Forum Discussion
NAT Gateway after firewall for outgoing network traffic
Hi guys, I have a bunch of VMs in a subnet. I would like them to have a static outbound IP from a NAT gateway, however I also want to filter the outbound traffic from these VMs through an Azure F...
One of the ways you can manage access to outbound networks from an Azure subnet is with Azure Firewall.
Create a default route for Outbound and Inbound connectivity through the firewall to a default route to 0.0.0.0/0 with the private IP address of next-hop to Virtual appliance. Once the route is created associate the workloads subnets for this route. Configure the necessary application and network rule for outbound access for the VMs should traverse through route traffic
Create a default route for Outbound and Inbound connectivity through the firewall to a default route to 0.0.0.0/0 with the private IP address of next-hop to Virtual appliance. Once the route is created associate the workloads subnets for this route. Configure the necessary application and network rule for outbound access for the VMs should traverse through route traffic
- Although this is true (and basic setup for the Azure Firewall), if the Azure Firewall has multiple public IP addresses, the firewall will randomly select the publi IP address it sees fit (according to MS Docs).
I have the same question as StanAzure1792: Is it possible to implement Azure NAT Gateway at the trusted or untrusted side of the Azure Firewall, in order to use the same outbound public IP address that is bound to the Azure Firewall?
Logically seen:
VM --> NAT Gateway with pub IP --> Azure Firewall (no NAT) --> Internet
or VM --> Azure Firewall --> NAT Gateway with pub IP --> Internet
Root cause of this question is a feature failure/lacking in Azure Firewall, as it does not support designating a specific public IP address for specific outbound traffic through.
This is dearly needed for e.g. sFTP, SSH, coinmining, basically any outbound service...
