NSG
Associated with subnets or NICs to allow or deny inbound/outbound traffic. The basic principle is minimal allowance to avoid spreading unnecessary traffic.
Landing Zone Network Guide
7 Roles of FW, UDR, and NSG
NSG allows/denies, UDR changes routes, and Azure Firewall does centralized inspection. Designing each role separately helps avoid unintended bypasses.
Key points of this chapter
- NSG controls ingress/egress at subnet/NIC
- UDR changes the next hop
- Firewall does inspection, logging, and centralized control
Explanation note
First explain the flow with a diagram, then supplement only the key points in text. For those unfamiliar with networking, showing where traffic flows before terminology is effective.
UDR
Decides traffic paths, such as pointing 0.0.0.0/0 to the Firewall or on-premises-bound traffic to the Gateway.
Azure Firewall
Centrally inspects east-west and north-south traffic, with logging, FQDN control, and policy management.