NSGs and routes — rule evaluation, default rules, service tags, application security groups, user-defined routes and next hops
How Azure decides whether a packet is allowed and where it goes — NSG priorities, five-tuple matching, default rules at 65000–65500, subnet-then-NIC order, service tags and ASGs, platform addresses 168.63.129.16 and 169.254.169.254, port 25, NSG flow log retirement — and route selection, next hop types, and the private endpoint /32 route that overrides broader UDRs.
markdownreferencev1ATTG-WT7Bstage: designtrust: officialservice: networkinginterface: iacinterface: cliNSG priority 100 4096NSG default rulesAllowVnetInBound 65000AllowAzureLoadBalancerInBound 65001DenyAllInBound 65500AllowInternetOutBoundNSG subnet and NIC evaluation orderservice tags VirtualNetwork AzureLoadBalancer Internetapplication security group same virtual network168.63.129.16169.254.169.254outbound port 25 blockedNSG flow logs retirement September 30 2027virtual network flow logsuser-defined routelongest prefix matchroute priority UDR BGP systemnext hop VirtualAppliancenext hop Noneforced tunnelingprivate endpoint /32 route InterfaceEndpointprivateEndpointNetworkPolicies RouteTableEnabledeffective routeseffective security rules
NSGs and routes
Network security group rules
- Priority 100–4096, lowest number first; the first matching rule decides and processing stops. Rules match on the five-tuple (source, source port, destination, destination port, protocol). Two rules can't share a priority and direction. NSGs are stateful: return traffic of an allowed flow is allowed.
- Order: inbound, the subnet's NSG first, then the NIC's; outbound, NIC then subnet. Traffic must be allowed by both when both exist. A subnet or NIC with no NSG allows everything at that level.
- Sources and destinations: IPs, CIDRs, service tags (
VirtualNetwork,AzureLoadBalancer,Internet,Storage.WestEurope,AzureCloud, …) or application security groups. NICs in one ASG must be in the same VNet, and an ASG-to-ASG rule needs both in the same VNet. - Azure Virtual Network Manager security admin rules are evaluated before NSG rules.
Default rules (can't be deleted; override them with lower numbers):
| Direction | Priority | Rule | Effect |
|---|---|---|---|
| Inbound | 65000 | AllowVnetInBound | VirtualNetwork → VirtualNetwork, allow (includes peered VNets and connected on-premises ranges) |
| Inbound | 65001 | AllowAzureLoadBalancerInBound | AzureLoadBalancer → any, allow (health probes) |
| Inbound | 65500 | DenyAllInBound | Deny |
| Outbound | 65000 | AllowVnetOutBound | VirtualNetwork → VirtualNetwork, allow |
| Outbound | 65001 | AllowInternetOutBound | Any → Internet, allow |
| Outbound | 65500 | DenyAllOutBound | Deny |
Things NSGs don't filter, or treat specially:
- 168.63.129.16 and 169.254.169.254 (host DHCP, DNS, IMDS, health) are platform addresses; blocking 168.63.129.16 breaks DNS and load balancer probes.
- Outbound TCP port 25 is blocked for most subscription types created after November 15, 2017 (Enterprise Agreement subscriptions aren't blocked). Use an SMTP relay on 587.
- NSG flow logs retire on September 30, 2027 and can't be created any more; use virtual network flow logs.
Routes
- Each subnet gets system routes: the VNet's own space (
VirtualNetwork),0.0.0.0/0→Internet, and RFC 1918,100.64.0.0/10and other reserved ranges → None (dropped) until they're in your address space. Peering and gateways add more. - Selection: longest prefix match first; for the same prefix, user-defined route > BGP route > system route. System routes for the VNet, peerings and service endpoints are preferred even over more specific BGP routes.
- Next hop types you set in a UDR:
VirtualAppliance(an NVA or firewall IP),VirtualNetworkGateway,Internet,VnetLocal,None(drop). - Forced tunneling (
0.0.0.0/0→ firewall) also sends Azure service traffic through the firewall unless service endpoints or private endpoints give it a more specific path.
The private endpoint /32 route
Every private endpoint adds a /32 route with next hop InterfaceEndpoint to its VNet. Longest prefix wins, so a UDR like 10.0.0.0/8 → VirtualAppliance or 0.0.0.0/0 → firewall does not catch traffic to the endpoint; it goes straight there, bypassing inspection. To force it through a firewall:
- Set
privateEndpointNetworkPolicieson the endpoint's subnet toRouteTableEnabledorEnabled(defaultDisabled);NetworkSecurityGroupEnabledmakes NSGs apply to endpoints. - Add a UDR whose prefix is equal to or more specific than the VNet's address space (a
0.0.0.0/0route is too broad).
az network watcher show-next-hop returning InterfaceEndpoint for an endpoint's IP is this route at work.
Check the effective result
az network nic show-effective-route-table -g <rg> -n <nic> -o table
az network nic list-effective-nsg -g <rg> -n <nic>These need the VM running. The full diagnosis order: guides/networking/diagnose-connectivity.md.