How to use Network Security Group (NSG) to allow and deny access to a virtual machine.
Tags: cloudcomputing, beginners, tutorial, learning
Published: 2023-12-17 20:43:31

## Introduction
You can restrict network traffic to resources in your virtual network by using network security groups. A list of security rules that permit or prohibit inbound or outgoing network traffic is contained in network security groups.

## Steps involved in creating Network Security Group
The first thing to do is to create a virtual machine to use in testing the network security. 
- Click create a resource
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/09zt4jgubficbnzrxlko.png)
- Search for virtual machine in the market place and click create
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/63pbsah5pdb0xwlm3pzc.png)
- Fill the project details which comprises of subscription and resource group
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hi11o5y6a63og70f5ne5.png)
- Fill in the instance details
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wz2wi62bz756rnlxt9cz.png)
- Fill the Administrator account
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rdbgn6p3tnqcmogc2b99.png)
- In the inbound port rules section, select none for Public inbound ports
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cuzff2plodou4ikch5zd.png)
- Select the Networking tab and choose none for NIC network security group.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ccu73vtcpmhjr6eitk3q.png)
- Select the monitoring tab, disable Boot diagnostics and leave other settings as default, click create + review after
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cbse1tfdhx27xlj9igpt.png)
- Click create once validation is passed
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cp649wuyi23ta9msjeza.png)
- Wait for it to deploy and click go to resource once deployment is complete
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c8bdr12cx3kzs49tp0hw.png)
- In the overview page, Click Networking in the settings. You will notice that there is no network security group in the inbound port rules. Also take note of the Network Interface Card name 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mv2aktts5pymjm8fwr8v.png)

## How to create Network Security Group
- Click create a resource
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/09zt4jgubficbnzrxlko.png)
- Search for virtual machine in the market place and click create
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8osxup7mg1h52bba2a9x.png)
- Fill the project details
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bdwwr2k607x9j5wrmjqm.png)
- Fill the instance details
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jwepvgu4fbywkldoj8mv.png)
- Click preview + create
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/q0io4qctqbvskro9fonh.png)
- Click create once validation passed
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xgk8ltoz3xttl0gp2j8v.png)
- Click go to resource once deployment is complete
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tlu4hcx3wlzj8oezy551.png)
- Click Network interfaces in the settings section and click associate
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x5paajftdi53rt3a4q97.png)
- Click Network Interface association and select the name of the interface noted earlier from the drop down, click Okay after.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ott308kfcu8zeidlgz40.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9vme37prg0ijh7wilfzn.png)

## How to configure Inbound security port rule to give access to RDP. 
- Go back to the virtual machine created earlier and click connect in the overview page 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/egjz4wxtvmf1e3lyh71u.png)
- We need to connect to the virtual machine by downloading the RDP. First click connect under Native RDP
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/87pqpdsux2ftthsfmck0.png)
- Click download RDP
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/polseu66ppuky2ucwdsh.png)
- After downloading the RDP file click on the file to launch it and the launch will fail because the Network Security Group created will not allow RDP
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0yb4xwfdu6g5wm0uuhdc.png)
- Click Networking under settings in the virtual machine and click Add inbound port rule
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mw7rpohx2nf8pktq88d6.png)
- Configure the inbound rule with the following settings
Destination port ranges: 3389
Protocol: TCP
Priority: 300
Name: AllowRDP
Leave other settings as default and click add 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1lxgytwo4b0v8wzt3kq2.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nkihagiw43cayvl9wz9l.png)
- We need to try to connect the virtual machine again to check if the inbound rule is working. Download the RDP file again 
- After downloading the RDP file click on the file to launch it and click connect
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dh5g357e7qgtrlovpr5m.png)
- Enter your username and password and click Ok
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jooln7lw1bz61hkltrx5.png)
- Click yes 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r1oc8vl8ij35xb0vxnnp.png)

## How to configure Outbound port rule to deny access to internet
- First check if the virtual machine connected to can access internet by opening internet explorer and search bing.com
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vsog8tm85dqpsmaefjtf.png)
This shows that outbound port rule is allowed
- Click networking in the settings, click outbound port rule and select add outbound port rule
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7sfdfr2vzfb3w249xvfp.png)
- Enter the following settings
Destination: Service Tag
Destination port ranges: *
protocol: TCP
Action: Deny
Priority: 4000
Name: DenyInternet
Leave other settings as default and click save
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/39oqqdtshoi6x8omcdte.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ngrn0hre8vlfihgnyu9l.png)
- To check if the outbound rule is working, go back to the connected virtual machine and search bing.com in internet explorer. The access will be denied
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xq51z4ay74a4gkqp6tsv.png)