Network Security Group

Introduction

An Azure network security group (NSG) filters network traffic to and from Azure resources in a virtual network. It holds a prioritized list of security rules that allow or deny inbound and outbound traffic by source, destination, port and protocol, and it is associated with subnets or network interfaces. For more information, see Network security groups.

LocalStack for Azure provides a local environment for building and testing applications that make use of network security groups. The supported APIs are available on our API Coverage section, which provides information on the extent of Network Security Group’s integration with LocalStack.

Getting started

This guide is designed for users new to network security groups and assumes basic knowledge of the Azure CLI and our lstk az proxy.

Launch LocalStack using your preferred method. For more information, see Introduction to LocalStack for Azure. Once the container is running, enable Azure CLI interception by running:

lstk az start-interception

This command points the az CLI away from the public Azure management REST API and toward the LocalStack for Azure emulator API. To revert this configuration, run:

lstk az stop-interception

This reconfigures the az CLI to send commands to the official Azure management REST API.

Create a resource group

Create a resource group to hold all resources created in this guide:

az group create \
  --name rg-nsg-demo \
  --location westeurope

Output

{
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-nsg-demo",
  "location": "westeurope",
  "managedBy": null,
  "name": "rg-nsg-demo",
  "properties": {
    "provisioningState": "Succeeded"
  },
  "tags": null,
  "type": "Microsoft.Resources/resourceGroups"
}

Create a network security group

Create a network security group:

az network nsg create \
  --name nsg-demo \
  --resource-group rg-nsg-demo \
  --location westeurope

The response contains the six default security rules that Azure adds to every network security group, followed by the group’s own (still empty) list of security rules:

Output

{
  "NewNSG": {
    "defaultSecurityRules": [
      {
        "access": "Allow",
        "description": "Allow inbound traffic from all VMs in VNET",
        "destinationAddressPrefix": "VirtualNetwork",
        "destinationPortRange": "*",
        "direction": "Inbound",
        "name": "AllowVnetInBound",
        "priority": 65000,
        "protocol": "*",
        "sourceAddressPrefix": "VirtualNetwork",
        "sourcePortRange": "*",
        "type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules"
        ...
      },
      ...
    ],
    "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-nsg-demo/providers/Microsoft.Network/networkSecurityGroups/nsg-demo",
    "location": "westeurope",
    "name": "nsg-demo",
    "provisioningState": "Succeeded",
    "resourceGroup": "rg-nsg-demo",
    "securityRules": [],
    "type": "Microsoft.Network/networkSecurityGroups"
  }
}

Add security rules

Allow inbound HTTPS traffic from the internet:

az network nsg rule create \
  --nsg-name nsg-demo \
  --resource-group rg-nsg-demo \
  --name allow-https \
  --priority 100 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --source-address-prefixes Internet \
  --source-port-ranges '*' \
  --destination-address-prefixes '*' \
  --destination-port-ranges 443

Output

{
  "access": "Allow",
  "destinationAddressPrefix": "*",
  "destinationAddressPrefixes": [],
  "destinationPortRange": "443",
  "destinationPortRanges": [],
  "direction": "Inbound",
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-nsg-demo/providers/Microsoft.Network/networkSecurityGroups/nsg-demo/securityRules/allow-https",
  "name": "allow-https",
  "priority": 100,
  "protocol": "Tcp",
  "provisioningState": "Succeeded",
  "resourceGroup": "rg-nsg-demo",
  "sourceAddressPrefix": "Internet",
  "sourceAddressPrefixes": [],
  "sourcePortRange": "*",
  "sourcePortRanges": [],
  "type": "Microsoft.Network/networkSecurityGroups/securityRules"
}

Then deny inbound SSH traffic:

az network nsg rule create \
  --nsg-name nsg-demo \
  --resource-group rg-nsg-demo \
  --name deny-ssh \
  --priority 200 \
  --direction Inbound \
  --access Deny \
  --protocol Tcp \
  --source-address-prefixes '*' \
  --source-port-ranges '*' \
  --destination-address-prefixes '*' \
  --destination-port-ranges 22

List the rules

List the custom rules, followed by the default rules:

az network nsg rule list \
  --nsg-name nsg-demo \
  --resource-group rg-nsg-demo \
  --include-default \
  --output table

