
Azure AKS Firewall is a crucial component of Azure Kubernetes Service (AKS) that enables you to control and secure network traffic to and from your cluster.
With Azure AKS Firewall, you can define rules to allow or deny traffic to specific pods or services, based on source and destination IP addresses, ports, and protocols.
This firewall feature provides an additional layer of security and helps protect your AKS cluster from unauthorized access and potential security threats.
By implementing Azure AKS Firewall, you can significantly reduce the attack surface of your cluster and ensure the integrity of your applications and data.
Explore further: Traffic Manager in Azure
Azure AKS Firewall Basics
You can deploy an AKS cluster into an existing virtual network, forcing all outbound traffic through the firewall. This is done by using the userDefinedRouting outbound type, which ensures no other egress paths exist.
The target subnet to be deployed into is defined with the environment variable, $SUBNETID. Set the value for the subnet ID using the following command.
Broaden your view: Azure Databricks Subnet
You can use the loadBalancer outbound type instead of userDefinedRouting. This configuration will enable AKS to skip the setup and IP provisioning for the load balancer.
AKS will create a system-assigned kubelet identity in the node resource group if you don't specify your own kubelet managed identity. This only supports the CNI network plugin for user-defined routing.
To create an AKS cluster using a system-assigned managed identity with the CNI network plugin, use the az aks create command.
Consider reading: Azure Cosmos Db User Assigned Identity
Network Configuration
To configure your network for Azure AKS Firewall, you'll need to create a virtual network with multiple subnets, one for the cluster and one for the firewall. You can also create a subnet for internal service ingress.
You can deploy an AKS cluster into the existing virtual network using the userDefinedRouting outbound type, which forces all outbound traffic through the firewall. This configuration skips the setup and IP provisioning for the load balancer.
For another approach, see: Create Virtual Network Azure
To add an extra layer of security, you can configure network policies to control traffic to and from pods within the cluster. Network policies define the rules governing outbound traffic from pods.
Azure Firewall is a managed firewall service that controls both inbound and outbound traffic to and from your AKS cluster. You can create rules to permit or deny specific traffic based on source and destination IP addresses, ports, and protocols.
Here are the basic steps to deploy an AKS cluster with Azure Firewall:
- Create an AKS cluster with user-defined routing
- Define the outbound type to use the UDR that already exists on the subnet
- Configure network policies to control traffic to and from pods within the cluster
- Create a DNAT rule in Azure Firewall to allow inbound traffic
Virtual Network with Multiple Subnets
To create a virtual network with multiple subnets, you can use the az network vnet create and az network vnet subnet create commands.
A virtual network with two subnets can be created to host the AKS cluster and the Azure Firewall. Each has their own subnet.
You can use the az group create command to create a resource group. Then, create a virtual network with two subnets using the az network vnet create and az network vnet subnet create commands.
On a similar theme: Azure Private Subnet
Here are the steps to create a dedicated virtual network with AKS subnet and a dedicated subnet for Azure Firewall:
- Create a resource group using the az group create command.
- Create a virtual network with two subnets to host the AKS cluster and the Azure Firewall using the az network vnet create and az network vnet subnet create commands.
The subnet for the AKS cluster can have an address prefix of 10.42.1.0/24, while the subnet for the Azure Firewall can have an address prefix of 10.42.2.0/24.
You can also create an optional subnet for internal service ingress.
Intriguing read: Azure Subnet
Network Policies
Network policies in Kubernetes are used to control the flow of traffic to and from pods within a cluster. Specifically, egress policies define the rules governing outbound traffic from pods.
In AKS, we can configure these policies to control which pods are allowed to communicate with specific external destinations, specifying ports and protocols as needed.
Egress policies can be used to restrict traffic to specific URLs or IP addresses, which can be useful for security or compliance purposes.
To configure egress policies, you can use the Kubernetes API to create a new policy object, specifying the rules for egress traffic.
If this caught your attention, see: Azure Webapp Capture Requests Blocked by Network Rules
Here are some key considerations for configuring egress policies:
- Specify the pods that are allowed to communicate with external destinations.
- Define the rules for egress traffic, including the ports and protocols used.
- Consider using a network policy to restrict traffic to specific URLs or IP addresses.
By configuring egress policies, you can gain more control over the traffic flowing in and out of your pods, which can help improve security and reduce the risk of data breaches.
