Azure Firewall - public IP as nexthop

Question

Azure Firewall - public IP as nexthop

Peter Stieber 180

Documentation says that

Application rules aren't applied for inbound connections. So, if you want to filter inbound HTTP/S traffic, you should use Web Application Firewall (WAF)

So my understanding is that when FW receives something on public IP, app rules are not evaluated. - is this correct ? Or what is considered inbound ? because its matter of perspective.

Is traffic coming from expressRoute hitting FW private IP considered inbound ?
Is traffic coming from peered VNET hitting FW private IP considered inbound ?

Or are app rules evaluated only when traffic hits FW private IP and route with next hop type "internet" is matched ?

But then I came across this - azure-firewall-without-nat-gateway

User's image

Is this example applicable only for return traffic or can I use firewall public IP as nexthop ?

What I am trying to understand ... is there a case where FW receives something on public IP and app rules are evaluated ?

Ganesh Patapati 8,760 Reputation points Microsoft External Staff Moderator

2025-07-11T08:55:21.6833333+00:00

Hello Peter Stieber

Just checking in to see if the information was helpful. If you have any further updates on this issue, please feel free to post back.

If the above is unclear or you are unsure about something, please add a comment below.
Peter Stieber 45 Reputation points

2025-07-12T17:55:31.7733333+00:00

Application rules are evaluated when the firewall receives traffic on its public IP and that traffic is routed through the firewall based on a routing table that indicates next hop type "Internet". - So if force tunneling is enabled then app rules are not applied ?
Ganesh Patapati 8,760 Reputation points Microsoft External Staff Moderator

2025-07-14T05:57:48.56+00:00
Hello Peter Stieber

With forced tunneling, Internet-bound traffic is redirected to an on-premises firewall or NVA instead of going directly to the Internet. - This means the Azure Firewall does not egress traffic directly, so application rules may not be evaluated for that traffic. - Instead, traffic is SNATed (source NAT) and routed to the next hop defined in your UDR—typically a VPN gateway

I hope this has been helpful!

If the above is unclear or you are unsure about something, please add a comment below.

please don’t forget to close the thread by clicking Accept the answer wherever the information provided helps you, as this can be beneficial to other community members.
Ganesh Patapati 8,760 Reputation points Microsoft External Staff Moderator

2025-07-15T10:51:41.9033333+00:00

Hello Peter Stieber

We haven't heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please let us know if you have any questions or concerns. We are happy to assist you.

If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.
Ganesh Patapati 8,760 Reputation points Microsoft External Staff Moderator

2025-07-16T11:24:41.44+00:00

Hello Peter Stieber

We haven't heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please let us know if you have any questions or concerns. We are happy to assist you.

If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.

Accepted answer

0 additional answers

Your answer

Ganesh Patapati 8,760 Reputation points Microsoft External Staff Moderator

2025-07-11T08:55:21.6833333+00:00

Hello Peter Stieber

Just checking in to see if the information was helpful. If you have any further updates on this issue, please feel free to post back.

If the above is unclear or you are unsure about something, please add a comment below.
Peter Stieber 45 Reputation points

2025-07-12T17:55:31.7733333+00:00

Application rules are evaluated when the firewall receives traffic on its public IP and that traffic is routed through the firewall based on a routing table that indicates next hop type "Internet". - So if force tunneling is enabled then app rules are not applied ?
Ganesh Patapati 8,760 Reputation points Microsoft External Staff Moderator

2025-07-14T05:57:48.56+00:00

Hello Peter Stieber

With forced tunneling, Internet-bound traffic is redirected to an on-premises firewall or NVA instead of going directly to the Internet. - This means the Azure Firewall does not egress traffic directly, so application rules may not be evaluated for that traffic. - Instead, traffic is SNATed (source NAT) and routed to the next hop defined in your UDR—typically a VPN gateway

I hope this has been helpful!

If the above is unclear or you are unsure about something, please add a comment below.

please don’t forget to close the thread by clicking Accept the answer wherever the information provided helps you, as this can be beneficial to other community members.
Ganesh Patapati 8,760 Reputation points Microsoft External Staff Moderator

2025-07-15T10:51:41.9033333+00:00

Hello Peter Stieber

We haven't heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please let us know if you have any questions or concerns. We are happy to assist you.

If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.
Ganesh Patapati 8,760 Reputation points Microsoft External Staff Moderator

2025-07-16T11:24:41.44+00:00

Hello Peter Stieber

We haven't heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please let us know if you have any questions or concerns. We are happy to assist you.

If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.

Answer 1

Hello Peter Stieber

Q. So my understanding is that when FW receives something on public IP, app rules are not evaluated. - is this correct? Or what is considered inbound? because its matter of perspective.

You're correct that application rules in Azure Firewall don't apply to inbound connections. Inbound traffic is generally considered anything that is directed towards the firewall's public IP (or private IP, depending on internal routing).
This means that when traffic is directed to the firewall’s public IP, application rules are not triggered. Instead, network rules or NAT rules are used to handle such traffic.

User's image

Q. Is traffic coming from expressRoute hitting FW private IP considered inbound? Is traffic coming from peered VNET hitting FW private IP considered inbound?

Yes, traffic coming from ExpressRoute or peered VNETs that reach the firewall's private IP is still considered inbound.

Q. Or are app rules evaluated only when traffic hits FW private IP and route with next hop type "internet" is matched?

Application rules are evaluated when the firewall receives traffic on its public IP and that traffic is routed through the firewall based on a routing table that indicates next hop type "Internet".

Q. Is this example applicable only for return traffic or can I use firewall public IP as next Hop ?

If you consider return traffic, utilizing the public IP as a next hop on the UDR might not be feasible solution. If you want inbound traffic from internet to reach the Azure VM private ips, consider using DNAT inbound rule to translate the azure firewall public ip to private ip of the VM.

Q. What I am trying to understand ... is there a case where FW receives something on public IP and app rules are evaluated ?

DNAT rules are used to receive the firewall traffic using public IP, whereas application rules are designed for only outbound internet traffic for the azure VMs.

I hope this has been helpful!

If the above is unclear or you are unsure about something, please add a comment below.

please don’t forget to close the thread by clicking Accept the answer wherever the information provided helps you, as this can be beneficial to other community members.

Share via

Azure Firewall - public IP as nexthop

0 additional answers

Your answer