NSG required for Bastion subnet?

Question

Hi,

I have setup Bastion service to connect to my VMs which are having private IPs, and subnet which is containing VMs has been associated with default NSG rules (3 inbound and 3 outbound)

I am wondering if I need to apply NSG rules on my Bastion subnet also? Is there any need for it?

I found below article on this topic

https://learn.microsoft.com/en-us/azure/bastion/bastion-nsg

also, need some clarity about the last ingress rule mentioned in the article for target VM subnet as 3389 traffic is anyways allowed between Bastion and VM subnets being in the same VNet.

Is it about ensuring that only 3389 traffic is received from bastion subnet to VM subnet.

Answer 1

@WinTechie , Azure Bastion is a fully managed platform PaaS service from Azure that is hardened internally to provide you secure RDP/SSH connectivity. You don't need to apply any NSGs to the Azure Bastion subnet. Because Azure Bastion connects to your virtual machines over private IP, you can configure your NSGs to allow RDP/SSH from Azure Bastion.

Ref: https://learn.microsoft.com/en-us/azure/bastion/bastion-overview

But, if you choose to use an NSG with your Azure Bastion resource, you must create all of the following ingress and egress traffic rules. Omitting any of the following rules in your NSG will block your Azure Bastion resource from receiving necessary updates in the future and therefore open up your resource to future security vulnerabilities.

Azure Bastion opens the RDP/SSH connection to your Azure virtual machine using private IP. So, 3389/22 are must.

----------

Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.