Securing a Private VM with Azure Firewall, Bastion, NSG, and NAT Gateway

fadayini fiyinfoluwa — Wed, 07 Oct 2026 09:32:38 +0000

Introduction

Exposing a VM directly to the internet is one of the easiest ways to widen your attack surface. In this lab, I built an architecture where a web server has no public IP yet is still reachable through a controlled entry point: Azure Firewall.

Architecture overview

The flow, as shown in my diagram:

Users resolve DNS to the Azure Firewall's public IP.
Azure Firewall filters traffic and forwards it into the virtual network.
The NSG on the subnet allows port 80 and the Bastion subnet, and denies everything else.
The private VM has no public IP and serves the site.
Admins use Azure Bastion for SSH.
NAT Gateway handles outbound internet access.

Step 1: Deploy the network security stack.

I deployed everything into one resource group (FW-rg, Central US). The deployment created:

Resources

Virtual Network

Purpose: Network boundary and subnets
Azure Firewall

Purpose: Public entry point and traffic filtering
Firewall Policy

Purpose: Centralized rules
Azure Bastion

Purpose: Secure browser-based SSH
NAT Gateway

Purpose: Outbound-only internet access
Public IPS Firewall
Purpose: Firewall management and Bastion

The deployment page showed Firewall and Bastion still provisioning while the network, NAT gateway, policy, and IPs were already OK. Firewall and Bastion take the longest, so be patient.

Step 2: Create the private VM

I created an Ubuntu VM (FW-VM) with no public IP, placed in the workload subnet protected by the NSG.

Step 3: Connect through Bastion

Instead of opening port 22 to the internet, I connected from the portal using Bastion. The login banner showed the source was 10.0.1.4, an internal address from the Bastion subnet. The admin never touches the VM over the public internet.

Step 4: Install a web server
bash
sudo apt update
sudo apt install apache2 -y
sudo vim /var/www/html/index.html

(My first attempt was sudo pt update, which failed with "command not found." Typos happen!)

The install output showed Apache enabled and running. I replaced the default Ubuntu page with a simple heading to prove the traffic path works.

Step 5: Configure the NSG

The NSG rules follow least privilege:

Allow TCP 80 for web traffic
Allow the Bastion subnet for administration
Deny all other traffic
Step 6: Test

Browsing to the firewall's public IP returned my custom page, served from a VM that has no public IP of its own. The firewall is the only door.

Key lessons

Layer your defenses. Firewalls and NSG enforce policy at different levels.
Private doesn't mean unreachable. Publish services through a controlled gateway.
Eliminate open SSH. Bastion removes a common attack vector.
Separate inbound and outbound paths. The firewall handles inbound; the NAT Gateway handles outbound.
Deny by default.

What I want to explore next
Add explicit DNAT and network rules in the firewall policy.
Enable diagnostic logs and query them in Log Analytics.
Reproduce the setup with Bicep or Terraform

Conclusion

This lab showed me that good cloud security is mostly about reducing exposure and routing everything through well-defined chokepoints. If you're learning Azure networking, build this one yourself.

Launched my first Virtual Machine

fadayini fiyinfoluwa — Mon, 06 Jul 2026 19:03:06 +0000

Azure VM Deployment & Secure Remote Access
What I did: Provisioned a virtual machine on Microsoft Azure from scratch — networking, deployment, and secure SSH access — and connected to it from a local terminal.
Skills Learnt include

Networking Fundamentals

Learned and applied CIDR notation to define IP address ranges
Understood IP address allocation logic within a network
Configured subnets to segment network address space

Azure Resource Architecture

Created a Resource Group (logical container for cloud resources)
Deployed a Virtual Network (VNet) with associated subnets
Provisioned a Virtual Machine within that network

Secure Remote Access (Linux/Unix)

Retrieved and managed SSH key-pair credentials (.pem file)
Applied correct file permission hardening (chmod 400) to protect private keys (a security best practice)
Constructed and executed an SSH connection command using key-based authentication
Understood and handled host-key verification (known_hosts trust-on-first-use)

Hosted My First Website

fadayini fiyinfoluwa — Thu, 04 Jun 2026 19:38:19 +0000

So just a few days ago I began a journey to learn
cloud computing using MICROSOFT AZURE, and I just hosted my first static website; it was quite exciting. Some things I learned include

How to create resource groups
How to create storage/blob accounts
How to create a static website data management container
Upload website HTML files
switch access to private and anonymous (blob).

DEV Community: fadayini fiyinfoluwa

Securing a Private VM with Azure Firewall, Bastion, NSG, and NAT Gateway

Launched my first Virtual Machine

Hosted My First Website