In this project, we will learn how to design a secure Azure Virtual Network with segmented subnets, deploy Linux virtual machines, configure Network Security Groups (NSGs), implement User-Defined Routes (UDRs), and validate secure communication between application tiers.
Step 1: Create the Virtual Network
a. Sign in to the Azure Portal.
b. Search for Virtual Networks.
c. Click Create.
Assign choice values to the tabs
Basics
Resource Group: Lab-RG
Name@ Production-VNet
Region@ West US 3 (Choose your preferred region)
Address Space:
10.0.0.0/16
//Create the following subnets:
Click on the "+ Add a subnet" to add the following subnet.
Subnet Address Range
Frontend-subnet 10.0.1.0/24
Backend-subnet 10.0.2.0/24
Database-subnet 10.0.3.0/24
Click on "Review + Create".
Click on Add to add the subnet
//Each subnet is created independently by repeating the process.
After validation has passed, press the "Create " button to create the VNet
Check:
On the left pane in your VNet, click on "settings" and then "subnets"
Step 2: Create NSGs
Create two NSGs:
Frontend-NSG
Search:
Network Security Groups
Create:
a. Fill in the values in the "Basics" tab
b. Review + create
After validation has passed, click Create
Go to resource
Repeat the same steps for the Backend-NSG
Backend-NSG
Search:
Network Security Groups
Create:
a. Fill in the values in the "Basics" tab
b. Review + create
After validation has passed, click Create
Go to resource
Step 3: Configure Frontend NSG Rules
Attach Frontend-NSG to Frontend-subnet.
a. In the "Subnets" tab under the "Settings" blade in the left pane, click "Frontend-subnet".
b. Go to the "Network Security Group" under the "Edit subnet".
c. Click on the drop-down arrow and select "Frontend-NSG"
Add inbound rules:
Priority Source Port Protocol Action
100 Internet 80 TCP Allow
110 Internet 443 TCP Allow
120 Your IP 22 TCP Allow
4096 Any Any Any Deny
In the "Frontend-NSG", click on the "Inbound security rules" under the "Settings" blade in the left pane.
Click "Add".
Provide the necessary details
*SSH *
Keep using the "Add" button until you are done setting the rules.
HTTP
HTTPS
Custom
//Refer to the table above for the appropriate values.
This allows:
HTTP
HTTPS
SSH from your workstation only
Step 4: Configure Backend NSG Rules
Attach Backend-NSG to Backend-subnet.
a. In the "Subnets" tab under the "Settings" blade in the left pane, click "Backend-subnet".
b. Go to the "Network Security Group" under the "Edit subnet".
c. Click on the drop-down arrow and select "Backend-NSG"
Create inbound rule:
Priority Source Source Address
100 IP Addresses 10.0.1.0/24
Destination: Any
Protocol: Any
Action: Allow
Leave the default DenyAllInbound rule.
Result:
✅ Frontend subnet can access Backend VM
✅ Internet cannot access Backend VM
Step 5: Deploy Frontend VM
Create a Linux VM.
Recommended:
Setting Value
Name frontend-vm
Image Ubuntu 24.04 LTS
Size B1s
Authentication SSH Key
Networking:
Setting Value
Virtual Network Production-VNet
Subnet Frontend-subnet
Public IP Create New
NSG Frontend-NSG
Download the private key and create the resource
Create VM.
Repeat the same step to create the Backend VM.
Step 6: Deploy Backend VM
Create another Linux VM.
Setting Value
Name backend-vm
Image Ubuntu 24.04 LTS
Size B1s
Networking:
Setting Value
VNet Production-VNet
Subnet Backend-subnet
Public IP None
NSG Backend-NSG
Create VM.
//Do not forget to download the private key
Step 7: Verify Public Access
Make sure you log in to your Azure portal from your Azure CLI/Git Bash. (Git Bash was the CLI used in this project)
Frontend VM
Obtain Public IP:
Type the command below in the terminal:
ssh azureuser@
ssh -i "C:\Users***l\Downloads\frontend-vm_key.pem" azureuser@20.168.66.216
ssh → The command to start an SSH session.
-i "C:\Users***l\Downloads\dev_key.pem" → Specifies the identity file (private key) used for authentication.
On Windows, make sure the path is correct and the .pem file has proper permissions.
azureuser@20.168.66.216 → Connects to the server at IP 20.168.66.216 using the username azureuser.
Type yes and enter
Should connect successfully.
Backend VM
Try connecting to the backend VM using the same syntax. But this time around, use the private key for the backend VM you downloaded:
ssh azureuser@
Expected result should be:
Connection timed out
because:
No Public IP
NSG blocks Internet traffic
Requirement satisfied.
Step 8: Test Frontend → Backend Connectivity
SSH into Frontend VM.
Find Backend private IP:
Example:
10.0.2.4
Install ping utility:
sudo apt update
sudo apt install iputils-ping -y
Ping Backend:
ping 10.0.2.4
Expected:
64 bytes from 10.0.2.4
Requirement satisfied.
Step 9: Install a Web Server on Frontend
sudo apt update
sudo apt install nginx -y
Enable:
sudo systemctl enable nginx
sudo systemctl start nginx
Browse:
Type http://20.168.66.216
You should see the Nginx welcome page.
Requirement satisfied:
✅ Frontend VM reachable via Public IP.
Step 10: Create User Defined Route (UDR)
Search:
Route Tables
Create:
Frontend-Backend-RT
Add Route
Field Value
Route Name InternalRoute
Address Prefix 10.0.2.0/24
Next Hop Type Virtual Network
Associate Route Table with:
Frontend-subnet
Result:
Traffic destined for Backend subnet remains inside Azure's virtual network routing and never traverses the Internet.
Validation Checklist
Requirement Status
Create VNet ✅
Frontend subnet ✅
Backend subnet ✅
Database subnet ✅
Linux VM in Frontend ✅
Linux VM in Backend ✅
HTTP/HTTPS allowed to Frontend ✅
Backend accepts traffic only from Frontend subnet ✅
Internet blocked from Backend ✅
Frontend has Public IP ✅
Backend has no Public IP ✅
Frontend can ping Backend ✅
UDR configured ✅
Top comments (0)