Block outbound SSH with an NSG rule

Security wants vm-web (in subnet-web) stopped from opening SSH sessions (port 22) to anything in subnet-db (10.1.3.0/24). The app on vm-web still needs SQL on vm-db (10.1.3.4) at port 1433. nsg-web is already on subnet-web, with no rules yet. Add an outbound rule to it, then log in to vm-web and test both ports.

1. Add an outbound deny for SSH to subnet-db.

   az network nsg rule create -g rg-lab --nsg-name nsg-web --name Deny-SSH-To-DB --priority 200 --direction Outbound --access Deny --protocol Tcp --destination-address-prefixes 10.1.3.0/24 --destination-port-ranges 22Type it
   What's this?

   Adds or changes one rule in a network security group (NSG). Rules are checked from the lowest priority number up, and the first match decides.

   • -g the resource group the resources live in
   • --nsg-name the network security group the rule is in
   • --name the name of the thing to look at or change
   • --priority where the rule sits in the order. Lower numbers are checked first
   • --direction Inbound for traffic coming in to the VM, Outbound for traffic leaving it
   • --access Allow or Deny
   • --protocol TCP or UDP
   • --destination-port-ranges which ports the rule matches
   • --direction Outbound filter traffic leaving subnet-web
   • --destination-address-prefixes 10.1.3.0/24 only traffic headed to subnet-db

2. Connect to vm-web. ssh opens a shell on the VM, so the next commands run from vm-web, not from Cloud Shell.

   ssh vm-webType it
   What's this?

   Opens a shell on vm-web, so the next commands run on that VM. In this lab it's a shortcut. In real Azure you'd connect through something like Azure Bastion, or SSH to an address you can reach.

3. Test SSH to vm-db. nc tries to open a TCP connection and tells you if the port answers. It should fail now.

   nc -zv 10.1.3.4 22Type it
   What's this?

   netcat, a standard Linux tool. Tries to open a TCP connection and reports whether it worked.

   • -z only check whether the port answers. Send no data
   • -v print the result in words
   • 10.1.3.4 where to connect
   • 22 the port to try
   • -z only check the port, send no data
   • -v print whether it worked
   • 10.1.3.4 22 the IP and port to try

4. Test SQL to vm-db. It should still work. Type exit when done to go back to Cloud Shell.

   nc -zv 10.1.3.4 1433Type it
   What's this?

   netcat, a standard Linux tool. Tries to open a TCP connection and reports whether it worked.

   • -z only check whether the port answers. Send no data
   • -v print the result in words
   • 10.1.3.4 where to connect
   • 1433 the port to try

5. Answer the question below.

   For outbound traffic, which NSG does Azure check first: the NIC's or the subnet's?

   NSG

   Network security group: a list of allow and deny rules on a subnet or a network interface.

   NIC

   Network interface: a VM's network card in Azure. It holds the VM's private IP.

   Check