Forum Discussion

STTHV's avatar
STTHV
Copper Contributor
Jun 20, 2020

Removing Inbound port rule in NSG not blocking traffic

Playing with JIT access to a Windows VM I wanted to close external RDP access prior to JIT time range expiration.

As there does not seem to be a suitable command I tried removing the JIT-generated 3389 allow rule from the NSG associated to both NIC and subnet . While that seemed to succeed with the 3389 deny rule now taking precedence over the default rules as per the attached screenshot, my external RDP connection to the VM kept working without a hitch.

 

Any idea what I might be missing?

 

  • STTHV 

     

    an already established RDP connection to a VM will not be impacted by removing an Allow rule or creating a Deny rule. As stated in the documentation, traffic flows are interrupted when connections are stopped and no traffic is flowing in either direction, for at least a few minutes. If you tried to open a new RDP connection with the Deny rule in place, that connection would normally be blocked.

    • STTHV's avatar
      STTHV
      Copper Contributor

      hspinto 

       

      sadly I must have missed that part in the documentation, thanks for pointing it out to me!  Do you see another option to lock out an an administrative access with immediate effect, ie. without waiting for the set JIT window to expire?

      • hspinto's avatar
        hspinto
        Icon for Microsoft rankMicrosoft

        STTHV 

         

        what you want to accomplish can be done from within the OS. For example, you could trigger an automated that would forcefully logoff all active sessions.

         

        Another option could also be using JIT integrated with Azure Firewall. Unlike NSGs, Azure Firewall drops existing sessions impacted by rule changes. More details here.

Resources