Quartz 5

nsg

Properties2
tagsnetworking, security, nsg, firewall
aliasesNSG, network security group

3 min read

Network Security Group (NSG)

What it is

A network security group (NSG) is a set of allow-or-deny rules that filters inbound and outbound network traffic for supported resources in a VNet. You can associate it with a subnet or a network interface (NIC). It filters traffic; it does not choose the traffic’s route or inspect a web request’s URL.

Why it exists

You need cheap, per-interface/per-tier filtering of who can talk to whom inside your VNet and with the outside world. NSGs provide stateful, micro-segmented security filtering without a box — applied right at the workload.

Key ideas

  1. A rule names a source, destination, protocol, port or port range, direction, priority, and Allow or Deny action. Sources and destinations can use IP addresses, CIDR ranges, service tags, or application security groups.
  2. Lower priority numbers are evaluated first. The first matching rule decides the outcome; later rules are not considered.
  3. Azure includes default rules, including virtual-network traffic allowances and a default internet-inbound deny. You cannot delete them, but a higher-priority custom rule can take precedence.
  4. NSGs are stateful. When a new allowed connection receives a reply, the reply is allowed without a mirror-image return rule. Rule changes affect new connections, not necessarily a connection already established.

How to reason about a flow

subnet association  ────────┐
NIC association    ────────┼──► combine (effective rules)
                            ▼
         process rules by priority, first match decides allow/deny
  • When an NSG is applied at both subnet and NIC, Azure evaluates the applicable rules at both levels. Traffic must be permitted through both; an allow at one level cannot defeat a deny at the other.
  • Check the path as well as the NSG. A rule that permits traffic cannot help if a route, DNS setting, load balancer, or service firewall sends it elsewhere or blocks it.

Northwind example

Northwind associates an NSG with the application subnet. It allows TCP traffic to the application port only from the front-end subnet and denies other inbound traffic. Luis can reach the application from the approved front end, but a shopper on the internet cannot reach the private app address directly. If Northwind needs URL-based rules such as “allow /orders but block /admin,” it needs a web-aware service such as Application Gateway, not an NSG.

Common confusion

  • NSG = traffic filter; route table = traffic path; Azure Firewall = centralized firewall capability. They can work together.
  • An NSG rule applies to network five-tuple details such as address, port, and protocol. It is not a user permission and does not replace RBAC.
  • Attaching an NSG to a subnet does not give each VM an internet address. Public exposure requires an explicit inbound path.

How it fits

Failure modes

  • A broad allow rule with a high priority can unintentionally override a later deny.
  • Blocking a platform or service dependency can make a workload fail in ways that look unrelated to networking.
  • Relying on an NSG alone does not protect data when an application, identity, or public endpoint is misconfigured.

asg · subnet · vnet · route-table · azure-firewall · application-gateway · network-watcher · northwind-traders-case-study

📘 Source: Microsoft Learn — Network security groups overview, checked 2026-09-16.

Graph View

Backlinks