Azure NSG Ports/Rules for Hindsight outbound

Microsoft Azure

A few weeks ago we had a requirement to restrict the outbounds ports of HDinsight for security reasons, so this article is dedicated to that requirement. Before we begin Microsoft official position on this is:

Important: HDInsight doesn’t support restricting outbound traffic, only inbound traffic. When defining Network Security Group rules for the subnet that contains HDInsight, only use inbound rules.

So after reading the above (from: https://azure.microsoft.com/en-gb/documentation/articles/hdinsight-extend-hadoop-virtual-network/) we took it as a challenge to get this working, after much testing we managed to get all the required ports. We have tried by deploying multiple clusters and so far it all works and deploys correctly, a couple of notes:

  • The solution below is not 100% secure but it mitigates the risk by lowering the “attack” service to only the regional azure IPs.
  • We also needed to open port 80 to the Ubuntu website (91.189.88.0/21) as this is required by some of the Apache tests after deployment
  • While testing we noticed that the servers communicate with the management point over a random port, this port seemed to be in the same range as the dynamic Azure SQL ports of 11000-11999 and 14000-14999. However to be on the safe side we opened a larger range 10000-49151 as we can’t be 100% sure.
  • You will need to open multiple rules for each Azure Regional IP (i suggest you combine the ips to the second octed). The ip addresses can be found here: https://www.microsoft.com/en-gb/download/details.aspx?id=41653. You will also need to keep the ip addresses updated (A new xml file will be uploaded every Wednesday (Pacific Time) with the new planned IP address ranges. New IP address ranges will be effective on the following Monday (Pacific Time)).
  • This is all unofficial and while we have had no problems with multiple deployments i can’t give any guarantees.

Inbound Ports

NamePriorityActionSourceSource PortDestinationDestination PortProtocolDirectionDescription
Allow-HDinsight01-Inbound1001Allow168.61.49.99/32*Subnet Range443*InboundRequired for Hdinsight Healthchecks
Allow-HDinsight02-Inbound1002Allow23.99.5.239/32*Subnet Range443*InboundRequired for Hdinsight Healthchecks
Allow-HDinsight03-Inbound1003Allow168.61.48.131/32*Subnet Range443*InboundRequired for Hdinsight Healthchecks
Allow-HDinsight04-Inbound1004Allow138.91.141.162/32*Subnet Range443*InboundRequired for Hdinsight Healthchecks

Outbound Ports

NamePriorityActionSourceSource PortDestinationDestination PortProtocolDirectionDescription
Allow-HDInsightToUbuntu-Outbound2001AllowSubnet Range*91.189.88.0/2180TCPOutboundRequired for Hdinsight
Allow-HDinsight01-Outbound2002AllowSubnet Range*Azure Regional Range80TCPOutboundRequired for Hdinsight
Allow-HDinsight02-Outbound2003AllowSubnet Range*Azure Regional Range443TCPOutboundRequired for Hdinsight
Allow-HDinsight03-Outbound2004AllowSubnet Range*Azure Regional Range1433TCPOutboundRequired for Hdinsight
Allow-HDinsight04-Outbound2005AllowSubnet Range*Azure Regional Range10000-49151TCPOutboundRequired for Hdinsight

Leave a Reply

Your email address will not be published. Required fields are marked *