100 lines
2.4 KiB
HCL
100 lines
2.4 KiB
HCL
resource "random_pet" "prefix" {
|
|
prefix = var.prefix
|
|
length = 1
|
|
}
|
|
resource "azurerm_resource_group" "rg" {
|
|
name = "${random_pet.prefix.id}-rg"
|
|
location = var.resource_group_location
|
|
}
|
|
|
|
resource "azurerm_virtual_network" "vnet" {
|
|
name = "${random_pet.prefix.id}-vnet"
|
|
address_space = ["10.0.0.0/16"]
|
|
location = azurerm_resource_group.rg.location
|
|
resource_group_name = azurerm_resource_group.rg.name
|
|
}
|
|
|
|
resource "azurerm_subnet" "subnet" {
|
|
name = "AzureFirewallSubnet"
|
|
resource_group_name = azurerm_resource_group.rg.name
|
|
virtual_network_name = azurerm_virtual_network.vnet.name
|
|
address_prefixes = ["10.0.1.0/24"]
|
|
}
|
|
|
|
resource "azurerm_public_ip" "pip" {
|
|
name = "${random_pet.prefix.id}-pip"
|
|
location = azurerm_resource_group.rg.location
|
|
resource_group_name = azurerm_resource_group.rg.name
|
|
allocation_method = "Static"
|
|
sku = "Standard"
|
|
}
|
|
|
|
resource "azurerm_firewall" "main" {
|
|
name = "${random_pet.prefix.id}-fw"
|
|
location = azurerm_resource_group.rg.location
|
|
resource_group_name = azurerm_resource_group.rg.name
|
|
sku_name = "AZFW_VNet"
|
|
sku_tier = "Standard"
|
|
|
|
ip_configuration {
|
|
name = "configuration"
|
|
subnet_id = azurerm_subnet.subnet.id
|
|
public_ip_address_id = azurerm_public_ip.pip.id
|
|
}
|
|
}
|
|
|
|
resource "azurerm_firewall_application_rule_collection" "app-rc" {
|
|
name = "${random_pet.prefix.id}-app-rc"
|
|
azure_firewall_name = azurerm_firewall.main.name
|
|
resource_group_name = azurerm_resource_group.rg.name
|
|
priority = 100
|
|
action = "Allow"
|
|
|
|
rule {
|
|
name = "testrule"
|
|
|
|
source_addresses = [
|
|
"10.0.0.0/16",
|
|
]
|
|
|
|
target_fqdns = [
|
|
"*.google.com",
|
|
]
|
|
|
|
protocol {
|
|
port = "443"
|
|
type = "Https"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "azurerm_firewall_network_rule_collection" "net-rc" {
|
|
name = "${random_pet.prefix.id}-net-rc"
|
|
azure_firewall_name = azurerm_firewall.main.name
|
|
resource_group_name = azurerm_resource_group.rg.name
|
|
priority = 100
|
|
action = "Allow"
|
|
|
|
rule {
|
|
name = "dnsrule"
|
|
|
|
source_addresses = [
|
|
"10.0.0.0/16",
|
|
]
|
|
|
|
destination_ports = [
|
|
"53",
|
|
]
|
|
|
|
destination_addresses = [
|
|
"8.8.8.8",
|
|
"8.8.4.4",
|
|
]
|
|
|
|
protocols = [
|
|
"TCP",
|
|
"UDP",
|
|
]
|
|
}
|
|
}
|