The Stack Underflow

Azure Networking, Packet by Packet: NSGs, Route Tables, ASGs and Azure Firewall

Azure networking one packet at a time: NSGs, route tables and NVAs, subnet vs NIC NSGs, application security groups, Azure Firewall rule processing, and hybrid connectivity with VPN and ExpressRoute, traced rule by rule and route by route, and checked against Microsoft Learn.

7 tutorials · start at part 1 or jump anywhere

Start the series → All series
  1. 0 Azure CIDR & Subnets: Why You Can Use Only 251 of 256 IPs in a /24 Azure networking from the ground up: CIDR, the five addresses Azure reserves in every subnet, system routes, longest prefix match and DNS, traced with three packets. Oct 5, 2026
  2. 1 How Azure NSGs Allow or Deny a Packet: 6 Real Packets, Rule by Rule How an Azure network security group reads its rules: priority order, first full match, the default rules you can't delete, and six packets traced to a verdict. Sep 30, 2026
  3. 2 Azure Route Tables and NVAs: Why the Reply Took a Different Path How Azure picks a route (longest prefix, then user over system), what an NVA needs to forward traffic, and why one connection can take two paths. Sep 30, 2026
  4. 3 Azure Subnet NSG vs NIC NSG: Why the Packet Still Got Denied Two NSGs on one path: inbound meets the subnet NSG first, outbound the NIC's. Both must allow. Plus application security groups and switching off AllowVNetInBound. Sep 30, 2026
  5. 4 How Azure Firewall Decides: 5 Packets Through a Hub and Spoke, Rule by Rule How spoke traffic reaches Azure Firewall, and how the firewall decides: DNAT, then network, then application rules, IP groups, SNI matching and default deny. Sep 30, 2026
  6. 5 The Local Network Gateway Isn't a Gateway: Azure Hybrid Networking Terms Azure hybrid networking words in one map: GatewaySubnet, VPN gateway, local network gateway, IPsec and IKE, peering location, MSEE, circuit, MPLS and BGP. Oct 6, 2026
  7. 6 Why Your Azure VM Can't Reach On-Premises: VPN vs ExpressRoute, Packet by Packet One packet from an Azure VM to the office, four times: no gateway, a site-to-site VPN, ExpressRoute next to it, and ExpressRoute unavailable. Routes, encryption, redundancy and prices. Oct 6, 2026