Microsoft Azure Documentation

Step 1: Create a Network Security Group

You can create an NSG using the Azure portal, Azure CLI, or Azure PowerShell. Here's how using the Azure portal:

1. Navigate to the Azure portal.
2. Search for "Network Security Groups" and select it.
3. Click "+ Create".
4. Fill in the required details: Subscription, Resource group, Name, and Region.
5. Click "Review + create" and then "Create".

Step 2: Configure Inbound Security Rules

By default, NSGs come with some pre-configured rules. You can add new rules to allow or deny specific inbound traffic.

1. Open your newly created NSG in the Azure portal.
2. Under "Settings", click "Inbound security rules".
3. Click "+ Add".
4. Configure the rule details:
• Source: e.g., "Any", "IP Addresses" (e.g., 203.0.113.5/32), or "Service Tag" (e.g., "Internet").
• Source port ranges: e.g., * or a specific port like 80.
• Destination: e.g., "Any", "IP Addresses", or "Service Tag".
• Destination port ranges: e.g., 80, 443, 3389.
• Protocol: TCP, UDP, ICMP, Any.
• Action: Allow or Deny.
• Priority: Assign a unique priority (e.g., 100, 110, 120). Lower numbers are processed first.
• Name: A descriptive name for the rule.
• Description: Optional description.
5. Click "Add".

Example: Allow HTTP traffic from the internet:

Source: Any
Source port ranges: *
Destination: Any
Destination port ranges: 80
Protocol: TCP
Action: Allow
Priority: 100
Name: AllowHTTP
            

Step 3: Configure Outbound Security Rules

Similar to inbound rules, you can configure outbound rules to control traffic originating from your Azure resources.

1. In your NSG, click "Outbound security rules".
2. Click "+ Add".
3. Configure the rule details (similar to inbound rules but focusing on outbound traffic).
4. Click "Add".

Example: Deny outbound access to a specific IP address:

Source: Any
Source port ranges: *
Destination: IP Addresses
Destination address prefix: 192.168.1.100/32
Protocol: Any
Action: Deny
Priority: 400
Name: DenySpecificOutbound
            

Step 4: Associate the NSG with a Subnet or NIC

An NSG only takes effect when it's associated with a network interface (NIC) or a subnet. You can associate an NSG with both, and the rules are evaluated at both levels.

To associate with a Subnet:

1. Navigate to the Virtual Network containing the subnet.
2. Select the subnet.
3. Under "Network security group", choose your NSG.
4. Click "Save".

To associate with a NIC:

1. Navigate to the Virtual Machine's Network Interface.
2. Under "Settings", click "Network security group".
3. Choose your NSG.
4. Click "Save".