配置NSG限制VM访问Internet

Posted 2020-06-18

配置NSG限制VM访问Internet

什么是网络安全组 (NSG)？

http://www.windowsazure.cn/documentation/articles/virtual-networks-nsg

新建一个安全组

New-AzureNetworkSecurityGroup-Name"DMZNSG"-Location"China East"

定义变量

$NSGGroup=Get-AzureNetworkSecurityGroup-NameDMZNSG

配置针对10.0.1.6这台虚拟机Outbound,拒绝访问Internet

$NSGGroup|Set-AzureNetworkSecurityRule-Nameblock-internet-ActionDeny-Protocol *-TypeOutbound-Priority200-SourceAddressPrefix‘10.0.1.6/32‘-SourcePortRange*-DestinationAddressPrefixInternet-DestinationPortRange*

配置针对10.0.1.6这台虚拟机Inbound规则,允许Inbound

$NSGGroup|Set-AzureNetworkSecurityRule-NameAllow-inbound-ActionAllow-Protocol*-TypeInbound-Priority200-SourceAddressPrefix*-SourcePortRange*-DestinationAddressPrefix‘10.0.1.6/32‘-DestinationPortRange*

$NSGGroup|Set-AzureNetworkSecurityGroupToSubnet-VirtualNetworkNamewrf-SubnetNameSubnet-1

测试：

通过远程桌面连接Azure VM，发现虚拟机无法访问外网。

外网可以访问

取消分配Remove-AzureNetworkSecurityGroupAssociation -VirtualNetworkName wrf -SubnetName Subnet-1

然后删除Remove-AzureNetworkSecurityGroup