🔐 Azure VM Security Lab: Using NSGs and Azure Firewall (Beginner-Friendly Guide)

Goal of this Lab

Learn how to secure a Virtual Machine (VM) in Azure using Network Security Groups (NSGs) and Azure Firewall — two key tools that control and filter network traffic in and out of your Azure resources.

This lab is part of https://securecloudx.pages.dev/ challenges.

What You'll Learn

• What NSGs and Azure Firewall are, and how they work

• How to build a secure virtual network from scratch

• How to create and apply firewall and routing rules

• How to test inbound (SSH/RDP) and outbound (internet) access securely

Before We Start: Key Concepts Explained Simply

What is a Network Security Group (NSG)?

Think of it like a mini-firewall for your subnet or VM. It controls what kind of traffic is allowed in or out based on rules you define (like port, IP, or protocol).

What is Azure Firewall?

A managed, cloud-based network security service that lets you centrally control and monitor traffic across multiple networks in Azure. It provides:

• DNAT (port forwarding) rules

• Outbound filtering

• Centralized logging

• Application rules (e.g., allow only specific websites)

Lab Architecture

🛠️ Lab Setup: Step-by-Step Guide

🌐 1. Create a Resource Group and Virtual Network

1. Go to the Azure Portal

2. Search for Resource groups → + Create

   • Name: Lab-RG

   • Region: Your choice (e.g., East US)

3. Go to Virtual Networks → + Create

   • Name: MyVNet

   • Address space: 10.0.0.0/16

   • Subnets:

     • AzureFirewallSubnet → 10.0.1.0/26

     • AzureFirewallManagementSubnet → 10.0.2.0/26

     • VMSubnet → 10.0.3.0/24

🌍 2. Create a Public IP for the Firewall

1. Go to Public IP addresses → + Create

   • Name: MyFirewallPIP

   • SKU: Standard

   • IP Type: Static

   • Tier: Regional

🔥 3. Deploy Azure Firewall

1. Go to Azure Firewall → + Create

2. Settings:

   • Name: MyFirewall

   • Region: same as the VNet

   • Policy: Create new or use default

   • Public IP: MyFirewallPIP

   • Virtual Network: MyVNet

   • Subnets: AzureFirewallSubnet, AzureFirewallManagementSubnet

💻 4. Deploy a Linux Test VM (No public IP)

1. Go to Virtual Machines → + Create

   • Name: TestVM

   • Image: Ubuntu LTS

   • Size: B1s or B2s

   • Authentication: Password or SSH key

   • Virtual network: MyVNet

   • Subnet: VMSubnet

   • Public IP: None

🛡️ 5. Create NSG for VM Subnet

1. Go to Network Security Groups → + Create

   • Name: VMSubnetNSG

   • Attach to: VMSubnet

2. Add Inbound rule:

   • Allow SSH (TCP 22) from your IP

   • Priority: 100

3. Add Deny all inbound:

   • Priority: 400

   • Source: Any, Port: Any

🚳️ 6. Route VM Traffic Through Firewall

1. Go to Route Tables → + Create

   • Name: VMRouteTable

   • Associate to: VMSubnet

2. Add route:

   • Name: DefaultRoute

   • Address prefix: 0.0.0.0/0

   • Next hop type: Virtual appliance

   • Next hop IP: Firewall's private IP

🔄 7. Add DNAT Rule (SSH into VM via Firewall)

1. Go to the Firewall Policy > NAT Rules > + Add

   • Name: AllowSSH

   • Rule Type: DNAT

   • Source: *

   • Destination IP: Firewall’s public IP

   • Destination Port: 22

   • Translated IP: VM Private IP

   • Translated Port: 22

   • Protocol: TCP

🌐 8. Add Network Rule for Internet Access

1. Go to Firewall Policy > Network Rules > + Add

   • Name: AllowOutboundWeb

   • Source: 10.0.3.0/24

   • Destination: *

   • Protocol: TCP

   • Destination Ports: 80, 443

🔢 Test It Out!

SSH Into the VM

ssh azureuser@<Firewall_Public_IP>

Test Internet from VM

ping 8.8.8.8 -c 4
curl http://bing.com

🔧 Troubleshooting Tips

🚫 Can’t SSH into the VM

• Check DNAT rule: maps Firewall Public IP to VM Private IP, port 22

• Confirm NSG allows SSH from your IP

• Ensure the VM has no public IP

• Use correct SSH key or username

🌐 VM Can’t Access Internet

• Ensure route table has 0.0.0.0/0 to Firewall Private IP

• Firewall allows outbound 80/443

• DNS resolution working? Try:

nslookup bing.com
ping 8.8.8.8

🔥 Firewall Fails to Deploy ("LinkedAccessCheckFailed")

• You don’t have permission to join the subnet

• Ask admin for Network Contributor role on the subnet or resource group

• Assign network contributor role at the resource group level - possible solution

🚫 Firewall Has No Public IP

• Create one before Firewall deployment (Standard SKU)

• Redeploy or assign it manually

🔍 Debugging Tools

• VM NIC > Effective Routes: check for route to firewall

• VM NIC > Effective Security Rules: confirm NSG rules

• Azure Network Watcher: use Connection Troubleshoot

🌟 Bonus Tips

• Use Azure Bastion if SSH fails

• Tag your resources

• Monitor with Log Analytics

• Clean up using:

az group delete --name Lab-RG --yes

🎓 You Did It!

You built a secure Azure network with:

• NSGs for granular subnet protection

• Azure Firewall for centralized control

• Routing and NAT for internet access and SSH