Output

Name                           ResourceGroup    Priority    SourcePortRanges    SourceAddressPrefixes    SourceASG    Access    Protocol    Direction    DestinationPortRanges    DestinationAddressPrefixes    DestinationASG
-----------------------------  ---------------  ----------  ------------------  -----------------------  -----------  --------  ----------  -----------  -----------------------  ----------------------------  ----------------
allow-https                    rg-nsg-demo      100         *                   Internet                 None         Allow     Tcp         Inbound      443                      *                             None
deny-ssh                       rg-nsg-demo      200         *                   *                        None         Deny      Tcp         Inbound      22                       *                             None
AllowVnetInBound               rg-nsg-demo      65000       *                   VirtualNetwork           None         Allow     *           Inbound      *                        VirtualNetwork                None
AllowAzureLoadBalancerInBound  rg-nsg-demo      65001       *                   AzureLoadBalancer        None         Allow     *           Inbound      *                        *                             None
DenyAllInBound                 rg-nsg-demo      65500       *                   *                        None         Deny      *           Inbound      *                        *                             None
AllowVnetOutBound              rg-nsg-demo      65000       *                   VirtualNetwork           None         Allow     *           Outbound     *                        VirtualNetwork                None
AllowInternetOutBound          rg-nsg-demo      65001       *                   *                        None         Allow     *           Outbound     *                        Internet                      None
DenyAllOutBound                rg-nsg-demo      65500       *                   *                        None         Deny      *           Outbound     *                        *                             None

Update a rule

Change the priority of the deny-ssh rule:

az network nsg rule update \
  --nsg-name nsg-demo \
  --resource-group rg-nsg-demo \
  --name deny-ssh \
  --priority 150

Output

{
  "access": "Deny",
  "destinationPortRange": "22",
  "direction": "Inbound",
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-nsg-demo/providers/Microsoft.Network/networkSecurityGroups/nsg-demo/securityRules/deny-ssh",
  "name": "deny-ssh",
  "priority": 150,
  "protocol": "Tcp",
  "provisioningState": "Succeeded",
  "type": "Microsoft.Network/networkSecurityGroups/securityRules"
  ...
}

Associate the group with a subnet

Create a virtual network with a subnet, then associate the network security group with the subnet:

az network vnet create \
  --name vnet-nsg-demo \
  --resource-group rg-nsg-demo \
  --location westeurope \
  --address-prefixes 10.0.0.0/16 \
  --subnet-name subnet-app \
  --subnet-prefixes 10.0.1.0/24

az network vnet subnet update \
  --vnet-name vnet-nsg-demo \
  --resource-group rg-nsg-demo \
  --name subnet-app \
  --network-security-group nsg-demo

Output

{
  "addressPrefix": "10.0.1.0/24",
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-nsg-demo/providers/Microsoft.Network/virtualNetworks/vnet-nsg-demo/subnets/subnet-app",
  "name": "subnet-app",
  "networkSecurityGroup": {
    "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-nsg-demo/providers/Microsoft.Network/networkSecurityGroups/nsg-demo",
    "resourceGroup": "rg-nsg-demo"
  },
  "provisioningState": "Succeeded",
  "type": "Microsoft.Network/virtualNetworks/subnets"
  ...
}

Delete the rule and the group

Remove the association from the subnet, then delete a rule and the network security group:

az network vnet subnet update \
  --vnet-name vnet-nsg-demo \
  --resource-group rg-nsg-demo \
  --name subnet-app \
  --network-security-group null

az network nsg rule delete \
  --nsg-name nsg-demo \
  --resource-group rg-nsg-demo \
  --name deny-ssh

az network nsg delete \
  --name nsg-demo \
  --resource-group rg-nsg-demo

Then list the network security groups in the resource group to confirm the group was removed:

az network nsg list \
  --resource-group rg-nsg-demo

Output

[]

Features

The Network Security Group emulator supports the following features:

• Create and manage network security groups: Full lifecycle management including create, get, update tags, list, and delete.
• Security rules: Create, get, update, list, and delete security rules for inbound and outbound traffic.
• Default security rules: Every network security group returns the six default rules Azure creates (AllowVnetInBound, AllowAzureLoadBalancerInBound, DenyAllInBound, AllowVnetOutBound, AllowInternetOutBound and DenyAllOutBound).
• Subnet and network interface associations: Subnets and network interfaces store and return a reference to their network security group.
• Subscription-scoped listing: List all network security groups across a subscription using az network nsg list.

Limitations

• No traffic filtering: Security rules are stored and returned, but no traffic in the emulator is evaluated against them, including traffic to and from AKS clusters and container workloads.
• No priority validation: Rule priorities are not checked for range or uniqueness, so two rules with the same priority and direction are accepted.
• Associations are not reflected on the group: A subnet or network interface shows its network security group, but the group does not return subnets or networkInterfaces properties.
• No default rule lookups: The default rules are part of the group’s response, but they cannot be retrieved one by one through the defaultSecurityRules API.
• Application security groups: Application security groups (Microsoft.Network/applicationSecurityGroups) are not emulated, and security rules do not keep references to them.

API Coverage

10 of 12 operations implemented

Formats for tools and AIPage MarkdownCoverage MarkdownCoverage JSONCoverage catalog

Operation ▲	Implemented ▼

PreviousPage 1 of 0Next