Question

A network security group named NSG-Web is attached to the subnet hosting several web servers. You add two inbound security rules: Rule 'Allow-HTTP' with priority 200 that permits TCP port 80 from any source, and Rule 'Deny-Internet' with priority 300 that denies all traffic from the Internet service tag. Internet clients report they can still reach the web servers over HTTP. What is the reason for this behavior?

Accepted Answer

The Allow-HTTP rule has a lower priority number, so it is evaluated first and traffic is permitted before the deny rule is reached.

Answer

NSG rules attached to a subnet do not apply to inbound Internet traffic unless also applied to the NIC.

Answer

The default deny rule always overrides custom deny rules with a higher priority number.

Answer

Service tags such as Internet cannot be used in inbound rules, so the Deny-Internet rule is ignored.