Exercise 2 – Secure network access using an NSG

This section will look at creating an NSG and associating with a subnet; adding an inbound rule, allowing us to connect to a VM over RDP while restricting connections to access from a known IP address only; then, creating an outbound rule to deny internet access.

For this exercise, we will create a new VM.

In the following sub-sections, you can see the procedure to complete the exercise, segregated into tasks for a better understanding.

Task: Access the Azure portal

1. Log in to the Azure portal at https://portal.azure.com. You can alternatively use the Azure desktop app, found at https://portal.azure.com/App/Download.

Task: Create a VM

2. In the search bar, type in virtual machines; click Virtual machines from the list of services.
3. From the Virtual machines blade, click + Create and then Virtual machine from the top menu of the blade.
4. Set Project and Instance details and Administrative accounts as required.
5. Set Public inbound port rules to None.
6. Set Licensing at the default of unchecked (that is, No) to use an existing Windows Server license.
7. Click Next: Disks.
8. Leave set at defaults.
9. Click Next: Networking.
10. From Network interface, set the following:

• • Virtual network—Use the default provided.
• • Subnet—Use the default provided.
  • Public IP—Click Create new, then enter a name and click OK.
  • NIC network security group—Select None.
  • Leave all other settings at defaults.

11. Click Next: Management.
12. Leave set at defaults.
13. Click Next: Advanced.
14. Leave set at defaults.
15. Click Next: Tags and add any tags as required; click Next: Review + create.
16. On the Review + create tab, review your settings; you may go back to the previous tabs and make any edits if required. Once you have confirmed your settings are as required, you can click Create.
17. You will receive a notification that the resource was created successfully.

Task: Create an NSG

18. In the search bar, type in network security groups; click network security groups from the list of services.
19. From the Virtual machines blade, click + Create from the top menu of the blade.
20. Set Project and Instance details and Administrative accounts as required.
21. Click Next: Tags and add any tags as required; click Next: Review + create.
22. On the Review + create tab, review your settings; you may go back to the previous tabs and make any edits if required. Once you have confirmed your settings are as required, you can click Create.
23. You will receive a notification that the resource was created successfully.
24. Click Go to resource from the deployment blade; alternatively, navigate to the Azure NSG instance.

Task: Associate NSG to a subnet

25. From the Created NSGs blade of the instance created, click Subnets under Settings.
26. Click + Associate from the top toolbar.
27. Select the VNet and subnet of the VM you created in the previous exercise from the Associate subnet blade.
28. Click OK.
29. You will receive a notification that the changes were saved successfully.

Task: Attempt to connect to a VM using RDP

30. Navigate to the VM created in this exercise.
31. From the Overview pane, click Connect and then click RDP.
32. From the Connect pane, click Download RDP file.
33. Open the downloaded file and click Connect.
34. You will see a message box that says Remote Desktop can’t connect to the remote computer. This is to be expected, and we will resolve this in the next task to allow a connection.

Task: Add an inbound rule to allow RDP access

35. From the Virtual machines blade, click Networking under Settings. You will see that from the inbound port rules, all inbound connections are denied unless their source is the VNet or Azure Load Balancer.
36. From Inbound port rules blade, click Add inbound port rule.
37. Open a browser and from Google, type what’s my ip and note your IP for the next step.
38. From the Add inbound security rule blade, leave all other options at their defaults apart from the following:

• • Source—Select IP addresses.
  • Source IP addresses/CIDR ranges—Set to your IP from the previous step.
  • Service—Select RDP.
  • Action—Ensure Allow is set.
  • Name—Provide a name, such as AllowInbound_RDP_KnownIP.
  • Description—Enter as required.

39. Click Add.
40. You will receive a notification that the rule was created successfully.
41. Open the downloaded file again and click Connect.
42. This time, you will be prompted to enter your credentials and will be able to connect to the VM successfully.

Task: Access the internet from the VM

43. While logged in to the VM, open a browser and confirm you have reached the internet by visiting a site such as www.milesbetter.solutions (you may need to adjust Internet Explorer (IE) security settings). We will restrict this access to the internet in the next exercise.

Task: Add an outbound rule to deny internet access

44. From the Virtual machines blade, click Networking under Settings; you will see from the Outbound port rules tab that all outbound connections are allowed to the internet.
45. From Outbound port rules blade, click Add outbound port rule.
46. From the Add outbound security rule blade, leave all other options at default apart from the following:

• • Destination—Select Service tag.
  • Destination service tag—Select Internet.
  • Destination port ranges—Enter the symbol * (asterisk symbol).
  • Action—Ensure Deny is set.
  • Priority—Enter a value of 200.
  • Name—Provide a name, such as DenyOutbound_Internet.
  • Description—Enter as required.

47. Click Add.
48. You will receive a notification that the rule was created successfully.
49. From the VM, open a browser again and confirm you can no longer reach the internet by visiting a site such as www.milesbetter.solutions.
50. This time, you will see a message from the browser such as Can’t reach this page.

In this exercise, we successfully created an NSG and associated with a subnet; we added an inbound rule that allows us to connect to a VM over RDP while restricting connections to be able to access from a known IP address only; then, we created an outbound rule to deny internet access.

This section covered hands-on exercises. The following section provides a summary of this chapter.