TopolearnAlmost every production workload sits in a VNet; NSGs are the first layer of network security.
A virtual network (VNet) is your private network in one region, defined by one or more address spaces such as 10.10.0.0/16. You carve it into subnets (10.10.1.0/24); Azure reserves 5 addresses in every subnet. Some services require a dedicated or delegated subnet (App Service VNet integration, Container Apps environments), so plan address space generously and never overlap with on-premises or other VNets you may peer with.
Resources in a VNet can talk to each other by default. Two VNets connect through peering, which is not transitive: if A peers with B and B with C, A cannot reach C without routing through an appliance (hub-spoke design).
A network security group (NSG) is a stateful set of allow/deny rules attached to a subnet or NIC. Each rule has a priority from 100 to 4096, and the lowest number that matches wins. Default rules allow traffic within the VNet and from the Azure load balancer and deny other inbound traffic; outbound to the internet is allowed by default.
Rules can use service tags (Internet, AzureLoadBalancer, Storage.WestEurope) and application security groups instead of raw IPs. For outbound internet access, use an explicit NAT gateway rather than relying on implicit default outbound access, which Azure is retiring.
Example
az network vnet create -g rg-net -n vnet-app --address-prefixes 10.10.0.0/16 \
--subnet-name snet-web --subnet-prefixes 10.10.1.0/24
az network nsg create -g rg-net -n nsg-web
az network nsg rule create -g rg-net --nsg-name nsg-web -n allow-https \
--priority 100 --direction Inbound --access Allow --protocol Tcp \
--source-address-prefixes Internet --destination-port-ranges 443
az network vnet subnet update -g rg-net --vnet-name vnet-app -n snet-web \
--network-security-group nsg-web
az network nsg rule list -g rg-net --nsg-name nsg-web --include-default -o tableRemember
- VNet = regional private address space split into subnets
- NSG rules: lowest priority number wins; stateful, so return traffic is allowed
- Peering is not transitive
- Plan non-overlapping address space up front
Watch out for
- Picking overlapping CIDR ranges, which makes later peering or VPN connections impossible without re-addressing.