Understanding DNAT, Application, and Network Rules in Azure Firewall

Azure Firewall is a cloud-native security service that provides advanced threat protection for Azure workloads. It supports three main rule types:

• DNAT (Destination Network Address Translation) Rules – Used to expose internal resources externally.
• Application Rules – Controls outbound HTTP(S) traffic using FQDNs, URL filtering, and web categories.
• Network Rules – Filters non-HTTP(S) traffic based on IP addresses, ports, and service tags.

1. DNAT (Destination Network Address Translation) Rules

DNAT rules allow inbound traffic from the internet. This traffic can be redirected to a private resource inside an Azure Virtual Network (VNet).

Example DNAT Rule

Source Type/IP/IP Group	Destination IP/Port	Translated IP/FQDN	Translated Port	Protocol
52.10.20.30	443	10.1.0.10 or app.internal.local	443	TCP or UDP

2. Application Rules

Application rules control outbound HTTP(S) traffic using:

• FQDNs (e.g., *.microsoft.com)
• FQDN Tags (e.g., WindowsUpdate, AzureActiveDirectory)
• URL Filtering (block specific URLs)
• Web Categories (e.g., Social Networking, Streaming)

Example Application Rule

Source IP Range	Protocol	Port	Allowed FQDNs	FQDN Tag	Web Category
10.0.0.0/24	HTTPS	443	*.microsoft.com	WindowsUpdate	Shopping

3. Network Rules

Network rules filter non-HTTP(S) traffic using:

• IP Addresses
• Service Tags (e.g., AzureSQL, Storage)
• IP Groups
• FQDNs

Example Network Rule

Source IP Range	Destination IP/FQDN	Protocol	Port	Service Tag
10.1.0.0/24	10.2.0.10 or db.internal.local	TCP	1433 (SQL)	AzureSQL

4. Comparison of DNAT, Application, and Network Rules

Destination Types

Rule Type	Best For	Filters By	Supports FQDN?	Supports FQDN Tags?	Supports URL Filtering?	Supports Web Categories?	Supports Service Tags?	Supports IP Groups?	Supports IP Addresses?
DNAT Rules	Inbound traffic redirection	Firewall IP → Translated IP/FQDN	✅	❌	❌	❌	❌	❌	✅ (Destination)
Application Rules	Outbound HTTP(S) control	FQDNs, FQDN Tags, URLs, Web Categories	✅	✅	✅	✅	❌	❌	❌
Network Rules	Non-HTTP traffic control	IP, Service Tags, FQDN, IP Groups	✅	❌	❌	❌	✅	✅	✅

5. When to Use Each Rule Type

• DNAT Rules – Expose internal resources to external users.
• Application Rules – Control outbound HTTP(S) traffic with FQDN, URL filtering, and Web Categories.
• Network Rules – Allow or block non-HTTP(S) traffic based on IPs, Service Tags, and IP Groups.