Azure Firewall NSG違いを構築で理解する｜Terraformで両方セットアップ

この記事のポイント

・NSGはL4（IP/ポート制御）、Azure FirewallはL7（FQDN/URLフィルタ）で役割が異なる
・TerraformではNSGはazurerm_network_security_group、Firewallはazurerm_firewallで定義
・本番環境は「NSGで東西トラフィック」「Azure Firewallで南北（インターネット）」が基本構成
・Azure FirewallはAzureFirewallSubnet（/26以上）が必須。デプロイに20～30分かかる

# main.tf
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.110"
    }
  }
}

provider "azurerm" {
  features {}
}

variable "location" {
  default = "japaneast"
}

variable "rg_name" {
  default = "rg-fw-nsg-demo"
}

# network.tf
resource "azurerm_resource_group" "main" {
  name     = var.rg_name
  location = var.location
}

resource "azurerm_virtual_network" "main" {
  name                = "vnet-demo"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
}

# Azure Firewallには必ずこのサブネット名が必要（/26以上）
resource "azurerm_subnet" "firewall" {
  name                 = "AzureFirewallSubnet"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = ["10.0.1.0/26"]
}

# テスト用VMを配置するサブネット
resource "azurerm_subnet" "app" {
  name                 = "AppSubnet"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = ["10.0.2.0/24"]
}

# nsg.tf
resource "azurerm_network_security_group" "app" {
  name                = "nsg-app"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name

  # SSH許可（内部ネットワークからのみ）
  security_rule {
    name                       = "Allow-SSH"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "22"
    source_address_prefix      = "10.0.0.0/8"
    destination_address_prefix = "*"
  }

  # HTTP許可（動作確認用）
  security_rule {
    name                       = "Allow-HTTP"
    priority                   = 110
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "80"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }

  # その他のインバウンドを全拒否
  security_rule {
    name                       = "Deny-All-Inbound"
    priority                   = 4096
    direction                  = "Inbound"
    access                     = "Deny"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }
}

resource "azurerm_subnet_network_security_group_association" "app" {
  subnet_id                 = azurerm_subnet.app.id
  network_security_group_id = azurerm_network_security_group.app.id
}

# firewall.tf
resource "azurerm_public_ip" "firewall" {
  name                = "pip-afw-demo"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  allocation_method   = "Static"
  sku                 = "Standard"
}

# Firewall Policy（ルールの入れ物）
resource "azurerm_firewall_policy" "main" {
  name                = "fwpolicy-demo"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  sku                 = "Standard"
}

# ルールコレクショングループ（L7アプリケーションルール + L4ネットワークルール）
resource "azurerm_firewall_policy_rule_collection_group" "main" {
  name               = "DefaultRCG"
  firewall_policy_id = azurerm_firewall_policy.main.id
  priority           = 100

  # アプリケーションルール: FQDNでHTTPS通信を制御
  application_rule_collection {
    name     = "AllowOutbound-App"
    priority = 100
    action   = "Allow"

    rule {
      name = "Allow-Ubuntu-Updates"
      protocols {
        type = "Https"
        port = 443
      }
      source_addresses  = ["10.0.2.0/24"]
      destination_fqdns = [
        "*.ubuntu.com",
        "security.ubuntu.com",
        "archive.ubuntu.com"
      ]
    }
  }

  # ネットワークルール: DNS（UDP/53）を許可
  network_rule_collection {
    name     = "AllowDNS"
    priority = 200
    action   = "Allow"

    rule {
      name                  = "Allow-DNS"
      protocols             = ["UDP"]
      source_addresses      = ["10.0.2.0/24"]
      destination_addresses = ["168.63.129.16"]
      destination_ports     = ["53"]
    }
  }
}

# Azure Firewall本体
resource "azurerm_firewall" "main" {
  name                = "afw-demo"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  sku_name            = "AZFW_VNet"
  sku_tier            = "Standard"
  firewall_policy_id  = azurerm_firewall_policy.main.id

  ip_configuration {
    name                 = "fw-ipconfig"
    subnet_id            = azurerm_subnet.firewall.id
    public_ip_address_id = azurerm_public_ip.firewall.id
  }
}

# route.tf
resource "azurerm_route_table" "app" {
  name                = "rt-app"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name

  route {
    name                   = "ForceToFirewall"
    address_prefix         = "0.0.0.0/0"
    next_hop_type          = "VirtualAppliance"
    next_hop_in_ip_address = azurerm_firewall.main.ip_configuration[0].private_ip_address
  }
}

resource "azurerm_subnet_route_table_association" "app" {
  subnet_id      = azurerm_subnet.app.id
  route_table_id = azurerm_route_table.app.id
}

$ terraform init
$ terraform plan -out=tfplan
$ terraform apply tfplan

azurerm_resource_group.main: Creating...
azurerm_resource_group.main: Creation complete after 2s
  [id=/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg-fw-nsg-demo]

azurerm_virtual_network.main: Creating...
azurerm_virtual_network.main: Creation complete after 7s
  [id=.../virtualNetworks/vnet-demo]

azurerm_subnet.firewall: Creating...
azurerm_subnet.app: Creating...
azurerm_subnet.firewall: Creation complete after 4s [id=.../subnets/AzureFirewallSubnet]
azurerm_subnet.app: Creation complete after 5s [id=.../subnets/AppSubnet]

azurerm_network_security_group.app: Creating...
azurerm_public_ip.firewall: Creating...
azurerm_network_security_group.app: Creation complete after 3s [id=.../networkSecurityGroups/nsg-app]
azurerm_public_ip.firewall: Creation complete after 4s [id=.../publicIPAddresses/pip-afw-demo]

azurerm_firewall_policy.main: Creating...
azurerm_firewall_policy.main: Creation complete after 6s

azurerm_firewall.main: Creating...
azurerm_firewall.main: Still creating... [1m0s elapsed]
azurerm_firewall.main: Still creating... [5m0s elapsed]
azurerm_firewall.main: Still creating... [10m0s elapsed]
azurerm_firewall.main: Still creating... [20m0s elapsed]
azurerm_firewall.main: Creation complete after 22m14s [id=.../azureFirewalls/afw-demo]

Apply complete! Resources: 12 added, 0 changed, 0 destroyed.

# Allow-HTTPルールをDenyに変更してNSGだけでブロックを確認
$ az network nsg rule update   --resource-group rg-fw-nsg-demo   --nsg-name nsg-app   --name Allow-HTTP   --access Deny

# ルール確認
$ az network nsg rule list   --resource-group rg-fw-nsg-demo   --nsg-name nsg-app   --output table

Name              Priority  Direction  Access  Protocol  DestinationPortRanges
----------------  --------  ---------  ------  --------  ---------------------
Allow-SSH         100       Inbound    Allow   Tcp       22
Allow-HTTP        110       Inbound    Deny    Tcp       80
Deny-All-Inbound  4096      Inbound    Deny    *         *

# AppSubnet上のVMにSSH後に実行
# FirewallのアプリケーションルールでFQDN許可済みのURL
$ curl -s -o /dev/null -w "%{http_code}" https://security.ubuntu.com
200

# FirewallのルールにないFQDNはブロック
$ curl -s -o /dev/null -w "%{http_code}" https://example-blocked.com
000
# 000 = 接続そのものが確立されない（Azure FirewallのDiagnosticsログにブロック記録あり）

Error: creating Firewall "afw-demo":
  The subnet AzureFirewallSubnet requires a minimum size of /26.

Error: deleting Public IP "pip-afw-demo":
  PublicIPAddressCannotBeDeleted
  Public IP address pip-afw-demo is referenced by Azure Firewall afw-demo.