Network security group

As explained in Microsoft Azure in Action

A network security group is an Azure traffic-filtering configuration that allows or denies inbound and outbound network connections according to prioritized rules.

A virtual machine may need SSH or RDP access, but opening a port should not mean welcoming every visitor. An Azure network security group (NSG) filters inbound and outbound traffic to a subnet or a VM’s network interface. Routing determines where traffic goes; the NSG determines whether it may arrive or leave. section 3.3.3 section 4.3

Figure 4.8 NSG1 applies to all VMs in the subnet, but NSG2 only applies to VM4.

Compare the scope of an NSG assigned to a subnet with one assigned to a single VM’s network interface. Subnet-level placement avoids managing a separate NSG for each VM. section 4.3 section 3.3.3

Each security rule answers three practical questions:

• What traffic matches? Specify its direction, source and destination, port, and protocol. Sources and destinations can include an IP address, a CIDR range, or an Azure service tag. section 4.3
• What happens? Set the action to Allow or Deny. section 4.3
• Which rule wins? Lower priority numbers run first; evaluation stops at the first match. Custom priorities run from 100 to 4,096, while the listed default rules at 65,000–65,002 cannot be removed. section 4.3

Table 4.3 Inbound security rules for a default NSG

Priority	Name	Port	Protocol	Source	Destination	Action
300	SSH	22	TCP	Any	Any	Allow
65000	AllowVNetInbound	Any	Any	VNet	VNet	Allow
65001	AllowAzureLoad­Balancer InBound	Any	Any	Azure Load Balancer	Any	Allow
65002	DenyAllInbound	Any	Any	Any	Any	Deny

Inspect the inbound-rule table: its priority-300 SSH rule allows TCP port 22 from any source, ahead of the default inbound rules. That broad source is worth noticing before using the configuration. section 4.3

Restrict RDP access with Azure PowerShell

Create an NSG with New-AzNetworkSecurityGroup, attach it to a subnet with Set-AzVirtualNetworkSubnetConfig, and save the VNet with Set-AzVirtualNetwork. Then add an inbound TCP rule using Add-AzNetworkSecurityRuleConfig: priority 300, source my.ip.address, destination port 3389, action Allow. Replace the example source-address placeholder with the address that should connect, then save the NSG with Set-AzNetworkSecurityGroup. section 4.3

VM setup offers None, Basic port presets, or Advanced NSG configuration. Basic can get a VM connected, but review its open ports rather than treating a preset as a finished security policy. Azure Bastion is another option for browser-based RDP or SSH without exposing a public IP address. section 3.3.3 section 4.6

How Microsoft Azure in Action covers it

How deep it goes

Explains subnet and NIC placement, rule fields, priority order, defaults, and PowerShell configuration.

Examples

Illustrates subnet-versus-VM placement, default inbound rules, and a PowerShell rule restricting RDP to one source address.

What it assumes

Assumes familiarity with virtual machines and remote-access ports while introducing subnets and CIDR address ranges.

What you can do after

Apply it via Azure PowerShell to create an NSG, associate it with a subnet, and add a restricted inbound RDP rule.

How it connects

Connects virtual networks, subnets, network interfaces, routing tables, service tags, and remote-access ports.

liveBookmanning.com

Read Microsoft Azure in Action on liveBook Get the book at manning.com

Related concepts

• network interfaceconfigures · A network interface is a physical or logical connection point through which a system sends and receives network traffic.
• automationused by · Automation is the execution of tasks or processes by machines or software with reduced direct human intervention.
• subnetworkconfigures · A subnetwork is a logical subdivision of an IP network with its own address range, routing scope, and network configuration.
• security rulehas part · A security rule is a declarative configuration that specifies conditions and the permitted or prohibited behavior for matching requests, traffic, access, or settings.
• firewall ruleequivalent to · A firewall rule is a network access-control specification that permits or denies matching traffic according to defined characteristics and conditions.
• virtual machineaddresses · A virtual machine is a software-based environment that emulates or implements an abstract computer system, providing an interface on which an operating system or programs can execute.

This explainer was generated by Manning's knowledge graph from the text of Microsoft Azure in Action. The section links point to the parts of the book it draws on.