Traffic Restriction
Traffic restriction is a crucial aspect of Azure AKS Firewall. You can restrict ingress traffic using Azure Firewall, which allows you to expose services and deploy applications to your cluster while maintaining control over incoming traffic.
To restrict ingress traffic, you can review the AKS Store Demo quickstart manifest to see all the resources that will be created. Then, deploy the service using the kubectl apply command.
Azure Firewall can also be used to allow inbound traffic through it, which is necessary when using a User-Defined Route (UDR) to force all egress traffic. In this case, you need to create a DNAT rule in Azure Firewall to correctly allow ingress traffic.
Take a look at this: Access Azure Key Vault Using Service Principal C#
To configure inbound connectivity, you need to write a DNAT rule to the Azure Firewall. This involves getting the internal IP address assigned to the load balancer using the kubectl get services command, and then getting the service IP using the kubectl get svc command.
Here's a step-by-step guide to creating a DNAT rule:
1. Get the internal IP address assigned to the load balancer using the kubectl get services command.
2. Get the service IP using the kubectl get svc command.
3. Add the NAT rule using the az network firewall nat-rule create command.
By following these steps, you can restrict traffic to your Azure AKS cluster and ensure that only authorized traffic is allowed to enter the cluster.
Recommended read: Azure Data Factory Ip Address Range
Route Configuration
Route Configuration is a crucial step in setting up Azure AKS Firewall. To associate the route table with AKS, you need to reference the route table in the virtual network holding both the cluster and firewall, and update the route table of the cluster's subnet.
Related reading: Trace Route in Azure
To create a route table, you can use the az network route-table create command. This command creates an empty route table to be associated with a given subnet. For example, you can use the command az network route-table create --resource-group $RG --location $LOC --name $FWROUTE_TABLE_NAME to create a route table.
You'll also need to create routes in the route table for the subnets using the az network route-table route create command. This command creates a route in the route table for a given subnet. For example, you can use the command az network route-table route create --resource-group $RG --name $FWROUTE_NAME --route-table-name $FWROUTE_TABLE_NAME --address-prefix 0.0.0.0/0 --next-hop-type VirtualAppliance --next-hop-ip-address $FWPRIVATE_IP to create a route to the Azure Firewall.
Here are the steps to create a UDR (User Defined Routing) with a hop to Azure Firewall:
1. Create an empty route table to be associated with a given subnet using the az network route-table create command.
2. Create routes in the route table for the subnets using the az network route-table route create command.
Note that each subnet can have zero or one route table associated to it.
Take a look at this: Azure Vault Route
Network Security Groups
Network Security Groups are a powerful tool in Azure that let us filter network traffic. We can associate them with subnets containing AKS nodes to control egress traffic.
Network Security Groups can be used to filter network traffic in a very specific way. By creating rules, we can permit or deny specific traffic based on source and destination IP addresses, ports, and protocols.
Network Security Groups are an essential part of a comprehensive network security strategy in Azure. They allow us to have granular control over the traffic flowing in and out of our AKS cluster.
In AKS, we can configure Network Security Groups to control which pods are allowed to communicate with specific external destinations, specifying ports and protocols as needed. This is especially useful when we need to restrict access to certain resources or services.
You might like: Azure Access Control Service
Management and Best Practices
Managing your Azure AKS firewall effectively requires some best practices to ensure secure egress traffic. Applying the principle of least privilege to egress traffic involves configuring network policies that only allow necessary outbound connections for each application, reducing the attack surface and limiting data exfiltration.
Implementing monitoring and logging for egress traffic is also crucial, as it helps detect anomalies and ensures compliance. Tools like Azure Monitor and third-party solutions provide visibility into outbound traffic patterns, helping to identify potential security threats.
To put these best practices into action, consider the following key strategies:
- Configure network policies to only allow necessary outbound connections for each application.
- Implement monitoring and logging for egress traffic using tools like Azure Monitor and third-party solutions.
Role of Kubernetes
Kubernetes is a powerful tool for managing containerized applications. It provides a robust framework for deploying, scaling, and maintaining applications.
Egress plays a crucial role in Kubernetes, referring to the outbound traffic from pods to external resources. Managing egress traffic is crucial to ensure that applications can securely and efficiently communicate with these external entities.
Pods are the basic execution units in Kubernetes, and understanding their lifecycle is essential for effective management. Pods can be thought of as a collection of containers that are tightly coupled and share resources.
