{"id":24042,"date":"2025-02-20T12:03:31","date_gmt":"2025-02-20T12:03:31","guid":{"rendered":"https:\/\/aidanfinn.com\/?p=24042"},"modified":"2025-02-20T12:03:33","modified_gmt":"2025-02-20T12:03:33","slug":"beware-of-the-default-rules-in-network-security-groups","status":"publish","type":"post","link":"https:\/\/aidanfinn.com\/?p=24042","title":{"rendered":"Beware Of The Default Rules In Network Security Groups"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The Network Security Group (NSG) is the primary mechanism for segmenting a subnet in Microsoft Azure. NSGs are commonly implemented. Unfortunately, people assume quite a bit about NSGs, and I want to tackle that by explaining why you need to be aware of the default rules in Network Security Groups.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Assumption<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Let&#8217;s say I have an extremely simple workload consisting of:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A virtual machine acting as a web server.<\/li>\n\n\n\n<li>A virtual machine acting as a database server.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Yes, this could be VNet-connected PaaS services and have the same issues, but I want the example to be as clear as possible.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"> I want to lock down and protect that subnet so I will create an NSG and associate it with the subnet. Traffic from the outside world is blocked, right? Now, I will create an inbound rule to allow HTTPS\/TCP 443 from client external addresses to the web server.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>Name<\/td><td>Source<\/td><td>Protocol<\/td><td>Port<\/td><td>Destination<\/td><td>Action<\/td><\/tr><tr><td>AllowWeb<\/td><td>&lt;clients><\/td><td>TCP<\/td><td>443<\/td><td>Web VM<\/td><td>Allow<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The logic I expect is:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Allow web traffic from the clients to the web server.<\/li>\n\n\n\n<li>Allow SQL traffic from the web server to the database server in the same subnet.<\/li>\n\n\n\n<li>Everything else is blocked.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">I check the Inbound Rules in the NSG and I can see my custom rules and the built-in default rules. This confirms my logic, right?<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-7.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"157\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-7-1024x157.png\" alt=\"\" class=\"wp-image-24061\" srcset=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-7-1024x157.png 1024w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-7-300x46.png 300w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-7-768x118.png 768w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-7-1200x184.png 1200w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-7.png 1237w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">All is well, until one day, every computer in the office has a ransomware demand screen and both of my Azure VMs are offline. Now my boss is screaming at me because the business&#8217;s online application is not selling our products to customers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Where It All Went Wrong<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Take a look at the default rules in the above screenshot. Rule 65500 denies all traffic. That&#8217;s what we want; block all traffic where a higher priority rule doesn&#8217;t allow it. That&#8217;s the rule that we were banking on to protect our Azure workload.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But take a look at rule 65000. That rule allows all traffic from VirtualNetwork to VirtualNetwork. We have assumed that VirtualNetwork means <em>the virtual network<\/em> that the NSG of the subnet that it is associated with &#8211; in other words, the virtual network that we are working on.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You are in for a bigger surprise than a teddy bear picnic in your woods if you <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/virtual-network\/service-tags-overview#available-service-tags\" target=\"_blank\" rel=\"noopener\" title=\"\">research the definition of VirtualNetwork<\/a>:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">The virtual network address space (all IP address ranges defined for the virtual network), all connected on-premises address spaces,\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/virtual-network\/virtual-network-peering-overview\">peered<\/a>\u00a0virtual networks, virtual networks connected to a\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/vpn-gateway\/vpn-gateway-about-vpngateways?toc=\/azure\/virtual-network?toc.json\">virtual network gateway<\/a>, the\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/virtual-network\/network-security-groups-overview#azure-platform-considerations\">virtual IP address of the host<\/a>, and address prefixes used on\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/virtual-network\/virtual-networks-udr-overview\">user-defined routes<\/a>. This tag might also contain default routes.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">In summary, this means that VirtualNetwork contains:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The prefixes in your virtual network<\/li>\n\n\n\n<li>Any peered virtual networks<\/li>\n\n\n\n<li>Any remote networks connected by site-to-site networking<\/li>\n\n\n\n<li>Any networks where you have referenced in a user-defined route in your subnets.