Azure Firewall DNAT rules - SNAT

Hi @ Peter Stieber,

Thank you for reaching out on Microsoft Q&A forum.

Regarding to 1st query : How does the firewall decide whether to change the source IP to its public or private IP address while applying SNAT with a DNAT rule matched?

Azure Firewall decides which IP to use for SNAT based on where the DNAT rule is sending the traffic. If the DNAT rule points to a public IP (like the public load balancer’s frontend IP in the workaround diagram), the firewall uses its own public IP as the source. 

If it points to a private IP (like a VM or an internal load balancer), it uses one of its private IPs from the AzureFirewallSubnet. This way, traffic flows symmetrically and is handled correctly in both directions.

For the 2nd query: If the load balancer was internal, would it change the source IP to its private IP address? Is it based on the IP address I am translating it to? If translated IP is public, does the FW change source to its public, and if it is private, does it change source to its private IP address (address from firewall subnet)?

Yes, the internal load balancer uses a private frontend IP & the firewall will use one of its own private IPs from the AzureFirewallSubnet for SNAT, as long as the DNAT rule is applied sending traffic to that private IP. 

In addition to the translated IP in the DNAT rule: If it’s public (like a public load balancer’s frontend IP), the firewall uses its public IP as the SNAT source. 

If it’s private (like an internal load balancer or VM’s private IP), it uses a private IP from its subnet. This approach keeps the traffic flowing in the right direction and avoids routing issues.

Hope the above answer helps! Please let us know if you have any further queries.Please do not forget to “up-vote” wherever the information provided helps you, this can be beneficial to community members.

Hi Peter,

If you find above comment as helpful, please “up-vote” for the information provided , this can be beneficial to community members.

Please let us know if you have any further queries.

Thanks