Egress traffic is managed through the use of egress policies, which allow administrators to control and limit the flow of traffic to external resources. This is essential for maintaining security and preventing unauthorized access to sensitive data.
Kubernetes provides a range of tools and features for managing egress traffic, including egress controllers and network policies. These tools enable administrators to create and enforce egress policies that meet the specific needs of their applications.
Additional reading: Azure Kubernetes Service vs Azure Container Apps
Management Best Practices

Effective egress management is crucial to ensure the security and compliance of your AKS cluster. Applying the principle of least privilege to egress traffic involves configuring network policies that let only the necessary outbound connections for each application.
This reduces the attack surface and limits the potential for data exfiltration. Implementing monitoring and logging for egress traffic helps detect anomalies and ensure compliance.
Monitoring and logging tools like Azure Monitor and third-party solutions provide visibility into outbound traffic patterns, helping to identify potential security threats. This visibility is essential to stay on top of your egress traffic.
Here are some best practices for egress management:
- Apply the principle of least privilege to egress traffic.
- Implement monitoring and logging for egress traffic.
Setup and Deployment
To set up an Azure Firewall, you'll need to configure inbound and outbound rules, which can be done by creating a standard SKU public IP resource using the `az network public-ip create` command.
This resource will be used as the Azure Firewall frontend address, and setting it up may take a few minutes.
Here's an interesting read: Ip Address Azure
You can register the Azure Firewall CLI extension using the `az extension add` command to create an Azure Firewall.
To enable DNS proxy, you'll need to create an Azure Firewall and set the `--enable-dns-proxy` parameter to `true` using the `az network firewall create` command.
To create an Azure Firewall IP configuration, you'll need to use the `az network firewall ip-config create` command, specifying the firewall name, public IP address, and virtual network name.
Here are the steps to create an Azure Firewall:
- Create a standard SKU public IP resource using the `az network public-ip create` command.
- Register the Azure Firewall CLI extension using the `az extension add` command.
- Create an Azure Firewall and enable DNS proxy using the `az network firewall create` command.
- Create an Azure Firewall IP configuration using the `az network firewall ip-config create` command.
Tools and Solutions
In the world of AKS cluster management, egress management is a crucial aspect to consider. Azure Firewall and Network Security Groups (NSGs) are two powerful tools that help control both inbound and outbound traffic for AKS clusters. Azure Firewall is a managed service that lets us create rules based on IP addresses, ports, and protocols.
To further manage egress traffic, we can associate NSGs with subnets containing AKS nodes. This provides additional filtering capabilities and helps us enforce security policies. I've seen this approach work well in organizations with complex network requirements.
For more granular control over outbound traffic, we can deploy egress proxies like Squid or HAProxy within our cluster. These proxies help us inspect and monitor traffic, and even route it through specific paths. This is particularly useful for organizations with specific routing needs.
Custom routing and egress controllers can also be implemented to integrate with AKS. This provides detailed control over outbound traffic and can be a good option for organizations with unique requirements. However, it may require additional expertise and setup.
DNS configuration is also essential for egress traffic. AKS uses Azure DNS by default, but we can configure custom DNS settings to meet specific organizational requirements. This ensures that our egress traffic is properly resolved and routed.
Here's a summary of the tools and solutions we've discussed:
- Azure Firewall and NSGs
- Egress Proxies (Squid or HAProxy)
- Custom Routing and Egress Controllers
- DNS Configuration
- Azure Private Link
Set Up
To set up an Azure Firewall, you'll need to configure inbound and outbound rules. This will enable your organization to control granular ingress and egress traffic rules into and out of the AKS Cluster.
Readers also liked: Azure Devops Agent Firewall Rules

First, create a standard SKU public IP resource using the az network public-ip create command. This resource will be used as the Azure Firewall frontend address.
Register the Azure Firewall CLI extension to create an Azure Firewall using the az extension add command.
To enable DNS proxy, create an Azure Firewall and use the az network firewall create command with the --enable-dns-proxy parameter set to true.
Setting up the public IP address to the Azure Firewall may take a few minutes. Once it's ready, the IP address created earlier can be assigned to the firewall front end.
To leverage FQDN on network rules, we need DNS proxy enabled. When DNS proxy is enabled, the firewall listens on port 53 and forwards DNS requests to the DNS server specified above.
Here are the steps to create an Azure Firewall:
- Create a standard SKU public IP resource using the az network public-ip create command.