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Or, pretty much every network you can route to\/from. And that&#8217;s how the ransomware got from someone&#8217;s on-premises PC into the virtual network. The on-premises networks were connected with the Azure virtual network by VPN. The built-in 65000 rule allowed all traffic from on-premises. There was nothing to block the ransomware from spreading to the Azure VMs from the on-premises network.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Solving This Problem<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There are a few ways to solve this issue. I&#8217;ll show you a couple. I am a believer in true micro-segmentation to create trust-noone networks. The goal here is that no traffic is allowed anywhere on any Azure network without a specific rule to permit flows that are required by the business\/technology.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The logic of the below is that all traffic will be denied by default, including traffic inside the subnet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Remember, all <a href=\"https:\/\/aidanfinn.com\/?p=24021\" target=\"_blank\" rel=\"noopener\" title=\"\">NSG rules are processed at the NIC<\/a>, no matter how the NSG is associated.<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-5.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"225\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-5-1024x225.png\" alt=\"\" class=\"wp-image-24055\" srcset=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-5-1024x225.png 1024w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-5-300x66.png 300w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-5-768x168.png 768w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-5-1200x263.png 1200w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-5.png 1231w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">I have added a low-priority (4000) rule to deny everything that is not allowed in the higher-priority rules. That will affect all traffic from any source, including sources in the same virtual network or subnet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By the way, the above is the sort of protection that many national cyber security agencies are telling people to implement to stop modern threats &#8211; not just the threats of 2003.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I know that some of you will prefer to treat the NSG as an edge defence, allowing all traffic inside the virtual network. You can do that too. Here&#8217;s an example of that:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-6.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"226\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-6-1024x226.png\" alt=\"\" class=\"wp-image-24059\" srcset=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-6-1024x226.png 1024w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-6-300x66.png 300w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-6-768x170.png 768w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-6-1200x265.png 1200w, https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/image-6.png 1236w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">My rule at 3900 allows all traffic inside the address prefix of the virtual network. The following rule, 4000, denies everything, which means that anything from outside the network (not including the traffic in rule 100) will be blocked.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Lesson<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Don&#8217;t assume anything. You now know that VirtualNetwork means everything that can route to your virtual network. For example the Internet service tag includes The Internet and Microsoft Azure!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Network Security Group (NSG) is the primary mechanism for segmenting a subnet in Microsoft Azure. NSGs are commonly implemented. Unfortunately, people assume quite a bit about NSGs, and I want to tackle that by explaining why you need to be aware of the default rules in Network Security Groups. The Assumption Let&#8217;s say I &hellip; <a href=\"https:\/\/aidanfinn.com\/?p=24042\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Beware Of The Default Rules In Network Security Groups&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":24064,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_wpcom_ai_launchpad_first_post":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-24042","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"Many are unaware that the VirtualNetwork service tag allows more traffic than expected. I will explain how &amp; show you how to lock down network security groups.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"AFinn\"\/>\n\t<meta name=\"google-site-verification\" content=\"TDKjbi2McB2eLIfL6KwPB3aQqv5E-mbcb2QYIcovGaI\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/aidanfinn.com\/?p=24042\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_GB\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Aidan Finn, IT Pro - A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Beware Of The Default Rules In Network Security Groups | Aidan Finn, IT Pro\" \/>\n\t\t<meta property=\"og:description\" content=\"Many are unaware that the VirtualNetwork service tag allows more traffic than expected. I will explain how &amp; show you how to lock down network security groups.