Options for configuring allowed IP addresses for Static Web App behind Application Gateway

Question

We used to configure allowed IP addresses for a Static Web App (SWA) using SWA's application configuration's allowedIpRanges.

Then the SWA was configured behind a private endpoint and Application Gateway, so allowedIpRanges configuration was removed.

In QA environment we can use Web Application Firewall configurations to configure allowed IP addresses.

But in Test environment we haven't deployed WAF (due to costs). Question is that is it possible to somehow configure allowed IP addresses in this setup without using WAF?

Answer 1

Hello @Mika Pitkänen Yes, it is possible to configure allowed IP addresses without using a Web Application Firewall (WAF). You can achieve this by using Network Security Groups (NSGs) and Application Gateway to control access to your Static Web App (SWA). Here's a high-level approach:

1. You can create NSGs and associate them with your virtual network (VNet) or subnets to control inbound and outbound traffic to your SWA. NSGs allow you to define security rules that specify allowed IP addresses or ranges.

# You can configure NSG rules on the subnet where your Application Gateway is deployed
# Example NSG rule:
{
    "name": "allow-specific-ips",
    "properties": {
        "priority": 100,
        "direction": "Inbound",
        "access": "Allow",
        "protocol": "Tcp",
        "sourcePortRange": "*",
        "destinationPortRange": "80,443",
        "sourceAddressPrefix": "YOUR_IP_RANGE",
        "destinationAddressPrefix": "*"
    }
}

2. If you have control over the Application Gateway, you can directly configure IP restrictions within its settings. This allows you to specify a list of allowed IP addresses that can access the SWA through the Application Gateway.

# While not as feature-rich as WAF, App Gateway basic rules can restrict traffic
# Configure in listener or request routing rules
{
    "properties": {
        "httpListener": {
            "id": "..."
        },
        "requestRoutingRules": [
            {
                "properties": {
                    "ruleType": "Basic",
                    "priority": 100,
                    "ipFilters": {
                        "allowedIpRanges": ["IP_RANGE1", "IP_RANGE2"]
                    }
                }
            }
        ]
    }


}