Azure Firewall: lack of service tag: Internet / allow access to the Internet on the specific port

@Bart Olejnik

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Your observation is correct. "Internet" Service Tag is currently not available to use with Azure Firewall.

If you would like to allow traffic to Internet on TCP Port 80(HTTP) ,

• You can create an explicit rule with:
  Source as the subnet range
  Source Port as *
  Destination as 0.0.0.0/0
  Destination Port as 80
• This will only allow traffic destined to port 80
• The "DENY BY DEFAULT" Effect of Azure Firewall would block traffic to other ports such as 443 etc.

There are quite a few service tags that are not supported in Azure Firewall.

• Just mentioning the "Internet" tag would not add a value.
• Hence, the document Azure Firewall service tags has the section "Supported service tags"

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

Thanks,

Kapil

@KapilAnanth-MSFT

thank you for your replay. In that case could you advise me how to adress such of scenario?

• Allow traffic to the Internet on port tcp:80 from all subnets / private IPs
• Block all other traffic to the Internet from all subnets / private IPs
• Allow all traffic between Subnets / private IPs

My proposal:

Outgouing

Priority 100:

Source IP: * (which include all private IPs; assumptio: Source IP is always private IP

Source Port : *
Destination: 0.0.0.0/0
Destination Port: 80

Priority 110

Source IP: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

Source Port : *
Destination: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
Destination Port: *

Remarks:

• outgouing traffic between Private IPs will filtered on the NSG lavel (Subnets) so Azure Firewall will not see blocked traffic
• according to the documentation (LINK ) "if a match is found in a network rule, no other rules are processed"

Any other suggestions?

Thank you in advance

@Bart Olejnik

• It's better to have generic rules at last. (with IP ranges 0.0.0.0/0)
• However, your implementation should also work without any issue.
• For Network Rules, yes, Source IP will always be a private IP. However, I would suggest you be always define specific IPs in rules wherever possible.
  • As address space increases, you can either edit the rule to include the additional address space or add new rule.

So, in your case,

Outgoing

Priority 100:

Source IP: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

Source Port : *
Destination: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
Destination Port: *

Priority 110

Source IP: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

Source Port : *
Destination: 0.0.0.0/0
Destination Port: 80

Hope this helps.

Cheers,

Kapil

@Bart Olejnik

I have summarized my comments and posted it as a new answer.

I would highly appreciate if you could Accept the answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Thanks,

Kapil

@KapilAnanth-MSFT thanks for sharing, we are encountering a similar issue, but it seems that your rule with priority 110, which is set to the destination 0.0.0.0/0, cannot be added to the network rules of the Azure firewall.

The portal throws an error stating, "Address 0.0.0.0/0 must be a valid IPv4 CIDR notation."

Any advice on how to resolve this would be greatly appreciated.