Join Log in
Score:0
Mike Sherrill 'Cat Recall' avatar Server

In an Azure network security group, is denying all traffic before the "AllowVnetInbound" and "AllowAzureLoadBalancerInbound" rules good practice?

cn flag
Mike Sherrill 'Cat Recall'

Inbound rules for an Azure network security group

This set of Azure Network Security Group inbound rules came from a "best practice" blog.

I understand this to mean there isn't any way for any network traffic to pass the "DropAll" rule and reach the "AllowVNetInbound" rule. Do I understand that correctly?

I can imagine a few cases where you might want to deny all inbound traffic from the vNet, but I can't imagine why that would be considered a best practice. (I understand best practice to mean always do this unless there's a seriously compelling reason not to.) What am I missing here?

966
1 + 0
Score:3
avatar Server
ng flag
Sam Cogan

The only real reason to do this is if you want to ensure that you are in complete control of the rules governing traffic flow, and not defaulting into using the built in rules. In the scenario you showed, intra-vnet traffic is not allowed, as the "AllowVnetInboundTraffic" rule is blocked. You would then need to explicitly define any rules you want to allow traffic between machines on the same (or peered) vNets, if you apply this rule to a subnet.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.