Azure SQL firewall rules - Step-by-Step Execution

Process Flow - Azure SQL firewall rules

Start: Azure SQL Server

↓

Check incoming connection IP

↓

Is IP in firewall rules?

No→Reject connection

Yes↓

Allow connection to database

↓

Connection established

Azure SQL checks the IP of incoming connections against firewall rules. If allowed, connection proceeds; otherwise, it is blocked.

Execution Sample

Azure

az sql server firewall-rule create --resource-group MyGroup --server MyServer --name AllowClientIP --start-ip-address 192.168.1.1 --end-ip-address 192.168.1.1

This command creates a firewall rule allowing the IP 192.168.1.1 to access the Azure SQL server.

Process Table

Step	Action	Input IP	Firewall Rules Checked	Result	Connection Status
1	Incoming connection attempt	192.168.1.1	No rules yet	No match	Rejected
2	Create firewall rule	192.168.1.1	Add rule 192.168.1.1 - 192.168.1.1	Rule added	N/A
3	Incoming connection attempt	192.168.1.1	Check rule 192.168.1.1 - 192.168.1.1	Match found	Allowed
4	Incoming connection attempt	192.168.1.2	Check rule 192.168.1.1 - 192.168.1.1	No match	Rejected

💡 Connection attempts stop after allowed or rejected based on firewall rules.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4
FirewallRules	[]	[192.168.1.1-192.168.1.1]	[192.168.1.1-192.168.1.1]	[192.168.1.1-192.168.1.1]
ConnectionIP	192.168.1.1	192.168.1.1	192.168.1.1	192.168.1.2
ConnectionStatus	Rejected	N/A	Allowed	Rejected

Key Moments - 2 Insights

Why was the first connection attempt rejected even though the IP was 192.168.1.1?

Because no firewall rules existed yet at step 1, so the IP was not allowed. The rule was added only at step 2.

Does the firewall rule allow IPs outside the specified range?

No, only IPs within the start and end IP addresses in the firewall rule are allowed, as shown at step 4 where 192.168.1.2 was rejected.

Visual Quiz - 3 Questions

Look at the execution table, what is the connection status at step 3 for IP 192.168.1.1?

A Rejected

B Pending

C Allowed

D Unknown

💡 Hint

Check the 'Connection Status' column at step 3 in the execution_table.

At which step is the firewall rule created?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at the 'Action' column for when the rule is added in the execution_table.

If the firewall rule allowed IP range 192.168.1.1 to 192.168.1.5, what would be the connection status for IP 192.168.1.4 at step 4?

A Allowed

B Rejected

C Pending

D Error

💡 Hint

Refer to the variable_tracker and execution_table logic about IP range matching.

Concept Snapshot

Azure SQL firewall rules control which IP addresses can connect.
Rules specify start and end IP addresses.
Incoming IPs are checked against these rules.
If IP matches, connection is allowed; otherwise, rejected.
Rules must be created before connections are accepted.

Full Transcript

Azure SQL firewall rules work by checking the IP address of any incoming connection against a list of allowed IP ranges. If the IP is within any allowed range, the connection is permitted. Otherwise, it is blocked. Initially, no rules exist, so connections are rejected. When a rule is created specifying a start and end IP address, connections from IPs in that range are allowed. This process ensures only trusted IPs can access the Azure SQL server.