Question

You deploy Azure Bastion into a dedicated AzureBastionSubnet to provide secure RDP/SSH access to VMs in a hub VNet. Your security team requires an NSG on AzureBastionSubnet to satisfy compliance. After associating the NSG, users can no longer connect through Bastion. Which set of outbound rules must the NSG allow to restore Bastion functionality while keeping the NSG in place?

Accepted Answer

Outbound to the VirtualNetwork service tag on ports 3389 and 22, to AzureCloud on port 443, to the VirtualNetwork tag on port 8080/5701, and to Internet on port 80

Answer

Outbound to Internet on port 443 only, since Bastion is a fully managed PaaS service that proxies all traffic through the public endpoint

Answer

Outbound to the GatewayManager service tag on ports 443 and 4443, and inbound from the Internet on port 3389

Answer

No outbound rules are needed because AzureBastionSubnet ignores NSG outbound rules by design