NSG rules (inbound, outbound) in Azure - Commands & Configuration

Introduction

Network Security Group (NSG) rules control the flow of network traffic to and from resources in Azure. They help protect your applications by allowing or blocking specific inbound and outbound traffic based on rules.

When you want to allow web traffic (HTTP/HTTPS) to your virtual machine from the internet.

When you need to block all inbound traffic except from a trusted IP range.

When you want to restrict outbound traffic from your VM to only specific ports or addresses.

When you want to allow SSH access only from your office IP to your Linux VM.

When you want to prevent your VM from accessing the internet except for specific services.

Config File - nsg-rules.json

nsg-rules.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.Network/networkSecurityGroups",
      "apiVersion": "2021-05-01",
      "name": "example-nsg",
      "location": "eastus",
      "properties": {
        "securityRules": [
          {
            "name": "AllowHTTPInbound",
            "properties": {
              "protocol": "Tcp",
              "sourcePortRange": "*",
              "destinationPortRange": "80",
              "sourceAddressPrefix": "*",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 100,
              "direction": "Inbound"
            }
          },
          {
            "name": "AllowSSHInbound",
            "properties": {
              "protocol": "Tcp",
              "sourcePortRange": "*",
              "destinationPortRange": "22",
              "sourceAddressPrefix": "203.0.113.0/24",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 200,
              "direction": "Inbound"
            }
          },
          {
            "name": "DenyAllOutbound",
            "properties": {
              "protocol": "*",
              "sourcePortRange": "*",
              "destinationPortRange": "*",
              "sourceAddressPrefix": "*",
              "destinationAddressPrefix": "*",
              "access": "Deny",
              "priority": 300,
              "direction": "Outbound"
            }
          }
        ]
      }
    }
  ]
}

This JSON file defines an Azure Network Security Group named example-nsg in the eastus region.

It has three rules:

• AllowHTTPInbound: Allows inbound TCP traffic on port 80 from any source.
• AllowSSHInbound: Allows inbound TCP traffic on port 22 only from the IP range 203.0.113.0/24.
• DenyAllOutbound: Denies all outbound traffic regardless of protocol or port.

Each rule has a priority number; lower numbers have higher priority.

Commands

Create a new Network Security Group named example-nsg in the example-rg resource group in the eastus region.

Terminal

az network nsg create --resource-group example-rg --name example-nsg --location eastus

Expected Output

{

  "NewNSG": {

    "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-rg/providers/Microsoft.Network/networkSecurityGroups/example-nsg",

    "location": "eastus",

    "name": "example-nsg",

    "resourceGroup": "example-rg",

    "securityRules": [],

    "type": "Microsoft.Network/networkSecurityGroups"

  }

}

→

--resource-group - Specifies the resource group where the NSG will be created

→

--name - Names the NSG

→

--location - Sets the Azure region for the NSG

Add an inbound rule to allow TCP traffic on port 80 from any source to the NSG.

Terminal

az network nsg rule create --resource-group example-rg --nsg-name example-nsg --name AllowHTTPInbound --priority 100 --direction Inbound --access Allow --protocol Tcp --source-address-prefixes '*' --source-port-ranges '*' --destination-address-prefixes '*' --destination-port-ranges 80

Expected Output

{

  "name": "AllowHTTPInbound",

  "priority": 100,

  "direction": "Inbound",

  "access": "Allow",

  "protocol": "Tcp",

  "sourceAddressPrefix": "*",

  "sourcePortRange": "*",

  "destinationAddressPrefix": "*",

  "destinationPortRange": "80"

}

→

--priority - Sets the rule priority; lower numbers are higher priority

→

--direction - Specifies if the rule applies to inbound or outbound traffic

→

--access - Allows or denies traffic matching the rule

Add an inbound rule to allow SSH (port 22) only from the IP range 203.0.113.0/24.

Terminal

az network nsg rule create --resource-group example-rg --nsg-name example-nsg --name AllowSSHInbound --priority 200 --direction Inbound --access Allow --protocol Tcp --source-address-prefixes 203.0.113.0/24 --source-port-ranges '*' --destination-address-prefixes '*' --destination-port-ranges 22

Expected Output

{

  "name": "AllowSSHInbound",

  "priority": 200,

  "direction": "Inbound",

  "access": "Allow",

  "protocol": "Tcp",

  "sourceAddressPrefix": "203.0.113.0/24",

  "sourcePortRange": "*",

  "destinationAddressPrefix": "*",

  "destinationPortRange": "22"

}

→

--source-address-prefixes - Limits traffic source to specified IP range

Add an outbound rule to deny all traffic from resources associated with this NSG.

