AZ-104 · Lab 04 · Virtual Networking~8 min
An NSG is read in priority order, then denied by default
Two things decide every packet: the lowest-numbered rule that matches, and the default deny waiting at 65500. Read the rules first. Then build a set of your own and prove it against traffic you were not shown.
The setup
The lab creates myNSGSecure and associates it with the SharedServicesSubnet in CoreServicesVnet (10.20.0.0/16). Web servers in the subnet belong to the application security group asg-web. Every rule below is either one the lab writes or one Azure adds by default.
myNSGSecureNSGThe network security group the lab creates in az104-rg4 and associates with a subnet.
SharedServicesSubnet10.20.10.0/24The subnet in CoreServicesVnet that myNSGSecure protects.
asg-webASGThe application security group the lab creates. Web server NICs join it, and rules target the group instead of IP addresses.
AllowASGpriority 100The lab's inbound rule. Allows TCP 80 and 443 sourced from asg-web.
DenyInternetOutboundpriority 4096The lab's outbound rule. Denies traffic to the Internet service tag.
Default rules65000+Azure adds these to every NSG. They cannot be deleted, and DenyAllInBound at 65500 is the reason an NSG is default deny.