Proposed NSG Micro-Segmentation Rules

Status: REFERENCE — production rules already deployed; this captures the complete proposed rule set for review, and the gap analysis against other spokes. Related: nseg-communication-map.md, azure-network-topology.md

Production Spoke — Already Deployed

The following rules are already implemented in azure-infra/prod/net_vnet.tf and visible in Azure:

nsg-servers (applied to servers-subnet 10.20.1.0/24)

Priority	Name	Direction	Access	Protocol	Source	Dest Port
3000	servers_deny_rdp_from_workers	Inbound	Deny	TCP	10.20.2.0/24	3389
3010	servers_deny_winrm_from_workers	Inbound	Deny	TCP	10.20.2.0/24	5985, 5986
3020	servers_deny_wmi_from_workers	Inbound	Deny	TCP	10.20.2.0/24	135

nsg-workers (applied to workers-subnet 10.20.2.0/24)

Priority	Name	Direction	Access	Protocol	Source	Dest Port
200	Allow-HTTPS-From-Twingate	Inbound	Allow	TCP	10.99.5.0/24	443 (to 10.20.2.10/32)
3000	workers_deny_rdp_from_servers	Inbound	Deny	TCP	10.20.1.0/24	3389
3010	workers_deny_winrm_from_servers	Inbound	Deny	TCP	10.20.1.0/24	5985, 5986
3020	workers_deny_wmi_from_servers	Inbound	Deny	TCP	10.20.1.0/24	135

DDE Spoke — Gap Analysis

DDE billings VNet (10.50.0.0/16) has nsg-servers and nsg-workers defined in azure-dde-infra/billings/infra/net_vnet.tf, but no east-west deny rules are currently applied:

• nsg-servers — security_rules = []
• nsg-workers — only has allow-from-firewall-vnet (10.99.0.0/16 to *)

Proposed rules (symmetrical with PROD pattern, adjusted for 10.50.x.x CIDRs):

nsg-servers in DDE billings (servers-subnet 10.50.3.0/24) — PROPOSED

Priority	Name	Direction	Access	Protocol	Source	Dest Port
3000	servers_deny_rdp_from_workers	Inbound	Deny	TCP	10.50.4.0/24	3389
3010	servers_deny_winrm_from_workers	Inbound	Deny	TCP	10.50.4.0/24	5985, 5986
3020	servers_deny_wmi_from_workers	Inbound	Deny	TCP	10.50.4.0/24	135

nsg-workers in DDE billings (workers-subnet 10.50.4.0/24) — PROPOSED

Priority	Name	Direction	Access	Protocol	Source	Dest Port
3000	workers_deny_rdp_from_servers	Inbound	Deny	TCP	10.50.3.0/24	3389
3010	workers_deny_winrm_from_servers	Inbound	Deny	TCP	10.50.3.0/24	5985, 5986
3020	workers_deny_wmi_from_servers	Inbound	Deny	TCP	10.50.3.0/24	135

Decision required — Rory: azure-dde-infra/CLAUDE.md states "Never modify, delete, or replace existing firewall rules or NSG configurations. Treat all firewall/NSG resources as read-only unless explicitly told otherwise." These proposed DDE rules are additive, but they alter the NSG's effective policy. Request explicit approval before a PR is opened against azure-dde-infra.

AWS — Gap Analysis

AWS uses Security Groups rather than NSGs. Current prod SG pattern (aws-infra/prod/svr_rdp.tf, svr_ftp.tf, net_vpc.tf):

• Ingress allows all protocols / ports from the Identity VPC CIDR 10.40.0.0/16
• Ingress allows TCP 3389 from var.admin_cidrs (Twingate only)
• Egress open (Palo Alto enforces egress filter)

Finding: AWS SGs do not enforce worker-to-server lateral movement blocks at the intra-VPC level — the security model relies on there being no "workers" tier in the DR AWS environment (only DR workloads + Cloud PC). Cloud PC has its own restrictive SG in ec2_cloudpc.tf. No proposed changes for AWS.

Verification

After any rule change:

1. az network nsg show --subscription <sub> -g <rg> -n <nsg> --query securityRules
2. Confirm all expected rules present and priorities match
3. From a worker VM: Test-NetConnection -ComputerName <server-ip> -Port 3389 — should time out
4. From admin via Twingate: connect to RD Gateway — should succeed
5. Review NSG flow logs in st-logging-flowlogs for unexpected denies within 24h

Change Log

Date	Change	Author
2026-04-16	Initial proposed rule document	Kobe