--- cuppy_hub: azure cuppy_path: reference/networking/firewall-and-ddos.md cuppy_section: docs cuppy_doc: SMF9-HBEJ cuppy_doc_uuid: 4c5a0fe7-03d9-4e2f-8b27-10514cacdc87 cuppy_permalink: https://cuppy.io/azure/d/SMF9-HBEJ cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/reference/networking/firewall-and-ddos cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 7c0ebf53a27fdd8120d85b10cec8b2af4fd1997af3fd8243c568335fa8c7a445 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Azure Firewall and DDoS Protection ## SKUs | | Basic | Standard | Premium | |---|---|---|---| | For | Small sites (up to 250 Mbps) | Most hubs; autoscale to 30 Gbps | Sensitive workloads | | FQDN filtering | Application rules only | Also network rules (all ports) | Same | | DNS proxy and custom DNS | No | Yes | Yes | | Threat intelligence | Alert only | Alert and deny | Alert and deny | | TLS inspection, IDPS, URL filtering | No | No | Yes | | Private-IP DNAT | No | Yes | Yes | | Management NIC | Always | Choose at creation | Choose at creation | The firewall goes in **`AzureFirewallSubnet`** (/26 or larger). Moving a firewall to another resource group or subscription isn't supported: delete and recreate. `az network firewall` comes from the **`azure-firewall` CLI extension**, not core CLI. ## How rules are processed - **Deny by default.** Rules are terminating. - Order: **rule collection groups by priority** (100 is highest, 65,000 lowest), then **collections by priority**, but always **DNAT rules, then network rules, then application rules**, whatever the priorities. A **parent policy's** groups always win over a child's. - An HTTP/HTTPS flow allowed by a **network rule** never reaches application rules. With threat intelligence in alert-only mode, network rules for 80/443 hide its alerts: filter web traffic with application rules, or set **Alert and Deny**. - **FQDNs in network rules need DNS proxy** on the firewall and clients using the firewall as their DNS server; otherwise the client and the firewall can resolve differently. Child policies don't inherit DNS settings from the parent: set them on each child. ## SNAT and egress - Network-rule traffic to **RFC 1918** (and RFC 6598) destinations isn't SNATed; everything else is SNATed to a firewall public IP. **Application rules always SNAT.** Set private ranges to `0.0.0.0/0` to never SNAT, or `255.255.255.255/32` to always SNAT; keep RFC 1918 in a custom list; or turn on auto-learn SNAT routes. With a firewall policy, set the ranges in the policy. - **2,496 SNAT ports per public IP per backend instance** (two instances by default). Add public IPs, or attach a **NAT gateway** to `AzureFirewallSubnet`, before SNAT exhaustion (`reference/networking/outbound-connectivity.md`). - Inbound DNAT always rewrites the client source address: read `X-Forwarded-For` for web traffic. ICMP and other non-TCP/UDP rules don't work to the internet (they work between VNets). Outbound TCP 25 is blocked by the platform. - **Forced tunnelling** (0.0.0.0/0 to on-premises or an NVA) needs the **management NIC**: an `AzureFirewallManagementSubnet` (/26 or larger) with its own public IP, a default route to the internet only, and gateway route propagation off. Enable it at creation, or stop and restart an existing Standard or Premium firewall with it. **DNAT from the internet doesn't work with forced tunnelling** (asymmetric routing). - After a deallocate and allocate, the firewall's private IP can change: UDRs pointing at the old address blackhole traffic. Private-IP DNAT rules block re-allocation: delete them, allocate, then re-add. - Some regions and zones block new firewall deployments for a period; check Microsoft's known-issues page before templating zones. ## DDoS Protection Every public IP has free **infrastructure protection**. Paid tiers add tuned mitigation, telemetry and reports: | | DDoS IP Protection | DDoS Network Protection | |---|---|---| | Enabled on | Each public IP (`ddosSettings.protectionMode: Enabled`) | A plan linked to VNets; one plan can cover many subscriptions in a tenant | | Basic public IPs | No | Yes | | Rapid response, cost protection, WAF discount | No | Yes | | Billed | Per protected IP | Per 100 protected IPs | Neither protects a **public IP attached to a NAT gateway**, multitenant PaaS endpoints, or Virtual WAN; VPN gateway protection has no adaptive tuning yet. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.