Create and configure NSG inbound and outbound rules

5.1 Network Security Groups (NSGs) and ASGs

📘Microsoft Azure Networking Solutions (AZ-700)

Overview

A Network Security Group (NSG) in Azure is like a digital firewall for your virtual network. It controls network traffic to and from resources (like virtual machines, subnets, or NICs).

NSGs use rules to allow or deny traffic based on:

Source (where the traffic comes from)
Destination (where the traffic goes)
Port (which service/port the traffic is trying to reach)
Protocol (TCP, UDP, or Any)

NSG Components

Inbound rules – control incoming traffic to a resource.
Outbound rules – control outgoing traffic from a resource.

Each rule has a priority number, a name, protocol, source, destination, port range, and action (allow/deny).

Step 1: Understand Rule Priority

NSG rules are processed by priority numbers, from lowest (100) to highest (4096).
A lower number means higher priority.
Once a packet matches a rule, the NSG stops processing further rules.
Example priorities:
- 100–499: Custom rules
- 65000–65500: Default rules (deny by default or allow basic traffic)

For the exam, remember: lower priority wins.

Step 2: Default NSG Rules

Every NSG has default rules, which cannot be deleted but can be overridden by custom rules:

Direction	Rule Name	Action	Purpose
Inbound	AllowVNetInBound	Allow	Allows VMs within the same VNet to talk
Inbound	AllowAzureLoadBalancerInBound	Allow	Allows Azure Load Balancer health probes
Inbound	DenyAllInbound	Deny	Denies all other incoming traffic
Outbound	AllowVNetOutBound	Allow	Allows outbound to other VMs in the same VNet
Outbound	AllowInternetOutBound	Allow	Allows outbound to the internet
Outbound	DenyAllOutbound	Deny	Denies all other outgoing traffic

Exam tip: Default rules exist, and you can override them with custom rules.

Step 3: Creating NSG Rules

When creating custom rules, you need to specify:

Name – e.g., Allow-SSH
Priority – e.g., 100 (important for ordering)
Direction – inbound or outbound
Source – IP range, subnet, or application security group (ASG)
Destination – IP range, subnet, VM, or ASG
Protocol – TCP, UDP, or Any
Port Range – specific port (e.g., 22 for SSH) or range (80-443)
Action – Allow or Deny

Example: Inbound Rule

Purpose: Allow SSH traffic to a VM
Direction: Inbound
Source: Any
Destination: VM’s NIC or subnet
Protocol: TCP
Port: 22
Action: Allow
Priority: 100

Example: Outbound Rule

Purpose: Block all outbound traffic to a specific IP
Direction: Outbound
Source: VM subnet
Destination: Specific IP (e.g., 10.1.1.10)
Protocol: Any
Port: Any
Action: Deny
Priority: 200

Exam tip: You must know how inbound and outbound rules differ and that direction matters.

Step 4: Configure NSG Rules in the Portal

Go to Azure Portal → Network Security Groups.
Select the NSG you want.
Go to Inbound Security Rules or Outbound Security Rules.
Click Add.
Fill in the fields: name, priority, source, destination, protocol, port, and action.
Click Save.

Important: Changes are applied immediately, no need to restart VMs.

Step 5: Best Practices for NSG Rules

Use lowest priority numbers for critical rules.
Use ASGs when you want rules applied to a group of VMs, not individual IPs.
Limit source/destination when possible (don’t use Any unless needed).
Audit rules regularly to avoid conflicts.
Use descriptive names for clarity (e.g., Allow-HTTP-Inbound).

Step 6: Exam Key Points

Inbound rules: Control traffic coming into a resource.
Outbound rules: Control traffic leaving a resource.
Priority numbers: Lower number = higher priority.
Action: Allow or Deny.
Default rules exist but can be overridden.
ASGs can be used as source/destination in rules.
Direction matters – inbound vs outbound.

Remember, for the exam, you may be asked to:

Create an NSG rule to allow or block traffic.

Determine which rule takes precedence.

Decide whether the rule should be inbound or outbound.

Summary Table: Inbound vs Outbound

Feature	Inbound	Outbound
Direction	Traffic coming to the VM	Traffic leaving from the VM
Exam focus	Allow access (e.g., SSH, HTTP)	Control outgoing traffic (e.g., block malicious IPs)
Default rule	Deny all inbound (except VNet/Load Balancer)	Deny all outbound (except VNet/Internet)