I followed the guide for implementing a new fresh Azure Firewall environment. I have set up a route table with traffic 0.0.0.0/0 to my Azure Firewall, but yet I want to route all internet traffic through this firewall to outside without any exceptions? How can I achieve this? Since it is not clear to me. I added a rule to allow all traffic to destination 0.0.0.0, but it doesn't seem to work.

I have found my own answer by adding a network rule which allows all traffic:

Maybe this can help. Deploy and configure Azure Firewall using the Azure portal Once you have the default route configured you will need to configure an application or network rule . It isn't clear from your question if you've configured the firewall rules to allow the internet outbound traffic.

Allow all outbound traffic through Azure Firewall

Accepted answer

André Krijnen 101 Reputation points

2021-08-20T08:15:53.41+00:00

I have found my own answer by adding a network rule which allows all traffic:
Please sign in to rate this answer.
GitaraniSharma-MSFT 49,261 Reputation points Microsoft Employee

2021-08-20T09:55:42.413+00:00

Hello @André Krijnen ,

Thank you for the update. Really appreciate it!

As mentioned by @FJcmdk4488 , after you create an Azure Firewall, you need to add a UDR on your source subnets with a default route (0.0.0.0/0) pointing to the Azure Firewall IP and then create a Network rule in the Azure Firewall allowing that traffic to go through (same as you shared in your screenshot). The source should be the subnet/VM from which you want to allow that particular traffic.

Regards,
Gita

Jessie 85 Reputation points

2023-11-16T04:33:45.97+00:00

@GitaraniSharma-MSFT

Just one question.

Assuming there is an NSG associated to the subnet,

will the above Firewall rule still connect workloads in the spoke subnet to the internet, after blocking the default rule in the NSG that allows internet access?

That is, where the goal is to enforce zero trust network security.

GitaraniSharma-MSFT 49,261 Reputation points Microsoft Employee

2023-11-16T09:16:07.4866667+00:00

@Jessie , could you please clarify which subnet you are referring to here? And what NSG configuration?

Jessie 85 Reputation points

2023-11-16T09:23:49.8333333+00:00

@GitaraniSharma-MSFT

I am assuming that the route table in which the default route (0.0.0.0/0) was configured in the original question, is attached to a spoke subnet.

If my assumption is true, and assuming there is an NSG associated to the subnet,

will the above Firewall rule still connect workloads in the spoke subnet to the internet, after blocking the default rule in the NSG that allows internet access?

GitaraniSharma-MSFT 49,261 Reputation points Microsoft Employee

2023-11-16T10:39:06.7733333+00:00

Yes @Jessie , as long as there is a UDR on the spoke subnet pointing 0.0.0.0/0 traffic to the Azure Firewall and Azure Firewall has direct Internet connectivity, it will work.

The NSG will only block any direct outbound traffic to Internet from the spoke subnet.

The VM and Firewall are both deployed in a Vnet, so unless you don't specifically block the VM traffic, the default NSG rule of AllowVnetOutBound and AllowVNetInBound will be applied for the traffic between the VM and the Firewall, which is allowed by default.

Refer: https://video2.skills-academy.com/en-us/azure/virtual-network/network-security-groups-overview#default-security-rules

And the UDR will create a route to send all the outbound traffic from the spoke subnet to the Azure Firewall and using the rules in Azure Firewall, that particular traffic will go out of Azure.

Regards,

Gita

Jessie 85 Reputation points

2023-12-08T00:17:28.03+00:00

Hello @GitaraniSharma-MSFT

Thank you for the above clarification.

I have a different question now but still on Azure Firewall.

We recently disabled internet access from our environment and are now not able to connect to SharePoint, and authentication to Micrsosoftonline also fails.

We are in favor of setting up Azure firewall Application rules that points to specific Sharepoint endpoints using FQDN tags, given the problems with maintaining specific FQDNs.

However, we are unsure of which FQDN tags in the list available in Azure allows us to achieve both connecting to SharePoint and authenticating to Microsoftonline services.

Which FQDN tags should we enable?
Sign in to comment

Share via

Allow all outbound traffic through Azure Firewall

1 additional answer