Not so much a question as an observation on port rule security. I have a Linux VM with iptables blocking and logging everything except for the exact things I need, and I have noticed that whenever I start the VM, add/modify/remove a port rule, or just sit there long enough the Azure "firewall" appears to drop for a significant enough period of time that my Linux host starts getting scanned. Here are the logged and dropped packets from the Linux host's iptables, since starting the VM: Packets that made it through Azure's firewall and hit the host's firewall.
It looks like there were no effective external protections in place for about 3-5 minutes after the VM started, where 4 external hosts (with negative reputations on AbuseIPDB) attempted service enumeration. Changing port rules has about the same effect - a few minutes of exposure to the world.
The packets that make it through the Azure firewall when I am just sitting there, watching the dropped packet log, seem to be ACK-RST scan attempts, though I can't seem to force this to happen (by throwing ACK-RST's at the external IP with nmap, from another external host; can't get any packets in, per how I set up Azure's port rules). My Azure Network Port Rules.
Anyways, I'm not sure how this is possible and why this is happening. Surely Microsoft knows that dropping all firewall rules, during VM deployment and/or when modifying rules, is bad, though I may be missing something obvious with my configuration. Any suggestions or help is appreciated, and thanks in advance.