aks+ firewall control egress traffic with multiple IPs

Israel.xmargin 1 Reputation point
2021-06-22T13:58:04.263+00:00

My basic problem is to run multiple containers that make HTTP requests to a test server. I need to control the egress traffic with multiples IPs. I need that each pod or a set of pod have different outbound IPs. I am using azure AKS. So far I follow the documentation from: https://video2.skills-academy.com/en-us/azure/aks/limit-egress-traffic#restrict-egress-traffic-using-azure-firewall The above works fine. I need to run another container with a different outbound IP address. For that I created a new Ip address, add it to the firewall, created a new Kubernetes service, connect the container to it and also create a new NAT rules connecting the service IP to the new public IP. That didn't work: the source Ip registered by the test server is the same public IP wich is the first public IP of the firewall.

The Documentation also states that: "If needed, you can generalize the steps above to forward the traffic to your preferred egress solution, following the Outbound Type userDefinedRoute documentation."

For that, I create a cluster with vm-set-type of VirtualMachineScaleSets and load-balancer-sku of Standard. Try the above steps and it didn't work. Also, I created a new route on the Route table connecting the internet to the new public IP.. nothing I am lack of ideas. I don't know if I mess something up. Anyway.. Any idea is welcome. Thanks in advance.

Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
662 questions
Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS)
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
2,103 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Sam Cogan 10,582 Reputation points MVP
    2021-06-22T14:39:54.5+00:00

    Routing your outbound traffic through an Azure Firewall with multiple IP's will not result in a different IP per pod or service. Azure Firewall has no idea what is running on your AKS cluster and just see's traffic coming from the cluster IP's. It will route traffic outbound using one of the external IP's for the Azure Firewall picked at random.

    There really isn't a good way to do what you want and get a different external egress IP for each pod, without using some sort of proxy in the middle.


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.