1. For **IPv4 Address space**, edit the default and type **192.168.0.0/16**.
79-
1. Under **Subnets**, select **default**.
80-
1. For the subnet **Name** type **SN-Workload**.
81-
1. For **Starting address**, type **192.168.1.0**.
82-
1. For **Subnet size**, select **/24**.
83-
1. Select **Save**.
84-
1. Select **Review + create**.
85-
1. Select **Create**.
71+
4. For **Resource group**, select **RG-DNAT-Test**.
72+
5. For **Name**, type **VN-Spoke**.
73+
6. For **Region**, select the same region that you used before.
74+
7. Select **Next**.
75+
8. On the **Security** tab, select **Next**.
76+
9. For **IPv4 Address space**, edit the default and type **192.168.0.0/16**.
77+
10. Under **Subnets**, select **default**.
78+
11. For the subnet **Name**, type **SN-Workload**.
79+
12. For **Starting address**, type **192.168.1.0**.
80+
13. For **Subnet size**, select **/24**.
81+
14. Select **Save**.
82+
15. Select **Review + create**.
83+
16. Select **Create**.
8684

8785
### Peer the VNets
8886

@@ -92,9 +90,9 @@ Now peer the two VNets.
9290
2. Under **Settings**, select **Peerings**.
9391
3. Select **Add**.
9492
4. Under **This virtual network**, for the **Peering link name**, type **Peer-HubSpoke**.
95-
5. Under **Remote virtual network**, for **Peering link name**, type **Peer-SpokeHub**.
96-
1. Select **VN-Spoke** for the virtual network.
97-
1. Accept all the other defaults, and then select **Add**.
93+
5. Under **Remote virtual network**, for **Peering link name**, type **Peer-SpokeHub**.
94+
6. Select **VN-Spoke** for the virtual network.
95+
7. Accept all the other defaults, and then select **Add**.
9896

9997
## Create a virtual machine
10098

@@ -106,22 +104,23 @@ Create a workload virtual machine, and place it in the **SN-Workload** subnet.
106104
**Basics**
107105

108106
1. For **Subscription**, select your subscription.
109-
1. For **Resource group**, select **RG-DNAT-Test**.
110-
1. For **Virtual machine name**, type **Srv-Workload**.
111-
1. For **Region**, select the same location that you used previously.
112-
1. Type a username and password.
113-
1. Select **Next: Disks**.
107+
2. For **Resource group**, select **RG-DNAT-Test**.
108+
3. For **Virtual machine name**, type **Srv-Workload**.
109+
4. For **Region**, select the same location that you used previously.
110+
5. Type a username and password.
111+
6. Select **Next: Disks**.
114112

115113
**Disks**
114+
116115
1. Select **Next: Networking**.
117116

118117
**Networking**
119118

120119
1. For **Virtual network**, select **VN-Spoke**.
121120
2. For **Subnet**, select **SN-Workload**.
122121
3. For **Public IP**, select **None**.
123-
4. For **Public inbound ports**, select **None**.
124-
2. Leave the other default settings and select **Next: Management**.
122+
4. For **Public inbound ports**, select **None**.
123+
5. Leave the other default settings and select **Next: Management**.
125124

126125
**Management**
127126

@@ -130,94 +129,94 @@ Create a workload virtual machine, and place it in the **SN-Workload** subnet.
130129
**Monitoring**
131130

132131
1. For **Boot diagnostics**, select **Disable**.
133-
1. Select **Review + Create**.
132+
2. Select **Review + Create**.
134133

135134
**Review + Create**
136135

137-
Review the summary, and then select **Create**. This takes a few minutes to complete.
136+
Review the summary, and then select **Create**. This process takes a few minutes to complete.
138137

139-
After deployment finishes, note the private IP address for the virtual machine. It is used later when you configure the firewall. Select the virtual machine name. Select **Overview**, and under **Networking** note the private IP address.
138+
After the deployment finishes, note the private IP address of the virtual machine. You need this IP address later when configuring the firewall. Select the virtual machine name, go to **Overview**, and under **Networking**, note the private IP address.
140139

