Home / server / Questions / 1067019
Accepted
Mike Sherrill 'Cat Recall'
Asked: 2021-06-18 06:09:11 +0800 CST

In an Azure network security group, is denying all traffic before the "AllowVnetInbound" and "AllowAzureLoadBalancerInbound" rules good practice?

  • 772

Inbound rules for an Azure network security group

This set of Azure Network Security Group inbound rules came from a "best practice" blog.

I understand this to mean there isn't any way for any network traffic to pass the "DropAll" rule and reach the "AllowVNetInbound" rule. Do I understand that correctly?

I can imagine a few cases where you might want to deny all inbound traffic from the vNet, but I can't imagine why that would be considered a best practice. (I understand best practice to mean always do this unless there's a seriously compelling reason not to.) What am I missing here?

azure network-security-group

1 Answers

  1. Best Answer

    The only real reason to do this is if you want to ensure that you are in complete control of the rules governing traffic flow, and not defaulting into using the built in rules. In the scenario you showed, intra-vnet traffic is not allowed, as the "AllowVnetInboundTraffic" rule is blocked. You would then need to explicitly define any rules you want to allow traffic between machines on the same (or peered) vNets, if you apply this rule to a subnet.

    • 3