Azure Firewall and DDoS Protection — SKUs, rule processing order, SNAT, forced tunnelling and the management NIC, DNS proxy, known issues, DDoS tiers
How Azure Firewall decides and translates traffic — Basic, Standard and Premium, rule collection group and collection priorities with DNAT before network before application rules, parent policy precedence, SNAT defaults and private ranges, SNAT ports per IP, forced tunnelling with the management NIC (and no DNAT), DNS proxy for FQDNs in network rules, the known issues that bite, and DDoS IP Protection versus Network Protection with their limits.
markdownreferencev1SMF9-HBEJstage: designtrust: officialservice: networkinginterface: iacinterface: portalAzure FirewallAzure Firewall Basic Standard Premiumfirewall policyrule collection group priorityDNAT network application rule orderparent policy precedenceAzureFirewallSubnet /26AzureFirewallManagementSubnetManagement NICforced tunneling Azure FirewallDNAT not supported with forced tunnelingSNAT private IP ranges0.0.0.0/0 never SNAT255.255.255.255/32 always SNATauto-learn SNAT routes2496 SNAT ports per public IPDNS proxy FQDN network rulesthreat intelligence alert maskedICMP internet SNAT not supportedaz network firewall extension azure-firewallfirewall private IP changes after deallocateDDoS Network ProtectionDDoS IP ProtectionDDoS NAT gateway public IP not supportedddosSettings protectionMode
Azure Firewall and DDoS Protection
SKUs
| Basic | Standard | Premium | |
|---|---|---|---|
| For | Small sites (up to 250 Mbps) | Most hubs; autoscale to 30 Gbps | Sensitive workloads |
| FQDN filtering | Application rules only | Also network rules (all ports) | Same |
| DNS proxy and custom DNS | No | Yes | Yes |
| Threat intelligence | Alert only | Alert and deny | Alert and deny |
| TLS inspection, IDPS, URL filtering | No | No | Yes |
| Private-IP DNAT | No | Yes | Yes |
| Management NIC | Always | Choose at creation | Choose at creation |
The firewall goes in AzureFirewallSubnet (/26 or larger). Moving a firewall to another resource group or subscription isn't supported: delete and recreate. az network firewall comes from the azure-firewall CLI extension, not core CLI.
How rules are processed
- Deny by default. Rules are terminating.
- Order: rule collection groups by priority (100 is highest, 65,000 lowest), then collections by priority, but always DNAT rules, then network rules, then application rules, whatever the priorities. A parent policy's groups always win over a child's.
- An HTTP/HTTPS flow allowed by a network rule never reaches application rules. With threat intelligence in alert-only mode, network rules for 80/443 hide its alerts: filter web traffic with application rules, or set Alert and Deny.
- FQDNs in network rules need DNS proxy on the firewall and clients using the firewall as their DNS server; otherwise the client and the firewall can resolve differently. Child policies don't inherit DNS settings from the parent: set them on each child.
SNAT and egress
- Network-rule traffic to RFC 1918 (and RFC 6598) destinations isn't SNATed; everything else is SNATed to a firewall public IP. Application rules always SNAT. Set private ranges to
0.0.0.0/0to never SNAT, or255.255.255.255/32to always SNAT; keep RFC 1918 in a custom list; or turn on auto-learn SNAT routes. With a firewall policy, set the ranges in the policy. - 2,496 SNAT ports per public IP per backend instance (two instances by default). Add public IPs, or attach a NAT gateway to
AzureFirewallSubnet, before SNAT exhaustion (reference/networking/outbound-connectivity.md). - Inbound DNAT always rewrites the client source address: read
X-Forwarded-Forfor web traffic. ICMP and other non-TCP/UDP rules don't work to the internet (they work between VNets). Outbound TCP 25 is blocked by the platform. - Forced tunnelling (0.0.0.0/0 to on-premises or an NVA) needs the management NIC: an
AzureFirewallManagementSubnet(/26 or larger) with its own public IP, a default route to the internet only, and gateway route propagation off. Enable it at creation, or stop and restart an existing Standard or Premium firewall with it. DNAT from the internet doesn't work with forced tunnelling (asymmetric routing). - After a deallocate and allocate, the firewall's private IP can change: UDRs pointing at the old address blackhole traffic. Private-IP DNAT rules block re-allocation: delete them, allocate, then re-add.
- Some regions and zones block new firewall deployments for a period; check Microsoft's known-issues page before templating zones.
DDoS Protection
Every public IP has free infrastructure protection. Paid tiers add tuned mitigation, telemetry and reports:
| DDoS IP Protection | DDoS Network Protection | |
|---|---|---|
| Enabled on | Each public IP (ddosSettings.protectionMode: Enabled) | A plan linked to VNets; one plan can cover many subscriptions in a tenant |
| Basic public IPs | No | Yes |
| Rapid response, cost protection, WAF discount | No | Yes |
| Billed | Per protected IP | Per 100 protected IPs |
Neither protects a public IP attached to a NAT gateway, multitenant PaaS endpoints, or Virtual WAN; VPN gateway protection has no adaptive tuning yet.