Terminal

az network nsg rule create --resource-group example-rg --nsg-name example-nsg --name DenyAllOutbound --priority 300 --direction Outbound --access Deny --protocol '*' --source-address-prefixes '*' --source-port-ranges '*' --destination-address-prefixes '*' --destination-port-ranges '*'

Expected Output

{

  "name": "DenyAllOutbound",

  "priority": 300,

  "direction": "Outbound",

  "access": "Deny",

  "protocol": "*",

  "sourceAddressPrefix": "*",

  "sourcePortRange": "*",

  "destinationAddressPrefix": "*",

  "destinationPortRange": "*"

}

→

--direction - Outbound rules control traffic leaving the resource

→

--access - Deny blocks matching traffic

View the current rules and settings of the example-nsg to verify the rules were added correctly.

Terminal

az network nsg show --resource-group example-rg --name example-nsg

Expected Output

{

  "name": "example-nsg",

  "resourceGroup": "example-rg",

  "securityRules": [

    {

      "name": "AllowHTTPInbound",

      "priority": 100,

      "direction": "Inbound",

      "access": "Allow",

      "protocol": "Tcp",

      "sourceAddressPrefix": "*",

      "sourcePortRange": "*",

      "destinationAddressPrefix": "*",

      "destinationPortRange": "80"

    },

    {

      "name": "AllowSSHInbound",

      "priority": 200,

      "direction": "Inbound",

      "access": "Allow",

      "protocol": "Tcp",

      "sourceAddressPrefix": "203.0.113.0/24",

      "sourcePortRange": "*",

      "destinationAddressPrefix": "*",

      "destinationPortRange": "22"

    },

    {

      "name": "DenyAllOutbound",

      "priority": 300,

      "direction": "Outbound",

      "access": "Deny",

      "protocol": "*",

      "sourceAddressPrefix": "*",

      "sourcePortRange": "*",

      "destinationAddressPrefix": "*",

      "destinationPortRange": "*"

    }

  ]

}

→

--resource-group - Specifies the resource group of the NSG

→

--name - Specifies the NSG name to show

Key Concept

If you remember nothing else from this pattern, remember: NSG rules control who can talk to your resources and where your resources can talk, by allowing or blocking specific traffic directions and ports.

Common Mistakes

Setting the same priority number for multiple rules

Azure requires unique priorities; duplicate priorities cause errors or unexpected rule application.

Assign a unique priority number to each NSG rule, with lower numbers having higher priority.

Using '*' for sourceAddressPrefix when you want to restrict access

Using '*' allows traffic from anywhere, which can expose your resource to unwanted access.

Specify exact IP ranges or service tags to limit traffic sources for better security.

Not verifying NSG rules after creation

Without verification, you might miss misconfigurations that block needed traffic or leave security holes.

Always use 'az network nsg show' or portal to confirm your rules are correctly applied.

Summary

Create an NSG to group network security rules for your Azure resources.

Add inbound and outbound rules with specific priorities, directions, protocols, and IP ranges.

Verify the NSG rules to ensure your traffic is allowed or blocked as intended.

Practice

1. What is the primary purpose of an Azure Network Security Group (NSG)?

easy

A. To store data securely in the cloud

B. To manage user identities and access

C. To control inbound and outbound network traffic to resources

D. To monitor application performance

Solution

1. Step 1: Understand NSG function

   NSGs are designed to filter network traffic to and from Azure resources.

2. Step 2: Compare options

   Only To control inbound and outbound network traffic to resources describes controlling inbound and outbound traffic, which matches NSG's role.

3. Final Answer:

   To control inbound and outbound network traffic to resources -> Option C

4. Quick Check:

   NSG controls traffic = B [OK]

Hint: NSG controls traffic flow, not data or users [OK]

Common Mistakes:

• Confusing NSG with storage or identity services
• Thinking NSG monitors performance
• Assuming NSG manages user access

2. Which of the following is the correct way to specify an inbound NSG rule to allow TCP traffic on port 80?

easy

A. Priority: 100, Direction: Inbound, Protocol: TCP, Port: 80, Action: Allow

B. Priority: 100, Direction: Inbound, Protocol: UDP, Port: 80, Action: Allow

C. Priority: 100, Direction: Outbound, Protocol: TCP, Port: 80, Action: Allow

D. Priority: 100, Direction: Inbound, Protocol: TCP, Port: 443, Action: Allow

Solution

1. Step 1: Identify direction and protocol

   The question asks for inbound TCP traffic on port 80, so Direction must be Inbound and Protocol TCP.

