Azure Firewall - SNAT IP Ranges

Hi, “SNAT private ranges” is just the list of destinations the firewall must treat as private → for those prefixes SNAT is skipped and the original source IP is preserved. The name is historical: by default the list contains the IANA private ranges (10/8, 172.16/12, 192.168/16, plus 100.64/10). The engine doesn’t enforce “private-only”: you can add any CIDR, including public ones (as you did with 20.30.0.0/24). That tells Azure Firewall “don’t SNAT when going to these addresses.”

Use with care: skipping SNAT only works when the destination has a return route to your original source IPs (e.g., on-prem via VPN/ExpressRoute, partner prefixes reachable over a private circuit, other VNets/DMZ NVAs). If you exclude general Internet prefixes, most sites won’t be able to route replies to your private sources and flows will fail or look asymmetric.

So: the field is called “privateRanges” because it defines addresses to treat as private (no SNAT). It’s valid to put public CIDRs there, but do it only when those “public” ranges are actually privately reachable and can route back without NAT.