Azure Network NAT Rule Collection

azurerm_firewall_nat_rule_collection (Terraform)

The NAT Rule Collection in Network can be configured in Terraform with the resource name azurerm_firewall_nat_rule_collection. The following sections describe 10 examples of how to use the resource and its parameters.

Example Usage from GitHub

BrettOJ/azuread_adfs_jwt_token

resource "azurerm_firewall_nat_rule_collection" "nat_rule" {
  name                = var.name
  azure_firewall_name = var.azure_firewall_name
  resource_group_name = var.resource_group_name
  priority            = var.priority
  action              = "Dnat"

andrewCluey/terraform-azurerm-azurefirewall-nat-rule-collection

resource "azurerm_firewall_nat_rule_collection" "nat_rule" {
  name                = var.nat_collection_name
  azure_firewall_name = var.azure_fw_name
  resource_group_name = var.fw_resource_group_name
  priority            = var.nat_collection_priority
  action              = var.nat_collection_action

s-archer/quick-demos-arch

resource "azurerm_firewall_nat_rule_collection" "natudr01" {
  name                = "natudr01"
  azure_firewall_name = azurerm_firewall.azurefwudr.name
  resource_group_name = azurerm_resource_group.rg.name
  priority            = 100
  action              = "Dnat"

stephaneclavel/terraform

resource "azurerm_firewall_nat_rule_collection" "natrc-demo-test-westeurope-001" {
  name                = "natrc-demo-test-westeurope-001"
  azure_firewall_name = azurerm_firewall.azfw-demo-test-westeurope-001.name
  resource_group_name = azurerm_resource_group.rg-demo-test-westeurope-001.name
  priority            = 100
  action              = "Dnat"

dcasati/aks-clusters

resource "azurerm_firewall_nat_rule_collection" "ssh" {
  name                = "JumpboxSshNatRule"
  azure_firewall_name = module.firewall.name
  resource_group_name = azurerm_resource_group.default.name
  priority            = 200
  action              = "Dnat"

vmnomad/terraform-azurerm-hub_and_spoke

resource "azurerm_firewall_nat_rule_collection" "firewall_nat_rules" {
  name                = "nat-rules"
  azure_firewall_name = azurerm_firewall.hub_firewall.name
  resource_group_name = var.hub_rg_name
  priority            = 100
  action              = "Dnat"

Haggle1996/revolution4-server

resource "azurerm_firewall_nat_rule_collection" "r4fwnat" {
  name                = "r4-nat-collection"
  azure_firewall_name = azurerm_firewall.r4fw.name
  resource_group_name = azurerm_resource_group.r4.name
  priority            = 100
  action              = "Dnat"

AlanCLo/play_terraform

resource "azurerm_firewall_nat_rule_collection" "example" {
  name                = "testcollection"
  azure_firewall_name = azurerm_firewall.example.name
  resource_group_name = azurerm_resource_group.example.name
  priority            = 100
  action              = "Dnat"

flarsmar/Terraform-on-azcloud

resource "azurerm_firewall_nat_rule_collection" "fe-rg" {
  name                = "nat-rules"
  azure_firewall_name = azurerm_firewall.fe-rg.name
  resource_group_name = azurerm_resource_group.fe-rg.name
  priority            = 100
  action              = "Dnat"

anttipo/caf-landingzone-example

resource "azurerm_firewall_nat_rule_collection" "natcollection" {
  for_each = lookup(var.az_firewall_rules, "azurerm_firewall_nat_rule_collection", {})

  name                = each.value.name
  azure_firewall_name = var.az_firewall_settings.az_fw_name
  resource_group_name = var.az_firewall_settings.az_object.resource_group_name

Parameters

• action required - string
• azure_firewall_name required - string
• id optional computed - string
• name required - string
• priority required - number
• resource_group_name required - string
• rule set block
  • description optional - string
  • destination_addresses required - set of string
  • destination_ports required - set of string
  • name required - string
  • protocols required - set of string
  • source_addresses optional - set of string
  • source_ip_groups optional - set of string
  • translated_address required - string
  • translated_port required - string
• timeouts single block
  • create optional - string
  • delete optional - string
  • read optional - string
  • update optional - string

Explanation in Terraform Registry

Manages a NAT Rule Collection within an Azure Firewall.

Tips: Best Practices for The Other Azure Network Resources

In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

azurerm_network_security_group

Ensure to disable RDP port from the Internet

It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.

azurerm_network_security_rule

Ensure to set a more restrictive CIDR range for ingress from the internet

It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.

azurerm_network_watcher_flow_log

Ensure to enable Retention policy for flow logs and set it to enough duration

It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.