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/aidanfinn.com\/?p=24042\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-02-20T12:03:31+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-02-20T12:03:33+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@joe_elway\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Beware Of The Default Rules In Network Security Groups | Aidan Finn, IT Pro\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Many are unaware that the VirtualNetwork service tag allows more traffic than expected. I will explain how &amp; show you how to lock down network security groups.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@joe_elway\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24042#article\",\"name\":\"Beware Of The Default Rules In Network Security Groups | Aidan Finn, IT Pro\",\"headline\":\"Beware Of The Default Rules In Network Security Groups\",\"author\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#person\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/BurglarRobbingCastleNsg.jpg\",\"width\":1024,\"height\":1024,\"caption\":\"A burglar robbing a castle. NSG.\"},\"datePublished\":\"2025-02-20T12:03:31+00:00\",\"dateModified\":\"2025-02-20T12:03:33+00:00\",\"inLanguage\":\"en-GB\",\"commentCount\":1,\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24042#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24042#webpage\"},\"articleSection\":\"Uncategorized\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24042#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/aidanfinn.com\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=1#listItem\",\"name\":\"Uncategorized\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=1#listItem\",\"position\":2,\"name\":\"Uncategorized\",\"item\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=1\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24042#listItem\",\"name\":\"Beware Of The Default Rules In Network Security Groups\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24042#listItem\",\"position\":3,\"name\":\"Beware Of The Default Rules In Network Security Groups\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=1#listItem\",\"name\":\"Uncategorized\"}}]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#person\",\"name\":\"AFinn\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24042#personImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"AFinn\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1\",\"name\":\"AFinn\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24042#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"AFinn\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24042#webpage\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24042\",\"name\":\"Beware Of The Default Rules In Network Security Groups | Aidan Finn, IT Pro\",\"description\":\"Many are unaware that the VirtualNetwork service tag allows more traffic than expected. I will explain how & show you how to lock down network security groups.\",\"inLanguage\":\"en-GB\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24042#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/BurglarRobbingCastleNsg.jpg\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24042\\\/#mainImage\",\"width\":1024,\"height\":1024,\"caption\":\"A burglar robbing a castle. NSG.\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=24042#mainImage\"},\"datePublished\":\"2025-02-20T12:03:31+00:00\",\"dateModified\":\"2025-02-20T12:03:33+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#website\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/\",\"name\":\"Aidan Finn, IT Pro\",\"description\":\"A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...\",\"inLanguage\":\"en-GB\",\"publisher\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#person\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Beware Of The Default Rules In Network Security Groups | Aidan Finn, IT Pro","description":"Many are unaware that the VirtualNetwork service tag allows more traffic than expected. I will explain how & show you how to lock down network security groups.","canonical_url":"https:\/\/aidanfinn.com\/?p=24042","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"TDKjbi2McB2eLIfL6KwPB3aQqv5E-mbcb2QYIcovGaI","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/aidanfinn.com\/?p=24042#article","name":"Beware Of The Default Rules In Network Security Groups | Aidan Finn, IT Pro","headline":"Beware Of The Default Rules In Network Security Groups","author":{"@id":"https:\/\/aidanfinn.com\/?author=1#author"},"publisher":{"@id":"https:\/\/aidanfinn.com\/#person"},"image":{"@type":"ImageObject","url":"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/BurglarRobbingCastleNsg.jpg","width":1024,"height":1024,"caption":"A burglar robbing a castle. NSG."