Skip to content

Contact sales

By filling out this form and clicking submit, you acknowledge our privacy policy.
  • Labs icon Lab
  • A Cloud Guru
Azure icon

Attach a Firewall to a Virtual Network in Azure

We are a security engineer that has been tasked with securing our hub VNet using a policy-based Azure Firewall.

Azure icon

Path Info

Clock icon Advanced
Clock icon 1h 15m
Clock icon Oct 09, 2020

Contact sales

By filling out this form and clicking submit, you acknowledge our privacy policy.

Table of Contents

  1. Challenge

    Create a Firewall

    Note: Please use the Policy-based rules; otherwise, the lab will not grade correctly. Note: The firewall resource can take around 45 minutes to deploy

    1. Log in to the Azure portal with the credentials provided.
    2. Create a new Azure firewall named fw-1.
    3. Use the existing virtual network provisioned with this lab.
    4. Create a new public IP for the firewall.
    5. Match the region of the firewall to the same region as the lab-provided resource group.
  2. Challenge

    Create a Route Table

    1. Create a new route table named routetable1.
    2. Create a route named route1 that routes all traffic ( to a virtual appliance with a next hop address of your Azure firewall's private IP.
    3. Associate routetable1 with the lab-VM-VNET virtual network and the default subnet.
  3. Challenge

    Configure Rule Collections for Firewall

    1. Add a DNAT rule that will route traffic from the firewall public IP to the private IP of the server over 3389 (RDP).
      • Name the collection natcollection.
      • Name the rule rdp.
    2. Add a network rule to allow UDP port 53 outbound to Google public DNS servers ( and
      • Name the collection netcollection.
      • Name the rule dns.
    3. Configure an application rule collection to allow from the default subnet CIDR over the http and https protocols under Target FQDNs.
      • Name the collection appcollection.
      • Name the rule wwwmicrosoftcom.
    4. Add the public DNS servers to the network interface of the virtual machine ( and
  4. Challenge

    Test Connectivity

    1. Log in to the server using the public IP address of the firewall. Success in this validates your NAT (Network Address Translation) rule for RDP.
    2. Open Internet Explorer and go to Success in this validates your application rule for HTTP and HTTPS to this website.
    3. Test DNS using nslookup -type=TXT to find that you are successfully using the Google DNS servers. Success in this validates the network rule for DNS traffic on port 53 (UDP).

The Cloud Content team comprises subject matter experts hyper focused on services offered by the leading cloud vendors (AWS, GCP, and Azure), as well as cloud-related technologies such as Linux and DevOps. The team is thrilled to share their knowledge to help you build modern tech solutions from the ground up, secure and optimize your environments, and so much more!

What's a lab?

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

Provided environment for hands-on practice

We will provide the credentials and environment necessary for you to practice right within your browser.

Guided walkthrough

Follow along with the author’s guided walkthrough and build something new in your provided environment!

Did you know?

On average, you retain 75% more of your learning if you get time for practice.

Start learning by doing today

View Plans