NSG rules (inbound, outbound) in Azure - Deep Dive

Overview - NSG rules (inbound, outbound)

What is it?

Network Security Group (NSG) rules are sets of instructions that control the flow of network traffic to and from resources in Azure. They act like filters that decide which data packets can enter (inbound) or leave (outbound) a virtual network or resource. Each rule specifies conditions like source, destination, port, and protocol to allow or deny traffic. This helps protect cloud resources from unwanted access.

Why it matters

Without NSG rules, all network traffic would be allowed by default, exposing resources to potential attacks or unauthorized access. NSG rules help enforce security boundaries, ensuring only trusted traffic reaches your applications. This protects data, reduces risk of breaches, and helps comply with security policies. In real life, it's like having a security guard checking who can enter or leave a building.

Where it fits

Before learning NSG rules, you should understand basic networking concepts like IP addresses, ports, and protocols. After mastering NSG rules, you can explore advanced Azure security features like Azure Firewall, Application Security Groups, and Azure DDoS Protection. NSG rules are foundational for securing Azure virtual networks.

Mental Model

Core Idea

NSG rules act as gatekeepers that allow or block network traffic based on defined conditions to protect Azure resources.

Think of it like...

Imagine a building with security checkpoints at every entrance and exit. Each checkpoint has a list of who can come in or go out, checking IDs and reasons. NSG rules are like those checkpoints for your cloud network, deciding who can pass through.

┌─────────────────────────────┐
│       Network Traffic        │
└─────────────┬───────────────┘
              │
      ┌───────▼────────┐
      │   NSG Rules    │
      │ ┌───────────┐  │
      │ │ Inbound   │  │
      │ │ Rules     │  │
      │ └───────────┘  │
      │ ┌───────────┐  │
      │ │ Outbound  │  │
      │ │ Rules     │  │
      │ └───────────┘  │
      └───────┬────────┘
              │
      ┌───────▼────────┐
      │ Azure Resource │
      └────────────────┘

Build-Up - 7 Steps

1

Foundation

What is a Network Security Group

Concept: Introduce the basic idea of NSGs as traffic filters for Azure resources.

A Network Security Group (NSG) is a container for security rules that control inbound and outbound traffic. It can be attached to subnets or individual network interfaces in Azure. Each NSG contains multiple rules that specify whether to allow or deny traffic based on source, destination, port, and protocol.

Result

You understand that NSGs are like traffic controllers that protect your cloud resources by filtering network packets.

Knowing that NSGs are containers for rules helps you see how Azure organizes network security in a modular and manageable way.

2

Foundation

Understanding Inbound and Outbound Traffic

Concept: Explain the difference between inbound and outbound traffic in networking.

Inbound traffic is data coming into your Azure resource from outside or other parts of the network. Outbound traffic is data leaving your resource to go elsewhere. NSG rules are divided into inbound rules and outbound rules to control these directions separately.

Result

You can distinguish between traffic entering and leaving your resources and know that NSG rules apply differently to each.

Separating inbound and outbound rules allows precise control over what data your resources accept and send out, improving security.

3

Intermediate

How NSG Rules Are Structured

🤔Before reading on: do you think NSG rules are processed in order or all at once? Commit to your answer.

Concept: Introduce the components of an NSG rule and how Azure processes them.

Each NSG rule has a priority number (100-4096), a name, direction (inbound or outbound), source and destination (IP addresses or ranges), protocol (TCP, UDP, or Any), port ranges, and an action (allow or deny). Azure processes rules in priority order, starting from the lowest number. The first matching rule decides the traffic fate.

Result

You understand that NSG rules are checked one by one by priority, and the first rule that matches stops further checks.

Knowing that rule priority matters helps prevent conflicts and ensures the correct rule applies to your traffic.

4

Intermediate

Default Rules and Their Role

🤔Before reading on: do you think you can delete Azure's default NSG rules? Commit to yes or no.

Concept: Explain the built-in default rules that always exist in NSGs and their purpose.

Azure NSGs come with default rules that allow essential traffic like VNet communication and deny all other inbound traffic by default. These default rules have fixed priorities and cannot be deleted but can be overridden by custom rules with higher priority (lower number).

Result

You know that default rules provide a secure baseline and that custom rules modify traffic behavior on top of them.

