Network Security Groups (NSGs)

A Network Security Group (NSG) is a stateful firewall that filters inbound and outbound traffic to Azure resources. NSGs are one of the most important tools for securing your Azure networks. They contain a list of security rules that allow or deny traffic based on source, destination, port, and protocol.

---

How NSGs Work

An NSG is a collection of rules evaluated in priority order (lowest number = highest priority). When traffic matches a rule, that rule's action is applied and no further rules are checked.

NSGs are stateful: if you allow an inbound request, the response is automatically allowed without needing a separate outbound rule.

NSGs can be associated with:

• Subnets — rules apply to all resources in the subnet.
• Network interfaces (NICs) — rules apply to a specific VM.
• Both — traffic must pass both the subnet NSG and the NIC NSG.

---

Default Rules

Every NSG includes three immutable default inbound rules and three default outbound rules:

Default Inbound Rules