I am trying to create a simple DMZ using Azure Network Security Groups, using a Barracuda WAF as the public entrypoint into the DMZ, however I am having some trouble allowing internet traffic to access the Barracuda (and then be forwarded on to my Internal Load Balancer for my Application Servers).
What should I be using for the SOURCE and DESTINATION IP prefixes? I have tried:
- Source: 0.0.0.0/0 Destination: internal IP of Barracuda
- Source: INTERNET Destination: internal IP of Barracuda
- Source: Public IP of Barracuda Destination: internal IP of Barracuda
- Source: 0.0.0.0/0 Destination: public IP of Barracuda
I have also tried changing the priority of the entry to be 100 as well as 1000 (all others are 900 - 500).
I have removed all of the default endpoint configurations on the Virtual Machine for the Barracuda (as I have found that these seem to override the Network Security Group).
The network definitely works with the Barracuda when I don't have the Network Security Group installed, but I am wanting to use a Network Security Group to make sure I have a "secure as possible" DMZ.
Name | Type | Prty | Source IP | Port | Dest IP | Port | Protcl | Access DMZ NSG: Internet | Inbound | 100 | INTERNET | 443 | 10.106.164.20 | 443 | TCP | Allow ADFS-WAP | Outbound | 900 | 10.0.20.0 | 443 | 10.0.1.10 | 443 | TCP | Allow Internal NSG: ADFS | Inbound | 900 | 10.0.20.0 | 443 | 10.0.1.10 | 443 | TCP | Allow