141-
[!INCLUDE [ephemeral-ip-note.md](~/reusable-content/ce-skilling/azure/includes/ephemeral-ip-note.md)]
140+
> [!INCLUDE [ephemeral-ip-note.md](~/reusable-content/ce-skilling/azure/includes/ephemeral-ip-note.md)]
142141
143142
## Deploy the firewall
144143

145144
1. From the portal home page, select **Create a resource**.
146-
1. Search for **Firewall**, and then select **Firewall**.
147-
1. Select **Create**.
148-
1. On the **Create a Firewall** page, use the following table to configure the firewall:
149-
150-
|Setting |Value |
151-
|---------|---------|
152-
|Subscription |\<your subscription\>|
153-
|Resource group |Select **RG-DNAT-Test** |
154-
|Name |**FW-DNAT-test**|
155-
|Region |Select the same location that you used previously|
156-
|Firewall SKU|**Standard**|
157-
|Firewall management|**Use Firewall rules (classic) to manage this firewall**|
158-
|Choose a virtual network |**Use existing**: VN-Hub|
159-
|Public IP address |**Add new**, Name: **fw-pip**.|
145+
2. Search for **Firewall**, and then select **Firewall**.
146+
3. Select **Create**.
147+
4. On the **Create a Firewall** page, use the following table to configure the firewall:
148+
149+
| Setting | Value |
150+
|-----------------------|---------------------------------|
151+
| Subscription | \<your subscription\> |
152+
| Resource group | Select **RG-DNAT-Test** |
153+
| Name | **FW-DNAT-test** |
154+
| Region | Select the same location used previously |
155+
| Firewall SKU | **Standard** |
156+
| Firewall management | **Use Firewall rules (classic) to manage this firewall** |
157+
| Choose a virtual network | **Use existing**: VN-Hub |
158+
| Public IP address | **Add new**, Name: **fw-pip** |
160159

161160
5. Accept the other defaults, and then select **Review + create**.
162-
6. Review the summary, and then select **Create** to create the firewall.
161+
6. Review the summary, and then select **Create** to deploy the firewall.
163162

164-
This takes a few minutes to deploy.
165-
7. After deployment completes, go to the **RG-DNAT-Test** resource group, and select the **FW-DNAT-test** firewall.
166-
8. Note the firewall's private and public IP addresses. You'll use them later when you create the default route and NAT rule.
163+
This process takes a few minutes to complete.
164+
7. After deployment completes, go to the **RG-DNAT-Test** resource group and select the **FW-DNAT-test** firewall.
165+
8. Note the firewall's private and public IP addresses. You use them later when creating the default route and NAT rule.
167166

168167
## Create a default route
169168

170-
For the **SN-Workload** subnet, you configure the outbound default route to go through the firewall.
169+
For the **SN-Workload** subnet, configure the outbound default route to go through the firewall.
171170

