With Session Pools, can you specify a custom CIDR range for network egress?

Jonah 20

In the UI, I see that Azure Container App Session Pools allow you to toggle network egress on and off. Is there any way to control this in a more granular way. I imagine a lot of developers need to allow some outbound network connections but want to limit what requests can be made. Modal offers something similar https://modal.com/docs/guide/sandbox-networking

1 answer

Sina Salam 16,446 Reputation points

2025-01-17T12:37:31.0866667+00:00

Hello Jonah,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that your concerns are about customization of network Egress in Azure Container App Session Pools.

As a developer, this is insightful. Like you're looking for a way to allow some outbound connections while restricting others, similar to what Modal offers. Azure Container Apps provides robust options to achieve this, ensuring your applications can securely and efficiently manage network traffic.

Firstly, Azure Container Apps Session Pools allow you to toggle network egress on and off. However, for more granular control, you can configure network access settings on the session pool. This includes specifying which outbound connections are allowed or blocked - https://learn.microsoft.com/en-us/azure/container-apps/sessions this level of control give help to manage and secure the network traffic more precisely.

Secondly, it a capital YES, you can specify a custom CIDR range for network egress in Azure Container Apps. This is particularly useful for defining specific network boundaries and ensuring that outbound traffic adheres to your network policies - https://techcommunity.microsoft.com/blog/azurepaasblog/securing-network-egress-in-azure-container-apps/3915548

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.
Please sign in to rate this answer.
Jonah 20 Reputation points

2025-01-17T14:16:44.5066667+00:00

Hi Sina, thanks for the response! Sorry, I'm a bit new to building in Azure, so I have a few follow up questions:

However, for more granular control, you can configure network access settings on the session pool. This includes specifying which outbound connections are allowed or blocked - https://learn.microsoft.com/en-us/azure/container-apps/sessions

Do you mind elaborating on which network access settings are available? In the linked docs and the "Code Interpreter Sessions" and "Custom Container Sessions" subpages, the only network configuration I see available is --network-status which only allows toggling network egress on and off and not more granular control. I've reviewed the docs fairly comprehensively, but hopefully I'm missing something!z

Secondly, it a capital YES, you can specify a custom CIDR range for network egress in Azure Container Apps.

Is this possible when only using session pools and not the rest of Azure Container Apps? My goal is only to restrict egress on the session pool containers (which I'm accessing via API to execute untrusted code) and not an entire application (the rest of my application is actually hosted elsewhere). Is the firewall + virtual network setup still possible in this case? Would it just be attached via the resource group on the Session Pool?

I really appreciate your responses! Thank you for the assistance

Sina Salam 16,446 Reputation points

2025-01-17T15:13:16.1866667+00:00

Dear

Thank you for your feedback.

From your review of the Azure documentation, you are correct that --network-status is currently the primary option for toggling network egress (on/off) in Azure Container Apps session pools. At present, granular control (like specifying which outbound connections are allowed or blocked) is not directly supported through the Azure CLI for session pools alone. The documentation you referenced doesn't detail advanced firewall rules or CIDR-based restrictions within the session pool scope. These controls are generally associated with Azure Virtual Networks (VNets) and Network Security Groups (NSGs), which are used for broader networking configurations in Azure. - https://learn.microsoft.com/en-us/azure/container-apps/sessions

If granular egress control is critical, you might consider:

For custom Container Sessions, you can run containers with network settings defined via a VNet.

For session pools attached to a VNet, NSGs can restrict or allow outbound traffic based on IPs, ports, or services.

You can use Azure Firewall Integration to enforce outbound traffic restrictions for session pools within a VNet.

On your second point, the ability to specify a custom CIDR range for egress is tied to the use of VNets in Azure Container Apps. However:

If you are using session pools independently and not the full Azure Container Apps environment, there isn’t currently a built-in feature for CIDR-based egress restriction directly scoped to session pools.

To apply such restrictions only to the session pool containers, you could:

Attach the session pool to a dedicated VNet.

Use an NSG or Azure Firewall within that VNet to define egress rules, limiting outbound traffic to specific IP ranges or services.

This approach does not impact your main application (hosted elsewhere) because it isolates the session pool containers within their own VNet. However, this setup would require provisioning and managing a VNet resource - https://learn.microsoft.com/en-us/azure/virtual-network/security-overview

For your new questions and clarifications:

Firewall + VNet Feasibility for Session Pools, YES, you can attach a session pool to a VNet and use its networking capabilities for granular egress control. However, this requires setting up the VNet and configuring the session pool to use it - [https://learn.microsoft.com/en-us/azure/container-apps/networking](https://learn.microsoft.com/en-us/azure/container-apps/networking](https://learn.microsoft.com/en-us/azure/container-apps/networking)

The VNet and NSG setup would be associated with the resource group containing the session pool. You can isolate this network configuration to only the resources you want (e.g., the session pool). - https://learn.microsoft.com/en-us/azure/virtual-network/security-overview

Azure's documentation does not yet provide an exhaustive guide on using VNets for session pools specifically. If you’re looking for tailored guidance, I can help with an example using Azure CLI or ARM templates to configure this setup.

Goodluck
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

With Session Pools, can you specify a custom CIDR range for network egress?

1 answer

Your answer