{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule/", "slug": "dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule", "url": "https://update.dsesecurity.com/updates/dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule/" }, "title": "Do not expect Azure Firewall private SNAT ranges to preserve application-rule source addresses", "summary": "The private-range setting controls network-rule SNAT; application rules always use source translation.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:23:56+00:00", "modified_at": "2026-09-10T02:08:05+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 234, "potentially_affected": "Azure Firewall designs using custom private SNAT ranges and network or application rules.", "dse_recommendation": "Identify the actual rule type before changing private ranges to preserve a source address.", "primary_source": { "name": "Azure Firewall SNAT private IP address ranges | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/firewall/snat-private-range", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure Firewall’s private SNAT range configuration applies only to network rules. Application rules always use SNAT. A destination’s inclusion in the private-range list therefore does not provide the same source-address behavior across both rule types.

\n

A custom list must retain the default private ranges if those defaults are still required. When a firewall is associated with a Firewall Policy, configure the SNAT range in that policy; the firewall’s PrivateRange property is ignored. Microsoft Learn.

\n

Applicability

\n

Record the matching rule type, policy association, destination and expected source seen by the receiving service. Treat the SNAT private list separately from other controls that also classify addresses as private.

\n

DSE recommendation

\n

DSE recommends resolving the traffic’s actual rule path before proposing a range change. If the receiving service requires original client addresses, have its owner review the supported design rather than assuming a private-range exception solves application-rule traffic. Preserve intended default ranges and change the owning policy instead of an ineffective local property.

\n

Verification

\n

Use an approved test connection and inspect the source address at the receiver together with the matched firewall rule. Compare the observed result with the documented behavior for that rule type. Validate an intended network-rule change separately from application-rule traffic and confirm unrelated private destinations retain their approved behavior. Keep the effective policy and test evidence together.

\n

Official references

\n

Microsoft Learn: Azure Firewall SNAT private IP address ranges. Source retrieved September 9, 2026.

", "content_text": "Source facts\nAzure Firewall’s private SNAT range configuration applies only to network rules. Application rules always use SNAT. A destination’s inclusion in the private-range list therefore does not provide the same source-address behavior across both rule types.\nA custom list must retain the default private ranges if those defaults are still required. When a firewall is associated with a Firewall Policy, configure the SNAT range in that policy; the firewall’s PrivateRange property is ignored. Microsoft Learn.\nApplicability\nRecord the matching rule type, policy association, destination and expected source seen by the receiving service. Treat the SNAT private list separately from other controls that also classify addresses as private.\nDSE recommendation\nDSE recommends resolving the traffic’s actual rule path before proposing a range change. If the receiving service requires original client addresses, have its owner review the supported design rather than assuming a private-range exception solves application-rule traffic. Preserve intended default ranges and change the owning policy instead of an ineffective local property.\nVerification\nUse an approved test connection and inspect the source address at the receiver together with the matched firewall rule. Compare the observed result with the documented behavior for that rule type. Validate an intended network-rule change separately from application-rule traffic and confirm unrelated private destinations retain their approved behavior. Keep the effective policy and test evidence together.\nOfficial references\nMicrosoft Learn: Azure Firewall SNAT private IP address ranges. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nAzure Firewall’s private SNAT range configuration applies only to network rules. Application rules always use SNAT. A destination’s inclusion in the private-range list therefore does not provide the same source-address behavior across both rule types.\n\nA custom list must retain the default private ranges if those defaults are still required. When a firewall is associated with a Firewall Policy, configure the SNAT range in that policy; the firewall’s PrivateRange property is ignored. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/firewall/snat-private-range).\n\n## Applicability\n\nRecord the matching rule type, policy association, destination and expected source seen by the receiving service. Treat the SNAT private list separately from other controls that also classify addresses as private.\n\n## DSE recommendation\n\nDSE recommends resolving the traffic’s actual rule path before proposing a range change. If the receiving service requires original client addresses, have its owner review the supported design rather than assuming a private-range exception solves application-rule traffic. Preserve intended default ranges and change the owning policy instead of an ineffective local property.\n\n## Verification\n\nUse an approved test connection and inspect the source address at the receiver together with the matched firewall rule. Compare the observed result with the documented behavior for that rule type. Validate an intended network-rule change separately from application-rule traffic and confirm unrelated private destinations retain their approved behavior. Keep the effective policy and test evidence together.\n\n## Official references\n\n[Microsoft Learn: Azure Firewall SNAT private IP address ranges](https://learn.microsoft.com/en-us/azure/firewall/snat-private-range). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule/", "url": "https://update.dsesecurity.com/updates/dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not expect Azure Firewall private SNAT ranges to preserve application-rule source addresses", "item": "https://update.dsesecurity.com/updates/dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule/", "url": "https://update.dsesecurity.com/updates/dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule/", "headline": "Do not expect Azure Firewall private SNAT ranges to preserve application-rule source addresses", "description": "The private-range setting controls network-rule SNAT; application rules always use source translation.", "abstract": "The private-range setting controls network-rule SNAT; application rules always use source translation.", "articleBody": "Source facts\nAzure Firewall’s private SNAT range configuration applies only to network rules. Application rules always use SNAT. A destination’s inclusion in the private-range list therefore does not provide the same source-address behavior across both rule types.\nA custom list must retain the default private ranges if those defaults are still required. When a firewall is associated with a Firewall Policy, configure the SNAT range in that policy; the firewall’s PrivateRange property is ignored. Microsoft Learn.\nApplicability\nRecord the matching rule type, policy association, destination and expected source seen by the receiving service. Treat the SNAT private list separately from other controls that also classify addresses as private.\nDSE recommendation\nDSE recommends resolving the traffic’s actual rule path before proposing a range change. If the receiving service requires original client addresses, have its owner review the supported design rather than assuming a private-range exception solves application-rule traffic. Preserve intended default ranges and change the owning policy instead of an ineffective local property.\nVerification\nUse an approved test connection and inspect the source address at the receiver together with the matched firewall rule. Compare the observed result with the documented behavior for that rule type. Validate an intended network-rule change separately from application-rule traffic and confirm unrelated private destinations retain their approved behavior. Keep the effective policy and test evidence together.\nOfficial references\nMicrosoft Learn: Azure Firewall SNAT private IP address ranges. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:23:56+00:00", "dateModified": "2026-09-10T02:08:05+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-480-do-not-expect-azure-firewall-private-snat-ranges-to-preserve-application-rule/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not expect Azure Firewall private SNAT ranges to preserve application-rule source addresses" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 234, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure Firewall SNAT private IP address ranges | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/firewall/snat-private-range" } } ] } }