Fix: Azure NSG Blocking Network Traffic

!Symptoms

• VM or AKS pods unable to reach external services
• Inbound traffic to application being dropped
• Intermittent connectivity — some ports work, others don't
• NSG flow logs showing denied traffic

?Root Causes

• NSG deny rule with higher priority blocking the traffic
• Default deny-all rule blocking traffic with no explicit allow
• NSG applied to both subnet and NIC — rules compounding unexpectedly
• Service tag not used — IP ranges changed and hardcoded IPs stale
• Application Security Group misconfigured

#Diagnosis Steps

1. 1Check effective NSG rules: Portal → VM → Networking → Effective security rules
2. 2Review NSG flow logs: `az network watcher flow-log show`
3. 3Use IP flow verify: `az network watcher test-ip-flow --vm <vm> --direction Inbound --local <ip>:<port> --remote <ip>:<port>`
4. 4List all NSG rules: `az network nsg rule list --nsg-name <nsg> -g <rg> -o table`
5. 5Check both subnet NSG and NIC NSG — both must allow the traffic

>Fix

1. 1Add an allow rule with higher priority (lower number) than the deny rule
2. 2Use service tags (Internet, AzureCloud, Storage) instead of IP ranges
3. 3Remove duplicate NSG from NIC if subnet NSG is sufficient
4. 4Fix Application Security Group membership
5. 5For AKS, ensure the cluster NSG allows required ports (443, 10250, etc.)

*Prevention

• Define NSGs in Terraform/Bicep with clear naming and comments
• Use Azure Policy to enforce NSG standards across subscriptions
• Always use service tags instead of hardcoded IP ranges
• Prefer subnet-level NSGs over NIC-level for simpler management
• Enable NSG flow logs for all production NSGs and alert on unexpected denies

Related Error Messages