Skip to content

Contact sales

By filling out this form and clicking submit, you acknowledge our privacy policy.
  • Labs icon Lab
  • A Cloud Guru
Azure icon
Labs

Attach a Firewall to a Virtual Network in Azure (v2)

Your company needs to restrict outgoing traffic from their server using a firewall. They want you to block users from visiting anything besides `https://www.microsoft.com`, and they don't want to allow port `53` outbound from the server. You will create a firewall and connect it to your virtual network as a solution.

Try for free Contact sales
Azure icon
Labs

Path Info

Level
Clock icon Advanced
Duration
Clock icon 1h 15m
Published
Clock icon Jun 28, 2024

Contact sales

By filling out this form and clicking submit, you acknowledge our privacy policy.

Table of Contents

  1. Challenge

    Create a Firewall

    Note: Please use the Classic rules; otherwise, the lab will not grade correctly.

    1. Log in to the Azure portal with the credentials provided.
    2. Create a new Azure firewall named fw-1.
    3. Use the existing virtual network provisioned with this lab.
    4. Create a new public IP for the firewall.
    5. Match the region of the firewall to the same region as the lab-provided resource group.

  2. Challenge

    Create a Route Table

    1. Create a new route table named route1.
    2. Create a route named route1 that routes all traffic (0.0.0.0/0) to a virtual appliance with a next hop address of your Azure firewall's private IP.
    3. Associate routetable1 with the lab-VM-VNET virtual network and the default subnet.

  3. Challenge

    Configure Rule Collections for Firewall

    1. Add a NAT rule that will route traffic from the firewall public IP to the private IP of the server over 3389 (RDP).
      • Name the collection natcollection.
      • Name the rule rdp.
    2. Add a network rule to allow UDP port 53 outbound to Google public DNS servers (8.8.8.8 and 8.8.4.4).
      • Name the collection netcollection.
      • Name the rule dns.
    3. Configure an application rule collection to allow www.microsoft.com from the default subnet CIDR over the http and https protocols under Target FQDNs.
      • Name the collection appcollection.
      • Name the rule microsoftcom.
    4. Add the public DNS servers to the network interface of the virtual machine.

  4. Challenge

    Test Connectivity

    1. Log in to the server using the public IP address of the firewall. Success in this validates your NAT (Network Address Translation) rule for RDP.
    2. Open Internet Explorer and go to https://www.microsoft.com. Success in this validates your application rule for HTTP and HTTPS to this website.
    3. Test DNS using nslookup -type=TXT test.dns.google.com. dns.google. to find that you are successfully using the Google DNS servers. Success in this validates the network rule for DNS traffic on port 53 (UDP).
A Cloud Guru - Labs - Attach a Firewall to a Virtual Network in Azure (v2)
Author
A Cloud Guru

The Cloud Content team comprises subject matter experts hyper focused on services offered by the leading cloud vendors (AWS, GCP, and Azure), as well as cloud-related technologies such as Linux and DevOps. The team is thrilled to share their knowledge to help you build modern tech solutions from the ground up, secure and optimize your environments, and so much more!

What's a lab?

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

Provided environment for hands-on practice

We will provide the credentials and environment necessary for you to practice right within your browser.

Guided walkthrough

Follow along with the author’s guided walkthrough and build something new in your provided environment!

Did you know?

On average, you retain 75% more of your learning if you get time for practice.

Start learning by doing today

View Plans