NSG rule tester
Paste the rules from a network security group, describe some traffic, and see whether Azure would allow it and exactly which rule decides. It also finds rules that can never take effect because a rule above them always matches first, and rules that open management ports to the internet.
Runs entirely in your browser. Nothing you paste is sent anywhere.
Traffic to test
Get your rules
Either command works. The tool reads the custom rules and, if they're included, the default rules. If they aren't, it adds Azure's standard default rules for you.
az network nsg show --resource-group rg-contoso-prod --name nsg-snet-contoso-app
az network nsg rule list --resource-group rg-contoso-prod --nsg-name nsg-snet-contoso-app --include-defaultHow Azure decides
- Rules are processed in priority order, lowest number first, from 100 to 4096. As soon as traffic matches a rule, processing stops.
- Inbound traffic goes through the subnet's NSG first, then the network interface's. Outbound traffic goes through the network interface's NSG first, then the subnet's. Traffic is only allowed if every NSG on its path allows it.
- Every NSG ends with default rules at priorities 65000 to 65500: allow traffic within the virtual network, allow the Azure load balancer in, allow outbound internet, and deny everything else.
Service tags other than VirtualNetwork, Internet and AzureLoadBalancer, and application security groups, can't be resolved here. Rules that use them are shown as "can't check" and skipped when testing, unless you type the same tag as the source or destination.