Create your first firewall

Before you begin

Check these first — each one is something the firewall depends on.

• You need permission to create networks and firewalls. If you are not sure, ask your administrator.
• A compute quota must already exist in your account before you can create a network — this is set up when your platform is first configured.
• If a menu below is missing, your role probably does not include it — see the Permissions reference (click here).

Create the network

The firewall attaches its interfaces to a network, so create that network first. A subnet's address range is written in CIDR notation, such as 10.0.10.0/24.

1. Open Networking → Networks and select Create VNet.
2. Enter a Name and select a Compute Quota.
3. Configure the subnet: choose Create new subnet and enter a subnet name, the CIDR address range, and an optional default gateway (one subnet maps to one network).
4. Optionally leave Inherit tags ticked and add a resource group and tags, then Save.

Expected result: the VNet and its subnet are queued for creation and appear in the Networks list.

Create the firewall

1. Open Networking → Firewalls and select Create Firewall.
2. Enter a firewall name and an optional description.
3. Choose a size: Small, Medium, or Large.
4. Optionally enable Default Deny Rules to start from a closed security posture.
5. Under Network Configuration, add the firewall's interfaces on the network you created.
6. Optionally assign tags or a resource group, then select Create Firewall.

Expected result: the firewall is queued for creation (visible in the Task Manager) and appears in the list once provisioned.

Add an allow rule

Rules apply in rank order; a lower rank has higher priority.

1. Open the firewall from the list, then open the Rules tab.
2. Select Create, enter a rule name, set the rank (1-9998), and toggle Enabled.
3. Choose the interface, the action Allow, and the protocol (TCP, UDP, ICMP, or Any).
4. Enter the source and destination IP or CIDR; for TCP or UDP, add source and destination ports.
5. Save.

Expected result: the rule set is queued and applied in rank order.

Next steps

• Expose a VM to the internet — publish an internal VM through this firewall (click here)
• Firewalls — SNAT, DNAT, routing, OSPF, DHCP, and logs (click here)