How to protect a Virtual Machine on Azure from being attacked by specific IP ranges on port 1433

Question

How can I protect a Virtual Machine on Azure from being attacked by specific IP ranges on port 1433?

Answer 1

Hello @Marc Troch ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to know how to protect an Azure Virtual Machine from being attacked by specific IP ranges on port 1433.

The basic network security recommendation for Azure Virtual Machines is to use network security groups (NSG) to restrict or monitor traffic by port, protocol, source IP address, or destination IP address.

So, you can only allow specific IP ranges on port 1433 of your VM and restrict/deny the rest.

Refer: https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/virtual-machines-windows-virtual-machines-security-baseline#network-security

You can also use just-in-time (JIT) VM access to lock down inbound traffic to your Azure VMs, reducing exposure to attacks while providing easy connections to VMs when they're needed.

Refer: https://learn.microsoft.com/en-us/azure/virtual-machines/security-recommendations#networking

https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage

https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-protect-resources

To monitor your network for unknown or undesired traffic, you can use Network security groups flow logging feature available in Azure Network Watcher that allows you to log information about IP traffic flowing through a network security group.

Refer: https://learn.microsoft.com/en-us/security/benchmark/azure/security-control-network-security

https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview

For broader Azure network security options and recommendations, please refer the below docs:

https://learn.microsoft.com/en-us/azure/security/fundamentals/network-overview

https://learn.microsoft.com/en-us/security/benchmark/azure/security-control-network-security

If interested, you can enable DDoS Standard protection on your Azure Virtual Networks to guard against DDoS attacks.

Refer: https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-reference-architectures

You can also deploy Azure Firewall for network traffic filtering and enable/configure Threat Intelligence to "Alert and deny" for malicious network traffic.

Refer: https://learn.microsoft.com/en-us/azure/firewall/overview

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.