Skip to main content

What is a firewall

A firewall controls which network traffic is allowed in and out of a VNet. Rules are defined per VNet and follow a default-deny policy: any traffic that is not explicitly allowed is blocked.

How rules are evaluated​

Each rule has a priority (from 100 to 65000). Rules are checked in priority order, and the first one that matches decides whether the traffic is allowed or denied.

A rule matches traffic by:

  • Action: ALLOW or DENY.
  • Direction: IN (inbound) or OUT (outbound).
  • Protocol: TCP, UDP, ICMP, or any.
  • Ports: one or more destination ports or ranges (for example, 80, 443, 8000-8080).
  • Source and destination: where the traffic comes from and goes to.

Sources and destinations​

Instead of writing raw IP ranges everywhere, a rule can target:

  • A custom CIDR (for example, 0.0.0.0/0 for anywhere) or your current IP.
  • A subnet or a specific VM network adapter.
  • A network tag, so the rule applies to every adapter carrying that tag.
  • A VPN endpoint (OpenVPN, IPsec, or Direct Connect).

Targeting by network tag keeps rules readable: you describe intent ("web servers can reach the database") instead of maintaining lists of IPs.

Firewall vs Perimeter Policy

The firewall gives fine-grained, per-VNet control by protocol and port. A Perimeter Policy works at the VDC edge for broader filtering, such as blocking entire countries. Use both together.