},"datePublished":"2025-02-20T12:03:31+00:00","dateModified":"2025-02-20T12:03:33+00:00","inLanguage":"en-GB","commentCount":1,"mainEntityOfPage":{"@id":"https:\/\/aidanfinn.com\/?p=24042#webpage"},"isPartOf":{"@id":"https:\/\/aidanfinn.com\/?p=24042#webpage"},"articleSection":"Uncategorized"},{"@type":"BreadcrumbList","@id":"https:\/\/aidanfinn.com\/?p=24042#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/#listItem","position":1,"name":"Home","item":"https:\/\/aidanfinn.com\/","nextItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?cat=1#listItem","name":"Uncategorized"}},{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?cat=1#listItem","position":2,"name":"Uncategorized","item":"https:\/\/aidanfinn.com\/?cat=1","nextItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?p=24042#listItem","name":"Beware Of The Default Rules In Network Security Groups"},"previousItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?p=24042#listItem","position":3,"name":"Beware Of The Default Rules In Network Security Groups","previousItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?cat=1#listItem","name":"Uncategorized"}}]},{"@type":"Person","@id":"https:\/\/aidanfinn.com\/#person","name":"AFinn","image":{"@type":"ImageObject","@id":"https:\/\/aidanfinn.com\/?p=24042#personImage","url":"https:\/\/secure.gravatar.com\/avatar\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g","width":96,"height":96,"caption":"AFinn"}},{"@type":"Person","@id":"https:\/\/aidanfinn.com\/?author=1#author","url":"https:\/\/aidanfinn.com\/?author=1","name":"AFinn","image":{"@type":"ImageObject","@id":"https:\/\/aidanfinn.com\/?p=24042#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g","width":96,"height":96,"caption":"AFinn"}},{"@type":"WebPage","@id":"https:\/\/aidanfinn.com\/?p=24042#webpage","url":"https:\/\/aidanfinn.com\/?p=24042","name":"Beware Of The Default Rules In Network Security Groups | Aidan Finn, IT Pro","description":"Many are unaware that the VirtualNetwork service tag allows more traffic than expected. I will explain how & show you how to lock down network security groups.","inLanguage":"en-GB","isPartOf":{"@id":"https:\/\/aidanfinn.com\/#website"},"breadcrumb":{"@id":"https:\/\/aidanfinn.com\/?p=24042#breadcrumblist"},"author":{"@id":"https:\/\/aidanfinn.com\/?author=1#author"},"creator":{"@id":"https:\/\/aidanfinn.com\/?author=1#author"},"image":{"@type":"ImageObject","url":"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/BurglarRobbingCastleNsg.jpg","@id":"https:\/\/aidanfinn.com\/?p=24042\/#mainImage","width":1024,"height":1024,"caption":"A burglar robbing a castle. NSG."},"primaryImageOfPage":{"@id":"https:\/\/aidanfinn.com\/?p=24042#mainImage"},"datePublished":"2025-02-20T12:03:31+00:00","dateModified":"2025-02-20T12:03:33+00:00"},{"@type":"WebSite","@id":"https:\/\/aidanfinn.com\/#website","url":"https:\/\/aidanfinn.com\/","name":"Aidan Finn, IT Pro","description":"A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...","inLanguage":"en-GB","publisher":{"@id":"https:\/\/aidanfinn.com\/#person"}}]},"og:locale":"en_GB","og:site_name":"Aidan Finn, IT Pro - A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...","og:type":"article","og:title":"Beware Of The Default Rules In Network Security Groups | Aidan Finn, IT Pro","og:description":"Many are unaware that the VirtualNetwork service tag allows more traffic than expected. I will explain how &amp; show you how to lock down network security groups.","og:url":"https:\/\/aidanfinn.com\/?p=24042","article:published_time":"2025-02-20T12:03:31+00:00","article:modified_time":"2025-02-20T12:03:33+00:00","twitter:card":"summary","twitter:site":"@joe_elway","twitter:title":"Beware Of The Default Rules In Network Security Groups | Aidan Finn, IT Pro","twitter:description":"Many are unaware that the VirtualNetwork service tag allows more traffic than expected. I will explain how &amp; show you how to lock down network security groups.","twitter:creator":"@joe_elway"},"aioseo_meta_data":{"post_id":"24042","title":null,"description":"Many are unaware that the VirtualNetwork service tag allows more traffic than expected. I will explain how &amp; show you how to lock down network security groups.","keywords":null,"keyphrases":{"focus":{"keyphrase":"VirtualNetwork","score":59,"analysis":{"keyphraseInTitle":{"score":3,"maxScore":9,"error":1},"keyphraseInDescription":{"score":9,"maxScore":9,"error":0},"keyphraseLength":{"score":9,"maxScore":9,"error":0,"length":1},"keyphraseInURL":{"score":1,"maxScore":5,"error":1},"keyphraseInIntroduction":{"score":3,"maxScore":9,"error":1},"keyphraseInSubHeadings":{"score":3,"maxScore":9,"error":1},"keyphraseInImageAlt":{"score":3,"maxScore":9,"error":1},"keywordDensity":{"type":"best","score":9,"maxScore":9,"error":0}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2025-02-20 10:59:29","updated":"2025-06-04 17:39:54","seo_analyzer_scan_date":null,"focus_keyword":"VirtualNetwork","additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/aidanfinn.com\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/aidanfinn.com\/?cat=1\" title=\"Uncategorized\">Uncategorized<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tBeware Of The Default Rules In Network Security Groups\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/aidanfinn.com\/"},{"label":"Uncategorized","link":"https:\/\/aidanfinn.com\/?cat=1"},{"label":"Beware Of The Default Rules In Network Security Groups","link":"https:\/\/aidanfinn.com\/?p=24042"}],"amp_enabled":true,"jetpack_featured_media_url":"https:\/\/aidanfinn.com\/wp-content\/uploads\/2025\/02\/BurglarRobbingCastleNsg.jpg","_links":{"self":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/24042","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=24042"}],"version-history":[{"count":17,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/24042\/revisions"}],"predecessor-version":[{"id":24063,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/24042\/revisions\/24063"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/media\/24064"}],"wp:attachment":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24042"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24042"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24042"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}