Lab: Azure VNet, VM and network security group

Aim and what you need

The aim is to understand how Azure filters traffic to a VM and how to prove the rules work. An NSG holds numbered allow and deny rules for inbound and outbound traffic. You can attach one to a subnet, to a VM's network interface (NIC), or both; when both exist, traffic must pass both. In this lab the NSG goes on the subnet only, which is easier to manage.

• An Azure subscription with MFA on your account and a budget set (see using cloud free tiers safely).
• Azure CLI installed locally, or Azure Cloud Shell in the portal.
• Your public IP address. About 45 minutes; a B-series VM costs very little for an hour, but delete it at the end.

Steps

1. Sign in and create a resource group in one region. Everything in this lab goes inside it, so one command deletes the lot.
2. Create the VNet with its first subnet.
3. Create the NSG, add an inbound rule for SSH from your IP only, and attach the NSG to the subnet.
4. Create the VM with SSH key authentication. Pass an empty NIC-level NSG so the subnet NSG is the only filter.

az login
az group create --name rg-lab-vnet --location uksouth --tags project=lab
az network vnet create --resource-group rg-lab-vnet --name vnet-lab --address-prefixes 10.20.0.0/16 --subnet-name snet-web --subnet-prefixes 10.20.1.0/24
az network nsg create --resource-group rg-lab-vnet --name nsg-web
az network nsg rule create --resource-group rg-lab-vnet --nsg-name nsg-web --name Allow-SSH-MyIP --priority 100 --direction Inbound --access Allow --protocol Tcp --source-address-prefixes <your-ip>/32 --destination-port-ranges 22
az network vnet subnet update --resource-group rg-lab-vnet --vnet-name vnet-lab --name snet-web --network-security-group nsg-web
az vm create --resource-group rg-lab-vnet --name vm-web --image Ubuntu2404 --size Standard_B1s --vnet-name vnet-lab --subnet snet-web --nsg "" --public-ip-sku Standard --admin-username azureuser --generate-ssh-keys

How to verify

List the NSG rules, including the defaults, and read them in priority order. Your rule at 100 allows SSH from your IP; the default DenyAllInBound at 65500 blocks everything else from the internet. SSH to the VM's public IP should work from your computer. From a phone on mobile data, which has a different IP, the connection should time out. Network Watcher's IP flow verify gives the same answer without a second device: it names the rule that allowed or denied a test packet. Effective security rules on the NIC show the combined result.

az network nsg rule list --resource-group rg-lab-vnet --nsg-name nsg-web --include-default --output table
az vm list-ip-addresses --resource-group rg-lab-vnet --name vm-web --output table
ssh azureuser@<vm-public-ip>
az network watcher test-ip-flow --resource-group rg-lab-vnet --vm vm-web --direction Inbound --protocol TCP --local 10.20.1.4:22 --remote 203.0.113.50:40000
az network nic list-effective-nsg --resource-group rg-lab-vnet --name vm-webVMNic

Next, add a rule at priority 110 allowing HTTP (TCP 80) from anywhere, install nginx on the VM, and test it in a browser. Then remove the rule and see the page stop loading.

Troubleshooting and clean-up

• SSH times out from your own computer: your public IP may have changed, or you are behind a carrier NAT with a different outbound address. Check it again and update the rule.
• Size not available: some regions or new subscriptions restrict sizes. Try another B-series size or region.
• Image alias not recognised: update the Azure CLI, or list images with az vm image list --output table.
• NIC name differs: find it with az network nic list -g rg-lab-vnet -o table.

Deleting the resource group removes the VM, disk, public IP, NSG and VNet together. Afterwards, confirm it has gone and check Cost Management the next day.

az group delete --name rg-lab-vnet --yes --no-wait
az group list --output table

Tip: in production, avoid SSH from the internet at all. Azure Bastion or just-in-time VM access in Microsoft Defender for Cloud are common alternatives.