I have multiple virtual networks, a VPN VN with site-to-site VPN, an AADDS VN, a production website cluster of virtual machines on a VN and a test website cluster of virtual machines on a VN. I also have a series of app services.

I have been advised to add a virtual machine firewall and it's got me a little stumped.

I have a public IP on the web server on each cluster, and the VPN.

The virtual machine based firewall (WatchGuard FireBox) only allows a single NIC on the untrusted side.

I could use an application gateway to route traffic to each website (production, test and app services) from a single IP, and a jumpbox to RDP to each VM (6 in total across test/prod), this would allow me to use ports of this single NIC to route traffic to its destination. This isn't ideal.

How can I intercept all external traffic using the firewall and still access multiple IPs using azure? Is a jumpbox and application gateway the only way?

Little confused to be honest. All input appreciated.

  • when you say firewall, do you mean an actual Firewall like Azure Firewall or Watchguard, or a Web Application Firewall (WAF) such as App Gateway, you mention both. What are you actually trying to protect? – Sam Cogan Oct 20 at 8:55
  • I mean a VM installed with watchguard firebox cloud. Then i would use the public IP of that as the entry point (with NAT rules) to forward it to an application gateway (so i can route the traffic based on host headers) or to a jumpbox for RDP access – Beakie Oct 20 at 9:21

I'm not overly familiar with Watchguard, however assuming it only supports a single NIC as you say then first you need capabilities to route traffic to your web applications based on the path or url. If the FW doesn't support this then yes you would need something after the Firewall to handle that routing. Application Gateway is one way to do this with Azure and is probably the simplest approach. You could also look at any other reverse proxy like Nginx etc.

As far as being able to RDP to your VM's, I would look to avoid exposing this to the internet and FW at all. I would recommend looking at using Azure Bastion, which effectively provides a jump box as a service, you can then use this to access all your VM's.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.