Question

Your company deploys an Azure Firewall (Standard SKU) in a hub virtual network. A web server running on a VM in a spoke VNet has the private IP 10.1.2.10 and listens on TCP 8080. You need to publish this server to the internet so that external clients can reach it via the firewall's public IP on TCP 443, with the firewall translating the traffic to the internal address and port. Which type of Azure Firewall rule should you configure?

Accepted Answer

A DNAT rule that translates the firewall public IP:443 to 10.1.2.10:8080

Answer

A network rule allowing inbound traffic from the internet to 10.1.2.10 on TCP 443

Answer

An application rule with a target FQDN pointing to the web server on port 8080

Answer

An SNAT rule that translates the source of inbound traffic to the firewall public IP