0

I have created a vnet on azure. The vnet contains VM, bastion host, and pfsense firewall. I'm connecting to VM using bastion host, and all the traffic is getting filtered using pfsense.

After connecting to VM, when I see the state table of pfsense, I notice that the vm has sent requests to public IPs of Microsoft. The details of the IPs are as follows

IP Address Port
168.63.129.16 32526
168.63.129.16 80
104.211.104.96 443
52.239.202.196 443
52.239.202.68 443
64.4.48.5 53

Can anyone please help me to understand what are these IPs and why VM is sending a request to these IPs

Yash
  • 57
  • 1
  • 10
  • hello @yash, the first two are used for azure extensions and features as mentioned in this [MS document](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/features-windows#network-access) – Ansuman Bal Oct 28 '21 at 05:10

1 Answers1

1

As I have mentioned in the comments , the First two IP address (168.63.129.16:35526,168.63.129.16:80) are used by Azure Extensions and Features which is also mentioned in the Microsoft Document .

As for the next 3 IP's (104.211.104.96:443,52.239.202.196:443,52.239.202.68:443) are used by Azure Storage Service in Central India region which can be found in the Microsoft Public IP's for Different Service File (mentioned as 52.239.202.0/24,104.211.104.96/28). You can Download it from here.

And For the last IP (64.4.48.5:53) , It not present in the list but as per the port 53, it is being used by DNS . So, my guess will be it is being used by public DNS of the Bastion Host.

Ansuman Bal
  • 9,705
  • 2
  • 10
  • 27