Networking

# Create a VNet with a subnet
az network vnet create \
  --name myVNet \
  --resource-group myRG \
  --location eastus \
  --address-prefix 10.0.0.0/16 \
  --subnet-name default \
  --subnet-prefix 10.0.0.0/24

# Add another subnet
az network vnet subnet create \
  --name appSubnet \
  --resource-group myRG \
  --vnet-name myVNet \
  --address-prefix 10.0.1.0/24

# List VNets
az network vnet list -g myRG -o table

# List subnets
az network vnet subnet list -g myRG --vnet-name myVNet -o table

# VNet peering (connect two VNets)
az network vnet peering create \
  --name vnet1-to-vnet2 \
  -g myRG --vnet-name myVNet \
  --remote-vnet /subscriptions/<sub>/resourceGroups/myRG/providers/Microsoft.Network/virtualNetworks/myVNet2 \
  --allow-vnet-access

# Create NSG
az network nsg create --name myNSG -g myRG

# Allow inbound HTTP (80)
az network nsg rule create \
  --name allow-http \
  --nsg-name myNSG -g myRG \
  --priority 100 \
  --protocol Tcp \
  --direction Inbound \
  --source-address-prefixes '*' \
  --source-port-ranges '*' \
  --destination-port-ranges 80 \
  --access Allow

# Allow SSH from specific IP
az network nsg rule create \
  --name allow-ssh \
  --nsg-name myNSG -g myRG \
  --priority 110 \
  --protocol Tcp \
  --direction Inbound \
  --source-address-prefixes 203.0.113.0/24 \
  --destination-port-ranges 22 \
  --access Allow

# Deny all other inbound (lowest priority rule recommended to add explicitly)
az network nsg rule create \
  --name deny-all-inbound \
  --nsg-name myNSG -g myRG \
  --priority 4096 \
  --protocol '*' --direction Inbound \
  --access Deny \
  --source-address-prefixes '*' \
  --destination-port-ranges '*'

# Associate NSG to subnet
az network vnet subnet update \
  --name default -g myRG --vnet-name myVNet \
  --network-security-group myNSG

# Associate NSG to NIC
az network nic update \
  --name myVMNic -g myRG \
  --network-security-group myNSG

# List NSG rules
az network nsg rule list --nsg-name myNSG -g myRG -o table

# Create static public IP
az network public-ip create \
  --name myPublicIP -g myRG \
  --sku Standard \
  --allocation-method Static \
  --zone 1 2 3              # zone-redundant

# Create dynamic basic IP (legacy — use Standard+Static instead)
az network public-ip create \
  --name myPublicIP -g myRG \
  --sku Basic --allocation-method Dynamic

# Show assigned IP
az network public-ip show --name myPublicIP -g myRG \
  --query ipAddress -o tsv

# List public IPs
az network public-ip list -g myRG -o table

# Create a public Standard Load Balancer
az network lb create \
  --name myLB -g myRG \
  --sku Standard \
  --public-ip-address myPublicIP \
  --frontend-ip-name myFrontend \
  --backend-pool-name myBackendPool

# Add a health probe (HTTP on port 80)
az network lb probe create \
  --lb-name myLB -g myRG \
  --name myHealthProbe \
  --protocol Http --port 80 --path /health

# Add a load-balancing rule
az network lb rule create \
  --lb-name myLB -g myRG \
  --name myLBRule \
  --frontend-ip-name myFrontend \
  --backend-pool-name myBackendPool \
  --probe-name myHealthProbe \
  --protocol Tcp --frontend-port 80 --backend-port 80

# Add VM NIC to backend pool
az network nic ip-config address-pool add \
  --address-pool myBackendPool \
  --ip-config-name ipconfig1 \
  --nic-name myVMNic -g myRG \
  --lb-name myLB

# Create (WAF_v2 for WAF, Standard_v2 for basic)
az network application-gateway create \
  --name myAppGW -g myRG \
  --location eastus \
  --sku WAF_v2 --capacity 2 \
  --vnet-name myVNet --subnet appgwSubnet \
  --public-ip-address myPublicIP \
  --frontend-port 80 \
  --http-settings-cookie-based-affinity Disabled \
  --http-settings-port 80 --http-settings-protocol Http \
  --routing-rule-type Basic \
  --servers 10.0.1.4 10.0.1.5     # backend pool IPs/FQDNs

# Enable WAF (on WAF_v2)
az network application-gateway waf-config set \
  --gateway-name myAppGW -g myRG \
  --enabled true \
  --firewall-mode Prevention \
  --rule-set-type OWASP --rule-set-version 3.2

# Create a DNS zone
az network dns zone create --name example.com -g myRG

# Add an A record
az network dns record-set a add-record \
  --zone-name example.com -g myRG \
  --record-set-name www \
  --ipv4-address 203.0.113.10

# Add a CNAME record
az network dns record-set cname set-record \
  --zone-name example.com -g myRG \
  --record-set-name blog \
  --cname myapp.azurewebsites.net

# Add a TXT record
az network dns record-set txt add-record \
  --zone-name example.com -g myRG \
  --record-set-name @ \
  --value "v=spf1 include:sendgrid.net ~all"

# List records
az network dns record-set list --zone-name example.com -g myRG -o table

# Show nameservers (update these at your registrar)
az network dns zone show --name example.com -g myRG \
  --query nameServers -o tsv

# Create private endpoint (e.g. for a storage account)
az network private-endpoint create \
  --name myPrivateEndpoint -g myRG \
  --location eastus \
  --vnet-name myVNet --subnet default \
  --private-connection-resource-id /subscriptions/<sub>/resourceGroups/myRG/providers/Microsoft.Storage/storageAccounts/mystorageacct \
  --group-id blob \
  --connection-name myStorageConnection

# Create Private DNS zone for blob
az network private-dns zone create \
  -g myRG --name "privatelink.blob.core.windows.net"

# Link DNS zone to VNet
az network private-dns link vnet create \
  -g myRG --zone-name "privatelink.blob.core.windows.net" \
  --name myLink --virtual-network myVNet \
  --registration-enabled false

# Gateway needs a dedicated GatewaySubnet
az network vnet subnet create \
  --name GatewaySubnet -g myRG --vnet-name myVNet \
  --address-prefix 10.0.255.0/27

# Create VPN gateway (takes ~30–45 min)
az network vnet-gateway create \
  --name myVPNGW -g myRG \
  --vnet myVNet --public-ip-address myPublicIP \
  --gateway-type Vpn --vpn-type RouteBased \
  --sku VpnGw1 --no-wait

# Create Azure Firewall subnet (must be /26 or larger)
az network vnet subnet create \
  --name AzureFirewallSubnet -g myRG --vnet-name myVNet \
  --address-prefix 10.0.2.0/26

az network firewall create --name myFirewall -g myRG --location eastus

# Add network rule (allow SSH to backend)
az network firewall network-rule create \
  --firewall-name myFirewall -g myRG \
  --collection-name NetRules --priority 100 --action Allow \
  --name allow-ssh \
  --protocols TCP \
  --source-addresses '*' \
  --destination-addresses 10.0.1.0/24 \
  --destination-ports 22