Skip to content

Commit 1ddd8fb

Browse files
vhornevhorne
committed
add firewall
1 parent cefacf9 commit 1ddd8fb

File tree

3 files changed

+260
-0
lines changed

3 files changed

+260
-0
lines changed

‎quickstart/101-firewall-standard/main.tf‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
provider "azurerm" {
2+
version = "=1.36.0"
3+
}
4+
5+
resource "azurerm_resource_group" "rg" {
6+
name = "test-resources"
7+
location = var.resource_group_location
8+
}
9+
10+
resource "azurerm_virtual_network" "vnet" {
11+
name = "testvnet"
12+
address_space = ["10.0.0.0/16"]
13+
location = azurerm_resource_group.rg.location
14+
resource_group_name = azurerm_resource_group.rg.name
15+
}
16+
17+
resource "azurerm_subnet" "subnet" {
18+
name = "AzureFirewallSubnet"
19+
resource_group_name = azurerm_resource_group.rg.name
20+
virtual_network_name = azurerm_virtual_network.vnet.name
21+
address_prefixes = ["10.0.1.0/24"]
22+
}
23+
24+
resource "azurerm_public_ip" "pip" {
25+
name = "testpip"
26+
location = azurerm_resource_group.rg.location
27+
resource_group_name = azurerm_resource_group.rg.name
28+
allocation_method = "Static"
29+
sku = "Standard"
30+
}
31+
32+
resource "azurerm_firewall" "fw" {
33+
name = "testfirewall"
34+
location = azurerm_resource_group.rg.location
35+
resource_group_name = azurerm_resource_group.rg.name
36+
37+
ip_configuration {
38+
name = "configuration"
39+
subnet_id = azurerm_subnet.subnet.id
40+
public_ip_address_id = azurerm_public_ip.pip.id
41+
}
42+
}
43+
44+
resource "azurerm_firewall_application_rule_collection" "app-rc" {
45+
name = "apptestcollection"
46+
azure_firewall_name = azurerm_firewall.fw.name
47+
resource_group_name = azurerm_resource_group.rg.name
48+
priority = 100
49+
action = "Allow"
50+
51+
rule {
52+
name = "testrule"
53+
54+
source_addresses = [
55+
"10.0.0.0/16",
56+
]
57+
58+
target_fqdns = [
59+
"*.google.com",
60+
]
61+
62+
protocol {
63+
port = "443"
64+
type = "Https"
65+
}
66+
}
67+
}
68+
69+
resource "azurerm_firewall_network_rule_collection" "net-rc" {
70+
name = "apptestcollection"
71+
azure_firewall_name = azurerm_firewall.fw.name
72+
resource_group_name = azurerm_resource_group.rg.name
73+
priority = 100
74+
action = "Allow"
75+
76+
rule {
77+
name = "dnsrule"
78+
79+
source_addresses = [
80+
"10.0.0.0/16",
81+
]
82+
83+
destination_ports = [
84+
"53",
85+
]
86+
87+
destination_addresses = [
88+
"8.8.8.8",
89+
"8.8.4.4",
90+
]
91+
92+
protocols = [
93+
"TCP",
94+
"UDP",
95+
]
96+
}
97+
}

