Secure VM Access with Network Security Groups

Network Security Groups (NSGs) are Azure's distributed, stateful packet filter. An NSG holds a prioritized list of inbound and outbound security rules, and each rule matches traffic on a 5-tuple: source, source port, destination, destination port, and protocol. Rules are evaluated in priority order, lowest number first, and the first match wins. Because the filter is stateful, allowing an inbound connection automatically permits the return traffic without a matching outbound rule.

An NSG can be attached to a subnet, to a network interface, or to both. Attaching it to a subnet applies it to every resource in that subnet, which makes the subnet the usual place to enforce a baseline access policy. Every NSG also ships with default rules that permit traffic inside the virtual network and from the Azure load balancer, then deny everything else arriving from the internet. That final deny is why a freshly deployed VM stays unreachable over SSH until you add an explicit allow rule.

By completing this Beginner challenge, you will be able to:

• Create a Network Security Group and associate it with a subnet
• Write an inbound security rule that permits SSH traffic on TCP port 22
• Scope a rule's source address to restrict who can reach the VM
• Confirm network reachability by opening an SSH session to the VM

Prerequisites

Before attempting this challenge, you should be comfortable with:

• Creating and managing Network Security Groups
• Understanding the 5-tuple (source, destination, port, protocol, action)
• Associating NSGs with subnets
• Basic SSH connectivity

Recommended Lab: Implement Network Security Groups (NSGs) and Application Security Groups (ASGs) in Azure