Share via

Whats the order of Firewall policies execution.

Yashas Manjunath 186 Reputation points
2025-07-28T07:57:14.7666667+00:00

I have a hub and spoke setup in my tenant. There 2 vm, one in each spoke. I have a azure firewall policies setup. All the traffic between the spokes are routed through the firewall. I have a firewall policy in place. 1 network rule which allows with prio 400 which blocks all traffic to the internet from both the spokes. 2nd Network rule which prio 250 which allows spoke 2 to talk to the internet. TCP 80 and 443 is allowed only with this rule.

What I want is spoke 2 to be able to resolve only one website. lets say google.com .
So I have a application rule with prio 100 which lets this happen for spoke 2. My issue is that this never gets hit. As soon as it hits the network rule with prio 250 it exits the list and never hits the application rule.

I know the network rules have a higher priority than application rules. But how do i ensure that the VM 2 can only resolve a specific website. Should I just get rid of the Network rule with prio 250. What is the best practise for a scenario like this.

Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
0 comments
Accepted answer
  1. JimmySalian-2011 43,251 Reputation points
    2025-07-28T09:57:30.3033333+00:00

    Hi Yashas,

    The firewall processes rules in a top-down approach, evaluating all traffic against the defined rules to determine if it matches an allow or deny condition. If no rule allows the traffic, it is denied by default.

    In this scenario Rule collections are processed according to the rule type in priority order, lower numbers to higher numbers from 100 to 65,000. The order is DNAT rules, then Network rules, then Application rules are processed.

    For your requirement only App Rule is required as you are doing FQDN filtering, so try that and remove the Network rule.https://learn.microsoft.com/en-us/azure/firewall/domain-filtering-overview

    Hope this helps.

    JS

    ==

    Please Accept the answer if the information helped you. This will help us and others in the community as well.

    1 person found this answer helpful.
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.