‎quickstart/101-firewall-standard/readme.md‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
# Azure Firewall Standard
2+
3+
This template deploys an [Azure Firewall](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/firewall) with classic application and network rules.
4+
5+
## Resources
6+
7+
| Terraform Resource Type | Description |
8+
| - | - |
9+
| `azurerm_resource_group` | The resource group all the deployed resources.|
10+
| `azurerm_virtual_network` | The virtual network for the firewall. |
11+
| `azurerm_subnet` |The firewall subnet.|
12+
| `azurerm_public_ip` | The firewall public IP address. |
13+
| `azurerm_firewall` | The standard Azure Firewall. |
14+
| `azurerm_firewall_application_rule_collection` | The application rule collection. |
15+
| `azurerm_firewall_network_rule_collection` | The network rule collection. |
16+
17+
## Variables
18+
19+
| Name | Description |
20+
|-|-|
21+
| `resource_group_location` | Resource group location |
22+
23+
## Example
24+
25+
```bash
26+
$ terraform plan -out main.tfplan
27+
28+
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
29+
+ create
30+
31+
Terraform will perform the following actions:
32+
33+
# azurerm_firewall.fw will be created
34+
+ resource "azurerm_firewall" "fw" {
35+
+ id = (known after apply)
36+
+ location = "eastus"
37+
+ name = "testfirewall"
38+
+ resource_group_name = "test-resources"
39+
+ sku_name = (known after apply)
40+
+ sku_tier = (known after apply)
41+
+ threat_intel_mode = "Alert"
42+
43+
+ ip_configuration {
44+
+ name = "configuration"
45+
+ private_ip_address = (known after apply)
46+
+ public_ip_address_id = (known after apply)
47+
+ subnet_id = (known after apply)
48+
}
49+
}
50+
51+
# azurerm_firewall_application_rule_collection.app-rc will be created
52+
+ resource "azurerm_firewall_application_rule_collection" "app-rc" {
53+
+ action = "Allow"
54+
+ azure_firewall_name = "testfirewall"
55+
+ id = (known after apply)
56+
+ name = "apptestcollection"
57+
+ priority = 100
58+
+ resource_group_name = "test-resources"
59+
60+
+ rule {
61+
+ name = "testrule"
62+
+ source_addresses = [
63+
+ "10.0.0.0/16",
64+
]
65+
+ target_fqdns = [
66+
+ "*.google.com",
67+
]
68+
69+
+ protocol {
70+
+ port = 443
71+
+ type = "Https"
72+
}
73+
}
74+
}
75+
76+
# azurerm_firewall_network_rule_collection.net-rc will be created
77+
+ resource "azurerm_firewall_network_rule_collection" "net-rc" {
78+
+ action = "Allow"
79+
+ azure_firewall_name = "testfirewall"
80+
+ id = (known after apply)
81+
+ name = "apptestcollection"
82+
+ priority = 100
83+
+ resource_group_name = "test-resources"
84+
85+
+ rule {
86+
+ destination_addresses = [
87+
+ "8.8.4.4",
88+
+ "8.8.8.8",
89+
]
90+
+ destination_fqdns = []
91+
+ destination_ip_groups = []
92+
+ destination_ports = [
93+
+ "53",
94+
]
95+
+ name = "dnsrule"
96+
+ protocols = [
97+
+ "TCP",
98+
+ "UDP",
99+
]
100+
+ source_addresses = [
101+
+ "10.0.0.0/16",
102+
]
103+
+ source_ip_groups = []
104+
}
105+
}
106+
107+
# azurerm_public_ip.pip will be created
108+
+ resource "azurerm_public_ip" "pip" {
109+
+ allocation_method = "Static"
110+
+ availability_zone = (known after apply)
111+
+ fqdn = (known after apply)
112+
+ id = (known after apply)
113+
+ idle_timeout_in_minutes = 4
114+
+ ip_address = (known after apply)
115+
+ ip_version = "IPv4"
116+
+ location = "eastus"
117+
+ name = "testpip"
118+
+ resource_group_name = "test-resources"
119+
+ sku = "Standard"
120+
+ zones = (known after apply)
121+
}
122+
123+
# azurerm_resource_group.rg will be created
124+
+ resource "azurerm_resource_group" "rg" {
125+
+ id = (known after apply)
126+
+ location = "eastus"
127+
+ name = "test-resources"
128+
}
129+
130+
# azurerm_subnet.subnet will be created
131+
+ resource "azurerm_subnet" "subnet" {
132+
+ address_prefix = (known after apply)
133+
+ address_prefixes = [
134+
+ "10.0.1.0/24",
135+
]
136+
+ enforce_private_link_endpoint_network_policies = false
137+
+ enforce_private_link_service_network_policies = false
138+
+ id = (known after apply)
139+
+ name = "AzureFirewallSubnet"
140+
+ resource_group_name = "test-resources"
141+
+ virtual_network_name = "testvnet"
142+
}
143+
144+
# azurerm_virtual_network.vnet will be created
145+
+ resource "azurerm_virtual_network" "vnet" {
146+
+ address_space = [
147+
+ "10.0.0.0/16",
148+
]
149+
+ dns_servers = (known after apply)
150+
+ guid = (known after apply)
151+
+ id = (known after apply)
152+
+ location = "eastus"
153+
+ name = "testvnet"
154+
+ resource_group_name = "test-resources"
155+
+ subnet = (known after apply)
156+
+ vm_protection_enabled = false
157+
}
158+
159+
Plan: 7 to add, 0 to change, 0 to destroy.
160+
```

‎quickstart/101-firewall-standard/variables.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
variable "resource_group_location" {
2+
default = "eastus"
3+
}

0 commit comments

Comments
 (0)