The Azure Bastion is a service that allow you to connect to your virtual machines without a public IP.
The connection is through TLS, which means you are able to reach your machine ( SSH or RDP ) via a browser.
You can configure Azure Bastion service without a NSG in front of, but in order to increase you security and block many unwanted tries already in the boarder, configure a Network Security Group in Azure Bastion subnet.
In order to create and apply a specific NSG to Bastion subnet, you need to fallow few steps:
- Create a Resource Group
- Create a Network Security Group
- Create a few necessary rules
I’ve created a simple bash script using Azure CLI, it can help you with that task, please check in Github:
After create the Bastion NSG, you just need to select it in “Network Security Group” section over Bastion subnet configuration.
To learn further, check those links below:
https://docs.microsoft.com/en-us/azure/bastion/bastion-overview