How can we route all inbound events of EventHub via Azure Firewall?

@Tenneti Ajay

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Please note that there is no direct integration between Public IP of the Azure Firewall and an Eventhub.

As you mentioned, you can use the DNAT Feature of Azure Firewall to redirect incoming traffic to a private resource behind the Azure Firewall.

• Can you please elaborate more on what you mean by "Unique IP for Eventhub"
• If you want a separate IP for Firewall and separate IP to DNAT to backend resource,
  • Deploy an Azure Firewall with multiple public IP addresses
    • Use DNAT on only one of the Public IP to your backend servers.
• This way, only one IP from Firewall acts as an inbound for the Event Hub service.

P.S :

• You can deploy an Azure Firewall with up to 250 public IP addresses, however DNAT destination rules will also count toward the 250 maximum. Public IPs + DNAT destination rule = 250 max
• For outbound, Azure Firewall randomly selects the source public IP address to use for a connection

Cheers,

Kapil

@KapilAnanth-MSFT

By Unique I meant we have different multiple Public IPs for different resources and we have separate Public IP for Eventhubs as well.

We have a DNS zone and custom certificate for the same domain.

I just want to know, if it is feasible and how we can send events to Eventhub via Azure Firewall.

@Tenneti Ajay

Are you following any documentation to set this up?

• I could not find any documents backing this design

The intended purpose of DNAT rules in Azure Firewall is primarily to provide Layer 4 IP/Port translation.

• For any HTTPS Traffic, customers are recommended to use Azure App gateway or Azure App gateway + Azure Firewall in Parallel.
• This document, talks about this in detail.
  • 
• Moreover, I noticed there is no inbuilt support for custom domains in Event Hubs.

Wrt the last point above,

• You must make sure the requests hitting your PaaS service (EventHub) uses the proper domain name of your service.
  • i.e., << {{ Namespace Name }}.servicebus.windows.net >>
• Please go through this document on why this would cause an issue : Host Name preservation in Azure
  • In your case, it should be contoso.servicebus.windows.net instead of contoso.azurewebsites.net
    
• I would suggest you to leverage Azure App gateway and add the Event Hub Private EndPoint as the backend and see if this works.

Since there are no documents on this design, you can create a Dev/Test environment as above and let us know if there are any issues.

Cheers,

Kapil

Thank you @KapilAnanth-MSFT