Destination network address translation maps inbound traffic sent to Azure Firewall’s public IP address to an internal Azure resource. It supports management access but expands exposure, so restrict sources, ports, and protocols carefully. section 3.2.7
Azure Firewall processes traffic through rule types in this order:
- Apply DNAT rules to traffic addressed to the firewall. section 3.2.7
- Evaluate network rules, then application rules, if no DNAT match applies. section 3.2.7
- Block traffic by default when no rule matches. section 3.2.7
- Organize rules in rule collections and optionally group collections into rule collection groups. section 3.2.7
Listing 3.5 Creating a DNAT rule for Azure Firewall
az network firewall nat-rule create --collection-name Nat-Coll01 #1 --dest-addr 209.244.0.3 #2 --destination-ports 53 #3 --firewall-name Contoso-FW01 #4 --name DNAT-MgmtAccess #5 --protocols TCP UDP #6 --resource-group myResourceGroup --source-addresses 10.0.0.1 #7 --translated-address 128.1.1.1 #8 --translated-port 126 #9 --priority 201 #10 --action Dnat #11 #1 The name of the rule collection; will be created automatically if one doesn’t exist #2 The destination IP addresses in CIDR format; you can use '*' for the rule to apply to all IP addresses #3 The destination port; you can use '*' for rule to apply to all ports #4 The name of the Azure Firewall #5 The name of the DNAT rule #6 The protocols used; accepted values are Any, ICMP, TCP, and UDP #7 The source IP address in CIDR format #8 The translated IP address for the DNAT rule #9 The translated port for the DNAT rule #10 The number value that specifies the priority of the rule collection; it can range from 100 (high priority) to 65000 (low priority) #11 The action that applies to the rule collection; for DNAT rules, the value is Dnat
Use the Azure CLI command to create a DNAT rule with a collection, firewall, destination, source, protocols, translated address, translated port, priority, and Dnat action. section 3.2.7
Creating rule collection 'Net-Coll01'. { "description": null, "destinationAddresses": [ "209.244.0.3" ], "destinationPorts": [ "53" ], "destinationFqdns": [], "destinationIpGroups": [], "name": "DNAT-MgmtAccess", "protocols": [ "TCP", "UDP" ], "sourceAddresses": [ "10.0.0.1" ], "sourceIpGroups": [] } ...
Inspect representative output to verify the rule name, source and destination addresses, destination port, and TCP/UDP protocols. section 3.2.7
