Azure Firewall Outbound

Question

Azure Firewall Outbound

Peter Stieber 45

Documentation keeps mentioning that app rules are applied only to outbound traffic. Same applies to network rules where dst is fqdn. They are only applied to outbound traffic - traffic leaving from VNET. Can someone please explain that little more? What if I have HUB and Spoke with fw in HUB. Will app rules be applied to traffic coming from spoke? What if I have UDR associated with fw subnet to route 0.0.0.0/0 via on prem. Will app rules be evaluated in such a case? Or is it that app rules are applied only when route with nexthop type internet is matched in azureFirewallSubnet? Or does Azure Firewall decides whether to evaluate Application Rules based on whether the destination is public or private IP? Is the key factor whether the destination IP is public or private, rather than the routing path or whether forced tunneling is enabled?

1 answer

Your answer

Answer 1

Hello,

Welcome to Microsoft Q&A,

Application Rules are only applied to traffic going to public FQDNs/IPs, not internal/private traffic, because Application Rules in Azure Firewall operate at Layer 7 (HTTP/S) and are designed specifically to filter outbound web traffic (HTTP, HTTPS, MSSQL) based on FQDNs.

https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#can-i-use-application-rules-to-filter-traffic-to-private-ip-addresses

https://learn.microsoft.com/en-us/azure/firewall/overview

What if I have Hub-Spoke, and FW is in the Hub? Will the Application Rules apply to traffic coming from Spoke?

Yes, if the traffic:

Is routed through the firewall via UDR (user-defined route),

Is going to public endpoints (like *.microsoft.com, github.com, etc.),

Uses HTTP/HTTPS (or SQL) protocols.

Then, Application Rules will be evaluated.

Spoke → Hub FW → Internet

If UDR in Spoke routes 0.0.0.0/0 to Firewall → Yes, App Rules apply.

What if I route 0.0.0.0/0 from the AzureFirewallSubnet to on-prem (forced tunneling)?

In this case:

The default route for Internet traffic points to on-prem via VPN/ExpressRoute,

The firewall will not evaluate Application Rules for Internet-bound traffic unless special configuration is done.

To make Application Rules still apply in forced tunneling:

You need to enable "Forced Tunneling support" and configure Virtual Route Point (VNet peering and routing table adjustments) using route tables with next hop type Internet for specific traffic.

Does the evaluation depend on whether the destination is public or private IP?

Yes. This is the core rule:

If its Public FQDN/IP, the application rules are used, but if it Private IP (VNet, on-prem) then the application rules are skipped and network rules are used.

So:

App Rules = Only for HTTP/S traffic to public IPs or FQDNs
Network Rules = Used for all IP-based traffic, including private IPs, VNET peering, and on-prem.

Please upvote and accept the answer if it helps!!

Ganesh Patapati 8,760 Reputation points Microsoft External Staff Moderator

2025-07-14T16:20:17.6933333+00:00

Hello Peter Stieber

I see Divyesh Govaerdhanan has addressed your queries.

Just checking in to see if the information was helpful. If you have any further updates on this issue, please feel free to post back.

please don’t forget to close the thread by clicking Accept the answer wherever the information provided helps you, as this can be beneficial to other community members.
Ganesh Patapati 8,760 Reputation points Microsoft External Staff Moderator

2025-07-15T10:53:12.9833333+00:00

Hello Peter Stieber

I see Divyesh Govaerdhanan has addressed your queries.

Just checking in to see if the information was helpful. If you have any further updates on this issue, please feel free to post back.

If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.

Share via

Azure Firewall Outbound

1 answer

Your answer