The Secret Life of Azure: The Firewall That Forgot to Lock the Back Door
.jpeg)
Mastering Network Security Groups and the importance of securing the paths you didn't know were open.
Arc 2 — Resource Security & Governance
The library was quiet as the evening sun moved across the floor. Margaret was standing at the chalkboard, where she had drawn a single rectangle labeled Subnet. Inside the rectangle sat a smaller box labeled Virtual Machine.
"Timothy," Margaret said softly, "we have spent much time discussing who is allowed to enter the library. Today, we must discuss how we protect the individual rooms once someone is already inside".
Timothy looked up from his notebook. "You are referring to the Network Security Group, aren't you?"
"I am," Margaret replied, nodding with a smile. "In Azure, the Network Security Group, or NSG, is the primary tool for filtering network traffic. It contains a list of security rules that either allow or deny traffic based on the source, destination, port, and protocol".
The Priority of Rules
Margaret wrote a column of numbers on the board: 100, 200, 300, and 65001.
"Timothy, when a packet of data tries to reach our Virtual Machine, the NSG evaluates the rules in a specific order," she explained. "It starts with the lowest number—the highest priority—and stops as soon as it finds a match. If rule 100 allows the traffic, Azure does not even look at rule 200".
Timothy leaned forward. "So the order of the rules is just as important as the rules themselves. If I put a broad 'Allow' rule at priority 100, any 'Deny' rules I write later at priority 500 will never be checked".
"That is correct," Margaret said. "Precision in priority ensures that your most specific security requirements are met first".
The Default Rules and the 'Back Door'
Margaret pointed to the bottom of her list, where she had written 65001.
"There are rules in every NSG that you did not write, Timothy," she said gently. "These are the Default Rules. They are always there, and they have the lowest priority. One of them is called AllowVnetInbound. It allows any resource within the same Virtual Network to communicate with any other resource by default".
Timothy frowned. "So, even if I haven't written a rule to allow it, a compromised service in a different part of my network could still reach this Virtual Machine?"
"Yes," Margaret confirmed. "This is often overlooked. We focus on blocking traffic from the internet, but we sometimes forget that internal traffic is allowed by default. To truly secure the resource, we must often write a specific 'Deny All' rule at a higher priority to override these defaults".
Inbound and Outbound
Margaret drew two arrows: one pointing toward the box and one pointing away.
"Finally, we must remember that traffic is evaluated twice," she said. "Once when it tries to come in—Inbound—and once when it tries to leave—Outbound. A secure configuration looks at both directions. For example, we might allow a web server to receive traffic on port 443, but we should strictly limit where that server is allowed to send data out".
Putting It into Practice
Timothy studied the diagram. "So, the NSG isn't just a list of blocks; it's a managed sequence of priorities. We have to account for the rules we didn't write just as much as the ones we did".
"Precisely," Margaret said, her voice warm. "Security is about knowing every path that is open, not just the ones you intended to use. By being intentional with our priorities and our 'Deny' rules, we ensure the resource is truly protected".
Key Concepts
- Network Security Group (NSG): A security object containing a list of access control rules that allow or deny network traffic to resources.
- Priority: A number between 100 and 4096 for custom rules; default rules use priorities in the 65000+ range.
- Default Rules: Built-in rules that allow basic connectivity, such as internal VNet communication and Load Balancer probes.
- Stateful: NSGs are stateful; if you allow inbound traffic on a port, the outbound response is automatically allowed without a separate rule.
- Augmented Security Rules: A feature that allows you to group multiple ports and addresses into a single rule for easier management.
Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.
Comments
Post a Comment