172171
> [!IMPORTANT]
173-
> You do not need to configure an explicit route back to the firewall at the destination subnet. Azure Firewall is a stateful service and handles the packets and sessions automatically. If you create this route, you'll create an asymmetrical routing environment that interrupts the stateful session logic and results in dropped packets and connections.
172+
> You don't need to configure an explicit route back to the firewall at the destination subnet. Azure Firewall is a stateful service and handles the packets and sessions automatically. Creating this route would result in an asymmetrical routing environment, interrupting the stateful session logic and causing dropped packets and connections.
174173
175174
1. From the Azure portal home page, select **Create a resource**.
176175
2. Search for **Route table** and select it.
177176
3. Select **Create**.
178-
5. For **Subscription**, select your subscription.
179-
1. For **Resource group**, select **RG-DNAT-Test**.
180-
1. For **Region**, select the same region that you used previously.
181-
1. For **Name**, type **RT-FWroute**.
182-
1. Select **Review + create**.
183-
1. Select **Create**.
184-
1. Select **Go to resource**.
185-
1. Select **Subnets**, and then select **Associate**.
186-
1. For **Virtual network**, select **VN-Spoke**.
187-
1. For **Subnet**, select **SN-Workload**.
188-
1. Select **OK**.
189-
1. Select **Routes**, and then select **Add**.
190-
1. For **Route name**, type **FW-DG**.
191-
1. For **Destination type**, select **IP Addresses**.
192-
1. For **Destination IP addresses/CIDR ranges**, type **0.0.0.0/0**.
193-
1. For **Next hop type**, select **Virtual appliance**.
194-
195-
Azure Firewall is actually a managed service, but virtual appliance works in this situation.
196-
18. For **Next hop address**, type the private IP address for the firewall that you noted previously.
197-
19. Select **Add**.
177+
4. For **Subscription**, select your subscription.
178+
5. For **Resource group**, select **RG-DNAT-Test**.
179+
6. For **Region**, select the same region used previously.
180+
7. For **Name**, type **RT-FWroute**.
181+
8. Select **Review + create**.
182+
9. Select **Create**.
183+
10. Select **Go to resource**.
184+
11. Select **Subnets**, and then select **Associate**.
185+
12. For **Virtual network**, select **VN-Spoke**.
186+
13. For **Subnet**, select **SN-Workload**.
187+
14. Select **OK**.
188+
15. Select **Routes**, and then select **Add**.
189+
16. For **Route name**, type **FW-DG**.
190+
17. For **Destination type**, select **IP Addresses**.
191+
18. For **Destination IP addresses/CIDR ranges**, type **0.0.0.0/0**.
192+
19. For **Next hop type**, select **Virtual appliance**.
193+
194+
Azure Firewall is a managed service, but selecting virtual appliance works in this situation.
195+
20. For **Next hop address**, type the private IP address of the firewall noted previously.
196+
21. Select **Add**.
198197

199198
## Configure a NAT rule
200199

201-
1. Open the **RG-DNAT-Test** resource group, and select the **FW-DNAT-test** firewall.
202-
2. On the **FW-DNAT-test** page, under **Settings**, select **Rules (classic)**.
203-
3. Select **Add NAT rule collection**.
204-
4. For **Name**, type **RC-DNAT-01**.
205-
5. For **Priority**, type **200**.
200+
1. Open the **RG-DNAT-Test** resource group, and select the **FW-DNAT-test** firewall.
201+
2. On the **FW-DNAT-test** page, under **Settings**, select **Rules (classic)**.
202+
3. Select **Add NAT rule collection**.
203+
4. For **Name**, type **RC-DNAT-01**.
204+
5. For **Priority**, type **200**.
206205
6. Under **Rules**, for **Name**, type **RL-01**.
207206
7. For **Protocol**, select **TCP**.
208-
1. For **Source type**, select **IP address**.
209-
1. For **Source**, type *.
210-
1. For **Destination Addresses**, type the firewall's public or private IP address.
211-
1. For **Destination ports**, type **3389**.
212-
1. For **Translated Address** type the private IP address for the Srv-Workload virtual machine.
213-
1. For **Translated port**, type **3389**.
214-
1. Select **Add**.
207+
8. For **Source type**, select **IP address**.
208+
9. For **Source**, type *.
209+
10. For **Destination Addresses**, type the firewall's public or private IP address.
210+
11. For **Destination ports**, type **3389**.
211+
12. For **Translated Address**, type the private IP address of the Srv-Workload virtual machine.
212+
13. For **Translated port**, type **3389**.
213+
14. Select **Add**.
215214

216-
This takes a few minutes to complete.
215+
This process takes a few minutes to complete.
217216

218217
## Test the firewall
219218

220-
1. Connect a remote desktop to firewall public IP address. You should be connected to the **Srv-Workload** virtual machine.
219+
1. Connect a remote desktop to the firewall's public IP address. You should be connected to the **Srv-Workload** virtual machine.
221220
2. Close the remote desktop.
222221

223222
## Clean up resources

0 commit comments

Comments
 (0)