1

I created a Standard tier Front Door with the necessary Azure WAF with default configurations. If I do this:

Test-NetConnection -ComputerName "<frontdoorurl>-dev-xxxxxx.z01.azurefd.net" -Port 80

ComputerName     : <frontdoorurl>-dev-xxxxxx.z01.azurefd.net
RemoteAddress    : xxxx:xxx:xx:x::xx
RemotePort       : 80
InterfaceAlias   : Ethernet 7
SourceAddress    : xxxx:xxxx:xx:xxx:xxxx:xxxx:xxx:xxxx
TcpTestSucceeded : True

I am unable to block this permanently - I tried having a rule set on the Server port equal to 80 conditions but there is no suitable action for this that blocks the port 80 access throughout.

How to block this permanently so that the result of Test-NetConnection is False? or is there no way to block the access to port 80 from outside?

P.S. I have tried asking ChatGPT - it tells me to use Network Security Group and block port 80. But in the latest Azure Portal setting for Front Door - no such provision is made.

neuro
  • 14,948
  • 3
  • 36
  • 59
ArnabSaha
  • 23
  • 8
  • Why don’t you just disable HTTP on all your routes, i.e. only accept HTTPS? No need to block HTTP then – silent Dec 11 '22 at 20:54
  • @silent - Thanks for the suggestion, I had already done that. All backend app services are HTTPS only. I wanted to stop it at front-door level only – ArnabSaha Dec 12 '22 at 16:13
  • I’m still not clear on what you want to achieve. AFF will not route any incoming traffic on port 80, so why do you need any additional blocking? – silent Dec 12 '22 at 21:15

2 Answers2

0

Azure Front Door will allow https requests by default, but you can restrict the http request for each end point using Routing Rules.
NOTE: With the front door URL, Test-NetConnection will not return a false result because FD will try to fetch the service responses frequently and, if they are not reachable, will send a message such as "Services are down."

Here is the way to restrict port 80 from Front Door.

Step1: Create front door application with 2 backend pools and Configure routing rule as follows.

enter image description here

Step2: update route rule with https & https request allows both allow enter image description here

Verificaiton: when browse the URL it will allow both http and https calls enter image description here enter image description here

Step3: Now, in order to restrict the http [80] port in the backend, update the routing rule to https only.

enter image description here

Step4: Save the Front Door settings

enter image description here

Step5: now https [443] port only allow to access the application and 80 port it won't allow via front door URL.

enter image description here

Note: We need to restrict port 80 from both the application endpoint side and the server side. Otherwise, when we ping from Test-NetConnection, it will return a true value. Because Front Door will give the response that the site is not reachable Backend Pool like this enter image description here becuase of this configure enter image description here enter image description here

Swarna Anipindi
  • 792
  • 2
  • 9
  • Thanks for answering this. The latest Azure portal does not have Front Door designer anymore. But we have a Front door manager which constituents similar blades and settings as you mentioned in the answer, I have done exactly as you mentioned. 1. `Test-NetConnection` is still `True` for port 80. 2. `400 Bad request` is coming for both HTTP and HTTPS GET calls on FD URL. - So overall the port 80 is not getting blocked as such – ArnabSaha Dec 12 '22 at 17:25
0

Azure Front Door consists of a a distributed network of POPs (Points-of-Presence) and these are listening for both port 80 and 443 on an Anycast IP, meaning you'll just get routed to whatever POP is closest to you. Your AFD endpoint will resolve to one of these Anycast IP's. You cannot block port 80 because these POPs handle more than just your site. There are numerous other customers that have sites hosted on these POPs and some are accepting HTTP, so port 80 is open. It's also needed for HTTP to HTTPS redirection. With respect to a TCP connection, the domain name is irrelevant as we aren't at the HTTP layer yet.

You can always redirect traffic from HTTP to HTTPS but these POPs are not in your control, unlike something like Application Gateway. With App Gateway, you can listen for whatever ports you want because it's not shared with other customers.

DusDee
  • 136
  • 1
  • 5