Configure Azure to allow inbound traffic to only one port by IP address and the rest to domain name

Question

Hi all,

I apologize for the poorly-worded title. What I'm trying to accomplish is this: allow one port to be reached by IP address, but require all other ports to use the domain name for connection. We're using Chirpstack and are expecting inbound traffic from around the globe.

Currently, the Azure server can be reached by its public IP address for all ports. I want to restrict this traffic to the domain name so HTTPS can be used. However, because we have already sent out devices that are configured to upload to our public IP address, we are trying to keep this IP address and port reachable.

I plan to re-restrict access to most ports (except 1700) and whitelist IP addresses to restrict unintended visitors once I get the OK from management. We already have a DNS name (nottherealname.westus#.cloudapp.azure.com)

Any recommendations?

Answer 1

Hi @BHaist

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Please follow the below steps to achieve your requirement:

Configure a NSG Inbound rule:

• Allow Port 1700 from Any Source
• Priority: Lower number (like 100) to ensure it evaluated first.
• Source: Any
• Source Port Ranges: *
• Destination: Any (or your VM's IP address if you prefer)
• Destination Port Ranges: 1700 Protocol: TCP or UDP (depending on your Chirpstack configuration)
• Action: Allow

Deny All Other Inbound Traffic (Default Rule)

• Priority: Higher number (like 65500) to be evaluated last.
• Source: Any
• Source Port Ranges: *
• Destination: Any Destination Port Ranges: *
• Protocol: Any
• Action: Deny

Please refer the document for NSG and how NSG filter the traffic.

NSGs themselves don't directly handle domain names or HTTPS termination. For HTTPS, you'll need a load balancer or Application Gateway.

To allow traffic via the domain name and HTTPS, you need a service that can handle the SSL/TLS certificate and direct traffic to your VM based on the domain name in the request.

Application Gateway is a good solution if you need advanced features like WAF, URL-based routing, and SSL termination. Otherwise, if you need a simpler solution, you can go for Azure Load Balancer which can handle SSL termination and basic load balancing. However, it doesn't provide the same advanced features as Application Gateway.

Let's take an example with Application Gateway, deploy an Application Gateway with public IP address and set up the listener to listen on port 443 (HTTPS) and associate an SSL certificate. Next add your VM's IP address to the backend pool and configure a rule that routes traffic to the backend pool based on the domain name in the host header.

Once you're ready to whitelist IPs for other ports, determine which ports need whitelisting and create new rules with higher priority than the "Deny All" rule. In the new rules, specify the specific IP addresses you want to allow.

Make sure your domain name is properly configured in Azure DNS (or your chosen DNS provider) to point to the public IP address of your Application Gateway, and you will need an SSL certificate for HTTPS. You can use Azure Key Vault to manage certificates and try to test your setup after making changes to make sure that the traffic is being routed correctly.

---

I hope this has been helpful!

Your feedback is important so please take a moment to accept answers. If you still have questions, please let us know what is needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!