2. Step 2: Check port and action

   Port must be 80 and Action Allow to permit traffic.

3. Final Answer:

   Priority: 100, Direction: Inbound, Protocol: TCP, Port: 80, Action: Allow -> Option A

4. Quick Check:

   Inbound TCP port 80 allow = C [OK]

Hint: Inbound + TCP + port 80 + Allow = correct rule [OK]

Common Mistakes:

• Using outbound direction instead of inbound
• Using UDP protocol instead of TCP
• Specifying wrong port number

3. Given these NSG rules applied in order of priority:
1) Priority 100: Allow inbound TCP port 22 from 10.0.0.0/24
2) Priority 200: Deny inbound TCP port 22 from any
What will happen if a connection attempt comes from IP 10.0.0.5 on port 22?

medium

A. The connection is allowed because allow rule has higher priority

B. The connection is allowed because deny rules do not apply to private IPs

C. The connection is denied because default deny applies

D. The connection is denied because deny rule has higher priority

Solution

1. Step 1: Understand rule priority

   Lower priority number means higher priority. Priority 100 rule is evaluated before 200.

2. Step 2: Evaluate matching rules

   IP 10.0.0.5 matches allow rule at priority 100, so connection is allowed before deny rule is checked.

3. Final Answer:

   The connection is allowed because allow rule has higher priority -> Option A

4. Quick Check:

   Lower priority allow beats higher priority deny = D [OK]

Hint: Lower priority number rules apply first [OK]

Common Mistakes:

• Assuming deny always overrides allow
• Ignoring rule priority order
• Thinking private IPs bypass deny rules

4. You created an NSG rule to allow outbound HTTPS traffic on port 443, but traffic is still blocked. Which of the following is the most likely cause?

medium

A. The source IP address range is set to 0.0.0.0/0

B. The NSG rule is set to inbound instead of outbound

C. The protocol is set to UDP instead of TCP

D. There is a higher priority outbound deny rule blocking port 443

Solution

1. Step 1: Check rule priority and direction

   If traffic is blocked despite allow rule, a deny rule with higher priority likely blocks it.

2. Step 2: Evaluate other options

   Inbound vs outbound mismatch or protocol mismatch would cause no effect, but the question states rule exists for outbound HTTPS.

3. Final Answer:

   There is a higher priority outbound deny rule blocking port 443 -> Option D

4. Quick Check:

   Higher priority deny blocks traffic despite allow = A [OK]

Hint: Check for higher priority deny rules first [OK]

Common Mistakes:

• Ignoring rule priority order
• Confusing inbound and outbound directions
• Assuming source IP 0.0.0.0/0 blocks traffic

5. You want to allow inbound HTTP traffic only from a specific IP range 192.168.1.0/24 and deny all other inbound HTTP traffic. Which NSG rule configuration achieves this?

hard

A. Priority 100: Deny inbound TCP port 80 from any; Priority 200: Allow inbound TCP port 80 from 192.168.1.0/24

B. Priority 100: Allow inbound TCP port 80 from 192.168.1.0/24; Priority 200: Deny inbound TCP port 80 from any

C. Priority 100: Allow inbound TCP port 80 from any; Priority 200: Deny inbound TCP port 80 from 192.168.1.0/24

D. Priority 100: Deny inbound TCP port 80 from 192.168.1.0/24; Priority 200: Allow inbound TCP port 80 from any

Solution

1. Step 1: Allow specific IP range first

   Allow rule with higher priority (lower number) must permit traffic from 192.168.1.0/24.

2. Step 2: Deny all other IPs

   Deny rule with lower priority blocks all other inbound HTTP traffic.

3. Final Answer:

   Priority 100: Allow inbound TCP port 80 from 192.168.1.0/24; Priority 200: Deny inbound TCP port 80 from any -> Option B

4. Quick Check:

   Allow specific IP first, then deny others = A [OK]

Hint: Allow specific IP with lower priority number, deny others after [OK]

Common Mistakes:

• Placing deny rule before allow rule
• Allowing all IPs instead of specific range
• Using wrong priority numbers