Azure Load Balancer + NSG Rules - Remove Access Directly

Question

I've got a networking question for one of my customers servers in the cloud.

We are using just a standard 2012R2 VM with a few endpoints set up through the NSG Firewall, and we have a LoadBalancer infront of the network with a few ports forwarded to the same VPC.

The reason we are using a load balancer with port forwarding is because I'm finding countless records of bots trying to hit 3389 and 21 with attempts to break in.

So I have tried to change the source setting in the NSG rule to AzureLoadBalancer with the hope that it will only allow access to traffic that has come via the LoadBalancer on the external ports.

But for some reason this is not the case? Is there a proper procedure for restricting traffic to a VM via the NSG from a LoadBalancer?

Any help with this is greatly appreciated.

Thanks

Answer 1

The NSG can’t be associated with Load balancer, NSGs can be associated with either subnets or individual VM instances within that subnet, so we can’t use NSG to block inbound IP address from the internet.
To protect the VM (with a public IP), we can deploy Linux VM, use IP tables work as a firewall. Also you can search some third party firewall product in Azure Marketplace.

Update:
To protect your VM, you can use NSG to allow the source IP address range to access your VM. NSG->Add inbound security rule->advanced->source IP address range.