Understanding default rules prevents accidental exposure and helps you design custom rules that safely override defaults.

5

Intermediate

Creating Effective Inbound Rules

🤔Before reading on: do you think allowing all inbound traffic on port 80 is safe? Commit to yes or no.

Concept: Teach how to write inbound rules that allow necessary traffic while minimizing risk.

When creating inbound rules, specify the exact source IP ranges, protocols, and ports your application needs. For example, allow inbound TCP traffic on port 80 only from trusted IPs. Avoid wide-open rules like allowing all sources on all ports, which expose your resource to attacks.

Result

You can create inbound rules that open only required access, reducing attack surface.

Knowing to limit inbound access to specific sources and ports is key to strong network security.

6

Advanced

Designing Outbound Rules for Security

🤔Before reading on: do you think outbound traffic should always be allowed? Commit to yes or no.

Concept: Explain how outbound rules control data leaving your resources and why restricting them matters.

Outbound rules control where your resource can send data. By default, outbound traffic is allowed, but restricting it can prevent compromised resources from communicating with malicious endpoints. For example, allow outbound traffic only to specific IP ranges or ports needed for your application.

Result

You understand how to limit outbound traffic to reduce risk of data leaks or malware communication.

Knowing to control outbound traffic helps contain threats and enforce compliance.

7

Expert

NSG Rule Conflicts and Troubleshooting

🤔Before reading on: if two NSG rules conflict, does Azure allow or deny the traffic? Commit to your answer.

Concept: Explore how Azure resolves conflicting NSG rules and how to troubleshoot unexpected traffic blocks.

When multiple NSG rules match traffic, Azure applies the rule with the lowest priority number. If a deny rule has higher priority than an allow rule, traffic is blocked. Troubleshooting involves checking rule priorities, directions, and effective NSGs on the resource. Tools like Azure Network Watcher help trace traffic flow and diagnose issues.

Result

You can predict traffic behavior when rules conflict and use Azure tools to fix problems.

Understanding rule priority and conflict resolution prevents misconfigurations that block legitimate traffic or expose resources.

Under the Hood

NSGs operate at the Azure virtual network layer, inspecting each network packet against the set of rules attached to the subnet or network interface. The Azure platform evaluates rules in priority order, matching packet properties like source/destination IP, port, and protocol. Once a matching rule is found, the action (allow or deny) is applied immediately, and no further rules are checked. This filtering happens before the packet reaches the resource or leaves it, ensuring security enforcement at the network boundary.

Why designed this way?

Azure designed NSGs with priority-based rules to provide flexible, fine-grained control over traffic. The fixed priority range allows predictable rule evaluation order. Default rules ensure baseline security without user configuration. This design balances ease of use, security, and performance by filtering traffic close to the resource and avoiding complex rule evaluation overhead.

┌─────────────────────────────┐
│ Incoming Network Packet      │
└─────────────┬───────────────┘
              │
      ┌───────▼────────┐
      │ NSG Rule List  │
      │ (Priority 100) │
      ├───────────────┤
      │ (Priority 200) │
      ├───────────────┤
      │ (Priority 4096)│
      └───────┬────────┘
              │
      ┌───────▼────────┐
      │ Match Found?   │
      ├───────────────┤
      │ Yes → Apply    │
      │ Action (Allow/ │
      │ Deny)          │
      └───────────────┘
              │
      ┌───────▼────────┐
      │ Packet Allowed │
      │ or Denied      │
      └────────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Do NSG rules apply only to inbound traffic? Commit to yes or no.

Common Belief: NSG rules only control inbound traffic to Azure resources.

Reality: NSG rules control both inbound and outbound traffic separately, allowing control over data entering and leaving resources.

Why it matters: Ignoring outbound rules can leave resources vulnerable to data leaks or malware communicating externally.

Quick: Can you delete Azure's default NSG rules? Commit to yes or no.

Common Belief: You can delete or modify Azure's default NSG rules to customize security fully.

Reality: Default NSG rules are built-in, cannot be deleted, and provide a secure baseline. You can override them only by creating custom rules with higher priority.

Why it matters: Trying to delete default rules can cause confusion and misconfiguration, leading to unexpected traffic behavior.

Quick: If two NSG rules conflict, does Azure combine them or pick one? Commit to your answer.

