Azure Firewall — DNAT · Network · Application Rules

# Tạo resource group
az group create \
  --name rg-lab16-firewall \
  --location southeastasia

# Tạo VNet + AzureFirewallSubnet
az network vnet create \
  --resource-group rg-lab16-firewall \
  --name vnet-fw \
  --address-prefix 10.1.0.0/16 \
  --subnet-name AzureFirewallSubnet \
  --subnet-prefix 10.1.1.0/26

# Tạo SubnetServer
az network vnet subnet create \
  --resource-group rg-lab16-firewall \
  --vnet-name vnet-fw \
  --name SubnetServer \
  --address-prefix 10.1.2.0/24

# Tạo VM không có public IP
az vm create \
  --resource-group rg-lab16-firewall \
  --name vm-lab16-server \
  --image Win2022AzureEditionCore \
  --size Standard_B2s \
  --vnet-name vnet-fw \
  --subnet SubnetServer \
  --admin-username azureadmin \
  --admin-password "P@ssw0rd2026!" \
  --public-ip-address ""

# Lấy private IP của VM
az vm show \
  --resource-group rg-lab16-firewall \
  --name vm-lab16-server \
  --show-details \
  --query privateIps --output tsv

# Tạo Standard Public IP (bắt buộc cho Azure Firewall)
az network public-ip create \
  --resource-group rg-lab16-firewall \
  --name pip-fw-lab16 \
  --sku Standard \
  --allocation-method Static \
  --location southeastasia

# Triển khai Azure Firewall Standard (~10 phút)
az network firewall create \
  --resource-group rg-lab16-firewall \
  --name fw-lab16 \
  --location southeastasia \
  --sku AZFW_VNet \
  --tier Standard

# Gắn IP vào firewall
az network firewall ip-config create \
  --resource-group rg-lab16-firewall \
  --firewall-name fw-lab16 \
  --name fw-ipconfig \
  --public-ip-address pip-fw-lab16 \
  --vnet-name vnet-fw

# Lấy private IP và public IP của firewall
FW_PRIVATE_IP=$(az network firewall show \
  --resource-group rg-lab16-firewall \
  --name fw-lab16 \
  --query "ipConfigurations[0].privateIPAddress" \
  --output tsv)

FW_PUBLIC_IP=$(az network public-ip show \
  --resource-group rg-lab16-firewall \
  --name pip-fw-lab16 \
  --query ipAddress --output tsv)

echo "Firewall Private IP: $FW_PRIVATE_IP"
echo "Firewall Public  IP: $FW_PUBLIC_IP"

# --- DNAT Rules: RDP forwarding ---
az network firewall nat-rule create \
  --resource-group rg-lab16-firewall \
  --firewall-name fw-lab16 \
  --collection-name dnat-rdp \
  --priority 200 \
  --name Allow-RDP \
  --protocols TCP \
  --source-addresses '*' \
  --dest-addr $FW_PUBLIC_IP \
  --destination-ports 3389 \
  --translated-address 10.1.2.4 \
  --translated-port 3389

# --- Network Rules: Allow DNS ---
az network firewall network-rule create \
  --resource-group rg-lab16-firewall \
  --firewall-name fw-lab16 \
  --collection-name net-allow-dns \
  --priority 200 \
  --action Allow \
  --name Allow-DNS \
  --protocols UDP \
  --source-addresses 10.1.2.0/24 \
  --destination-addresses 8.8.8.8 8.8.4.4 \
  --destination-ports 53

# --- Application Rules: Allow microsoft.com ---
az network firewall application-rule create \
  --resource-group rg-lab16-firewall \
  --firewall-name fw-lab16 \
  --collection-name app-allow-web \
  --priority 200 \
  --action Allow \
  --name Allow-Microsoft \
  --source-addresses 10.1.2.0/24 \
  --protocols Https=443 \
  --fqdn-tags WindowsUpdate \
  --target-fqdns "*.microsoft.com" "*.windowsupdate.com"

# --- Application Rules: Deny bing.com ---
az network firewall application-rule create \
  --resource-group rg-lab16-firewall \
  --firewall-name fw-lab16 \
  --collection-name app-deny-web \
  --priority 300 \
  --action Deny \
  --name Deny-Bing \
  --source-addresses 10.1.2.0/24 \
  --protocols Https=443 \
  --target-fqdns "*.bing.com"

# Tạo Route Table
az network route-table create \
  --resource-group rg-lab16-firewall \
  --name rt-lab16 \
  --location southeastasia \
  --disable-bgp-route-propagation false

# Thêm default route → firewall private IP
az network route-table route create \
  --resource-group rg-lab16-firewall \
  --route-table-name rt-lab16 \
  --name route-to-firewall \
  --address-prefix 0.0.0.0/0 \
  --next-hop-type VirtualAppliance \
  --next-hop-ip-address $FW_PRIVATE_IP

# Gắn Route Table vào SubnetServer
az network vnet subnet update \
  --resource-group rg-lab16-firewall \
  --vnet-name vnet-fw \
  --name SubnetServer \
  --route-table rt-lab16

# Cấu hình custom DNS cho VM NIC
NIC_ID=$(az vm show \
  --resource-group rg-lab16-firewall \
  --name vm-lab16-server \
  --query "networkProfile.networkInterfaces[0].id" \
  --output tsv)

az network nic update \
  --ids $NIC_ID \
  --dns-servers 8.8.8.8 8.8.4.4

# Restart VM để áp dụng DNS
az vm restart \
  --resource-group rg-lab16-firewall \
  --name vm-lab16-server