- Register the Azure Firewall CLI extension to create an Azure Firewall using the az extension add command.
- Create an Azure Firewall and enable DNS proxy using the az network firewall create command with the --enable-dns-proxy parameter set to true.
If you use secure access to the AKS API server with authorized IP address ranges, you need to add the firewall public IP into the authorized IP range.
Explore further: Azure Ip Address Ranges
Security and Connectivity
Azure AKS Firewall offers robust security features to control both inbound and outbound traffic to and from our AKS cluster. Azure Firewall is a managed firewall service that controls both inbound and outbound traffic to and from our AKS cluster.
To validate connectivity, navigate to the Azure Firewall frontend IP address in a browser, and you should see the AKS store app. In this example, the Firewall public IP was 203.0.113.32.
Azure Firewall and Network Security Groups can be used to filter network traffic, and we can associate them with subnets containing AKS nodes to control egress traffic. Network Security Groups also let us filter network traffic, and we can associate them with subnets containing AKS nodes to control egress traffic.
Here are some options for securely connecting Azure resources:
- Private IP within a Virtual Network (VNet)
- Virtual Network Service Endpoint
- VNet peering
VNet Rules are recommended for accessing a MySQL or PostgreSQL DB instance from pods running on an AKS worker node, as they avoid issues with dynamic IP addresses and node additions.
Gateways
Gateways are a crucial part of securing and managing traffic in Kubernetes environments. They help ensure that egress traffic from pods passes through specific gateways or proxies for security, compliance, or performance reasons.
Azure offers services like Azure Firewall, Azure Application Gateway, and Azure Front Door that can act as egress gateways. These services provide network filtering, load balancing, and application-level security for outgoing traffic.
Having a clear understanding of how gateways work and what options are available can help you make informed decisions about your Kubernetes security and connectivity setup.
If this caught your attention, see: Azure Application Gateway
Secure Connectivity
Secure connectivity is a top priority for any cloud-based application. Azure supports multiple options for securely connecting Azure resources.
Private IP addresses within a Virtual Network (VNet) allow Azure resources to communicate freely with each other. This is a straightforward way to enable secure communication between resources in the same VNet.
Virtual Network Service Endpoints enable service resources like Azure DB for MySQL and PostgreSQL to be made available to other resources in a VNet. This is done by adding a shared service tag like Microsoft.Sql to the cluster subnet’s service endpoints.
Broaden your view: Azure Secure Score
VNet peering enables communication between Azure resources deployed into different VNets, as if they were on the same VNet. This can be a powerful tool for connecting resources across different VNets.
To access a MySQL or PostgreSQL DB instance from pods running on AKS worker nodes, you have two options. You can create a firewall rule on the Azure DB Server with a range of IP addresses that encompasses all IPs of the AKS Cluster nodes.
Alternatively, you can create a VNet Rule on the Azure DB Server that allows access from the subnet the AKS nodes are in. This is recommended and preferable because it avoids issues with dynamic IP addresses and node scaling.
Here are the recommended options for securely connecting Azure resources:
- Private IP addresses within a VNet
- Virtual Network Service Endpoints
- VNet peering
- VNet Rules for accessing DB instances
For egress traffic, Azure offers services like Azure Firewall, Azure Application Gateway, and Azure Front Door that can act as egress gateways. These services offer features like network filtering, load balancing, and application-level security for outgoing traffic.
Consider reading: Azure Application Gateway Waf
Validate Connectivity
To validate connectivity, navigate to the Azure Firewall frontend IP address in a browser. You should see the AKS store app, which is a good indication that everything is working as expected.
The Azure Firewall public IP address can vary, as seen in Examples 1 and 2. In Example 1, the Firewall public IP was 203.0.113.32, while in Example 2, it was 52.253.228.132.
If you see the AKS store app, it means that the Azure Firewall is functioning correctly and allowing traffic to flow through. This is a crucial step in ensuring that your AKS cluster is properly connected to the Azure Firewall.
Sources
- https://learn.microsoft.com/en-us/azure/firewall/protect-azure-kubernetes-service
- https://learn.microsoft.com/en-us/azure/aks/limit-egress-traffic
- https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/app-platform/aks/network-topology-and-connectivity
- https://bobcares.com/blog/azure-kubernetes-egress/
- https://blog.crossplane.io/azure-secure-connectivity-for-aks-azure-db/
Featured Images: pexels.com