Common Belief: Azure combines conflicting NSG rules to allow traffic if any rule allows it.

Reality: Azure applies only the first matching rule by priority. If a deny rule has higher priority than an allow rule, traffic is denied.

Why it matters: Misunderstanding this can cause security holes or block legitimate traffic unintentionally.

Quick: Is it safe to allow all inbound traffic on port 80? Commit to yes or no.

Common Belief: Allowing all inbound traffic on common ports like 80 is safe and standard practice.

Reality: Allowing all inbound traffic on any port exposes resources to attacks. It's safer to restrict access to trusted sources.

Why it matters: Overly permissive rules increase risk of breaches and compromise.

Expert Zone

1

NSG rules attached to a subnet apply to all resources in that subnet, but rules on individual network interfaces override subnet rules, allowing granular control.

2

Azure processes NSG rules for both inbound and outbound traffic independently, so a packet can be allowed inbound but denied outbound or vice versa.

3

Effective security depends on the combined effect of NSGs, Azure Firewall, and Application Security Groups, requiring careful coordination to avoid conflicts.

When NOT to use

NSGs are not suitable for deep packet inspection or application-layer filtering. For advanced security needs like threat detection or web application firewall, use Azure Firewall or Azure Application Gateway instead.

Production Patterns

In production, NSGs are often combined with Application Security Groups to group resources logically and apply rules at scale. Teams use Infrastructure as Code tools like ARM templates or Terraform to manage NSG rules consistently. Monitoring and logging NSG flow logs helps detect anomalies and audit traffic.

Connections

Firewall Rules

NSG rules are a simpler, network-layer filtering mechanism, while firewall rules provide deeper inspection and more features.

Understanding NSG rules clarifies the foundation upon which more advanced firewall protections build.

Access Control Lists (ACLs)

NSG rules function similarly to ACLs in traditional networking, controlling traffic based on IP and port criteria.

Knowing ACLs helps grasp NSG rules quickly, as both enforce network traffic policies.

Physical Security Checkpoints

Both NSG rules and physical checkpoints control who can enter or leave a protected area based on rules.

Recognizing this parallel helps appreciate the importance of direction-specific controls and priority in security.

Common Pitfalls

#1 Allowing all inbound traffic without restrictions.

Wrong approach:

Priority: 100
Direction: Inbound
Source: *
Destination: *
Protocol: Any
Port: *
Action: Allow

Correct approach:

Priority: 100
Direction: Inbound
Source: Specific IP range (e.g., 192.168.1.0/24)
Destination: *
Protocol: TCP
Port: 80
Action: Allow

Root cause:

Misunderstanding that open rules expose resources to attacks; failing to limit source and port reduces security.

#2 Assuming outbound traffic is always allowed and ignoring outbound rules.

Wrong approach:

No outbound NSG rules configured, relying on defaults.

Correct approach:

Priority: 100
Direction: Outbound
Destination: Specific IP range
Protocol: TCP
Port: 443
Action: Allow
Priority: 200
Direction: Outbound
Destination: *
Protocol: Any
Port: *
Action: Deny

Root cause:

Overlooking outbound traffic control can allow data leaks or malware communication.

#3 Creating conflicting rules with incorrect priorities causing unexpected traffic blocks.

Wrong approach:

Priority: 100
Direction: Inbound
Source: *
Protocol: TCP
Port: 22
Action: Deny
Priority: 200
Direction: Inbound
Source: 10.0.0.0/24
Protocol: TCP
Port: 22
Action: Allow

Correct approach:

Priority: 100
Direction: Inbound
Source: 10.0.0.0/24
Protocol: TCP
Port: 22
Action: Allow
Priority: 200
Direction: Inbound
Source: *
Protocol: TCP
Port: 22
Action: Deny

Root cause:

Not ordering rules properly causes deny rules to override intended allow rules.

Key Takeaways

NSG rules are essential filters that control inbound and outbound network traffic to protect Azure resources.

Rules have priorities and are processed in order; the first matching rule determines whether traffic is allowed or denied.

Default NSG rules provide a secure baseline and cannot be deleted but can be overridden by custom rules.

Effective security requires carefully crafting inbound and outbound rules to allow only necessary traffic from trusted sources.

Understanding rule conflicts and Azure's processing order is critical to avoid unintended access or blocks.