|
| 1 | +--- |
| 2 | +title: Azure Firewall FQDN filtering |
| 3 | +description: Learn about Azure Firewall FQDN filtering and how it works with DNAT rules, network rules, and application rules. |
| 4 | +services: firewall |
| 5 | +author: sjamiya |
| 6 | +ms.service: azure-firewall |
| 7 | +ms.topic: concept-article |
| 8 | +ms.date: 6/30/2025 |
| 9 | +ms.author: sujamiya |
| 10 | +ms.custom: ai-usage |
| 11 | +--- |
| 12 | + |
| 13 | +# Azure Firewall FQDN filtering |
| 14 | + |
| 15 | +A fully qualified domain name (FQDN) is the complete domain name of a host on the internet, such as www.microsoft.com. In Azure Firewall and Firewall policy, FQDNs can be used to filter traffic in DNAT, network, and application rules, depending on the type and direction of traffic being inspected. |
| 16 | + |
| 17 | + |
| 18 | +## How it works |
| 19 | + |
| 20 | +Azure Firewall handles FQDN-based filtering depending on the rule type: |
| 21 | + |
| 22 | +- **Application rules** use FQDNs to filter HTTP/S and MSSQL traffic. They rely on an application-level transparent proxy and the Server Name Indication (SNI) header to differentiate between FQDNs that resolve to the same IP address. In other words, FQDNs are matched and filtered against the original domain requested by the client, not based on the resolved IP address. |
| 23 | +- **Network and DNAT rules** filter traffic based on the resolved IP addresses of the FQDNs, using Azure DNS or a custom DNS server. Azure Firewall dynamically maintains and updates the list of associated IP addresses for the FQDNs, ensuring that traffic is routed correctly even if the underlying IP addresses change. |
| 24 | + |
| 25 | +When DNS resolution is used, Azure Firewall: |
| 26 | + |
| 27 | +- Resolves the FQDN to its corresponding IP address. |
| 28 | +- Uses the resolved IP address to apply the appropriate rule type (DNAT or network) |
| 29 | +- Refreshes FQDN-to-IP mappings every 15 seconds. |
| 30 | +- Removes IP addresses that are no longer resolved or utilized after 15 minutes. |
| 31 | + |
| 32 | +## Differences between FQDN filtering in DNAT rules, and network rules, and application rules |
| 33 | + |
| 34 | +### DNAT rules |
| 35 | + |
| 36 | +DNAT (Destination Network Address Translation) rules are used to route inbound traffic to backend servers. These rules allow you to specify an IP address or FQDN as the target for translation. Using FQDNs in DNAT rules enables you to specify a fully qualified domain name for the backend server, which is particularly useful in dynamic environments where the backend server's IP address may change frequently. |
| 37 | + |
| 38 | +**Key characteristics:** |
| 39 | + |
| 40 | +- Enable inbound traffic routing to backend servers. |
| 41 | +- Support FQDN-based targeting for dynamic environments. |
| 42 | +- Useful for scenarios requiring flexible backend server configurations. |
| 43 | + |
| 44 | + |
| 45 | +### Network rules |
| 46 | + |
| 47 | +Network rules are used for filtering traffic based on any TCP or UDP protocol, such as Network Time Protocol (NTP), Secure Shell (SSH), and Remote Desktop Protocol (RDP). Unlike application rules, network rules don't depend on an application-level proxy or the SNI header. |
| 48 | + |
| 49 | +> [!NOTE] |
| 50 | +> Network rules with FQDN filtering don't support the use of wildcard characters. This limitation is intentional by design. |
| 51 | +
|
| 52 | +**Key characteristics:** |
| 53 | + |
| 54 | +- Applicable to all TCP and UDP protocols. |
| 55 | +- Ideal for non-HTTP/S or MSSQL traffic. |
| 56 | +- Operate at the network layer without protocol-specific inspection. |
| 57 | + |
| 58 | +### Application rules |
| 59 | + |
| 60 | +Application rules are designed for filtering HTTP/S and MSSQL traffic. They rely on an application-level transparent proxy and the Server Name Indication (SNI) header to differentiate between FQDNs that resolve to the same IP address. These rules are ideal for scenarios where you need to control access to web services or databases. |
| 61 | + |
| 62 | +**Key characteristics:** |
| 63 | + |
| 64 | +- Best suited for HTTP/S and MSSQL protocols. |
| 65 | +- Use FQDN tags for Azure services like Azure Backup and HDInsight. |
| 66 | +- Provide finer granularity for supported protocols. |
| 67 | + |
| 68 | +By understanding the differences between these rule types, you can effectively configure Azure Firewall to meet your organization's security and traffic management needs. |
| 69 | + |
| 70 | +- Learn how Azure Firewall policy rule sets are structured [Azure Firewall Policy rule sets](policy-rule-sets.md). |
0 commit comments