Azure Firewall DNAT Miss: az network firewall policy When the Public IP Is Dead

Azure · Techclick CLI troubleshooting lab

Public IP is on Azure Firewall. DNAT rule looks right. External curl times out. VM is healthy.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Azure for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

DNAT needs a matching network rule, the right firewall public IP, and SNAT/return through the firewall. Policy hierarchy can hide a deny.

Why this ticket shows up

Azure Firewall policy is parent/child. A parent deny or a missing network rule drops DNAT even when the DNAT collection exists.

Symptoms operators actually see

• DNAT collection present, timeout

• Wrong public IP on the rule

• No network rule for the translated port

• Return path bypasses the firewall

CLI first — copy this block

Run these on the Azure device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

az network firewall policy rule-collection-group list --policy-name fw-pol --resource-group rg1 -o table
az network firewall show -n fw1 -g rg1 --query ipConfigurations
az network watcher test-ip-flow --direction inbound --local <fw-ip> --remote 198.51.100.20 --port 443 --protocol TCP --vm fw1
az network nic show-effective-route-table --ids <vm-nic> -o table

How to read that output

The VM default route must point back at the firewall. If it goes to Internet, DNAT return dies.

Triage order

1. Confirm DNAT uses the actual firewall public IP

2. Confirm a network rule allows the translated flow

3. Check the VM effective route to the client

4. Force tunneling / UDR if needed

5. Retest curl

Classic traps

What you see	Real cause	Fix
Add another DNAT	Return UDR is missing	Fix routing
Attach the public IP to the VM	You bypassed the firewall	Wrong design
Open NSG only	Firewall policy still denies	Fix the policy

Proof the ticket is closed

• External curl 200

• Firewall logs show DNAT hit

• VM default route via firewall

Say this in an interview

Azure Firewall DNAT that times out is usually return routing or a parent policy deny, not the VM.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/