Storage Account with Private Endpoint. Can it be accessed from Public IPs through Azure Firewall?

Charis Chari 20 Reputation points
2024-05-02T06:50:07.7366667+00:00

I have a Storage Account with Private Endpoint. My Vnet is protected with Azure Firewall. Storage Account is accessible from On-premises or other (through Azure VPN GW) and from other peered Vnets. All traffic to the Storage Account Private Endpoint is filtered by the Azure Firewall.

If we want to allow access to the storage account from specific Internet IP Addresses, can we filtered these I Ps with the Azure Firewall and how ? Which FQDN to use? Do we NAT the private IP to a Public IP ? What certificate do we use?

Or we have to do it through the Storage Account public network access filter?

Azure Storage Accounts
Azure Storage Accounts
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
2,871 questions
Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
600 questions
Azure Private Link
Azure Private Link
An Azure service that provides private connectivity from a virtual network to Azure platform as a service, customer-owned, or Microsoft partner services.
484 questions
0 comments
Accepted answer
  1. Anand Prakash Yadav 7,775 Reputation points Microsoft Vendor
    2024-05-02T08:31:29.97+00:00

    Hello Charis Chari,

    Thank you for posting your query here!

    To control access via Azure Firewall, you would generally need to filter network traffic by source and destination IP addresses, protocols, and ports, but not by Internet IP addresses directly to a Private Endpoint because Private Endpoints are not accessible from the public internet.

    Azure Firewall does not support NAT (Network Address Translation) from public IP to private IP for incoming traffic. Azure Firewall is primarily used to control outbound and inbound network traffic rules between protected subnets.

    Since your storage account uses a Private Endpoint, it likely has a DNS configuration that resolves to private IP addresses within your virtual network. Public internet users cannot use this DNS to reach the storage account.

    A much easier way to let specific internet IPs into your storage account is to use the network access controls that come with Azure Storage:

    · You need to configure the storage account to allow public network access. This can be done by setting the Allow option for public network access on the storage account configuration.

    · Under the Firewalls and virtual networks settings of the storage account, you can specify which public IP addresses or IP ranges are allowed to access the storage account.

    · As for FQDN, in case of public access, the storage account can be accessed via its public endpoint, typically in the format https://<account_name>.blob.core.windows.net. If you enable public access only for specific IPs, this would be the endpoint they use.

    · Also, please note that when connecting to Azure Storage, the SSL/TLS certificate is managed by Azure, and you don’t need to handle certificates specifically for Azure Firewall.

    Do let us know if you have any further queries. I’m happy to assist you further.

    Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    1 person found this answer helpful.
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest