Azure Firewall vs Web Application Firewall vs DDoS Protection vs Bastion vs NSG
Verdict: Match the threat to the service: stateful traffic filtering is Azure Firewall, web exploits are Web Application Firewall, traffic floods are DDoS Protection, private admin access to VMs is Bastion, and subnet allow or deny rules are an NSG.
| Criterion | Azure Firewall | Web Application Firewall | DDoS Protection | Azure Bastion | Network security group |
|---|---|---|---|---|---|
| Protects against | East-west and north-south traffic across workloads | Web exploits such as SQL injection and cross-site scripting | Volumetric floods that exhaust an application | Exposure of VM management ports to the internet | Unwanted inbound or outbound traffic to resources |
| Layer | Cloud-native stateful firewall, L3 to L7 | Application layer, in front of web apps | Network layer, on a virtual network or public IP | Connectivity, RDP and SSH over TLS | Subnet or NIC packet filtering by rule |
| Deployed with | Central service, optionally Firewall Manager | Application Gateway, Front Door, or CDN | A virtual network or an individual public IP | The virtual network, uses private IPs | Attached to a subnet or network interface |
| Choose when | You need managed, highly available network filtering | You must patch common web exploits centrally | A public endpoint must survive a traffic flood | Admins need VM access with no public IP | You need simple per-property allow or deny |
Rules
- Choose Azure Bastion for RDP or SSH to a VM from the portal over TLS, so the VM needs no public IP address.
- Choose Azure Firewall for a cloud-native, fully stateful, highly available service that inspects east-west and north-south traffic.
- Choose Web Application Firewall for centralised protection against common web exploits such as SQL injection and cross-site scripting.
- Choose DDoS Protection to mitigate attacks that flood an application to exhaust its resources.
- Choose a network security group to allow or deny inbound and outbound traffic by source, destination, port, and protocol.
- Web Application Firewall is deployed with Application Gateway, Front Door, or Content Delivery Network, not with Key Vault or an NSG.
Traps
- Bastion provides admin connectivity only - it does not filter traffic, block floods, or store secrets, though it is offered as a distractor for all three.
- Key Vault stores secrets and certificates; it never filters network traffic, so it is the wrong answer to any traffic question.
- DDoS Protection is network-layer only; it does not stop application-layer exploits like SQL injection, which is a Web Application Firewall job.