firewall is necessary for eventhub if not necessary then what is the alternate of firewall to restric the traffic.

Jena, Tapas Kumar (893) (EXT) 0 Reputation points
2026-07-08T16:57:32.43+00:00

firewall is necessary for eventhub if not necessary then what is the alternate of firewall to restric the traffic.

Azure Event Hubs

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. SAI JAGADEESH KUDIPUDI 3,645 Reputation points Microsoft External Staff Moderator
    2026-07-11T07:26:37.6433333+00:00

    Hi @Jena, Tapas Kumar (893) (EXT) ,

    No, Azure Firewall is not mandatory for Azure Event Hubs. By default, Event Hubs is secured through authentication and authorization mechanisms such as SAS and Microsoft Entra ID.

    If you want to restrict network access to Event Hubs, you can use the following alternatives:

    • IP Firewall Rules: Allow access only from specific public IP addresses or ranges.
    • Virtual Network Service Endpoints: Restrict access to selected virtual networks.
    • Private Endpoints (Recommended): Provide private connectivity to Event Hubs through a private IP address within your VNet and disable public access if required.

    For the highest level of network isolation, Microsoft recommends using Private Endpoints.

    References:

    If your requirement is to restrict traffic from specific networks only, please let us know whether the clients connect over the public internet or from an Azure Virtual Network so that we can recommend the most appropriate option.

    Was this answer helpful?

    0 comments
  2. Megha Ramakrishnan 500 Reputation points
    2026-07-09T08:58:16.02+00:00

    Hi @Jena, Tapas Kumar (893) (EXT)

    No, an Azure Firewall is not strictly necessary for an Event Hub.

    If you want to restrict traffic without using a firewall, you could try out the below alternatives.

    Alternatives to Firewall:

    1. Private Endpoint:
      Instead of exposing your Event Hub to the public internet, you can project it directly into your private Azure Virtual Network using a Private Endpoint.
      It assigns a private IP address from your Virtual Network to the Event Hub. All traffic travels securely over private network rather than the public internet.

    Once enabled, you can completely shut off the public network access point. Only resources inside your approved VNet (or connected via VPN/ExpressRoute) can even see that the Event Hub exists.

    1. Event Hub IP Filters:
      Event Hubs has a built-in, lightweight IP filtering system. You don't need an external firewall because the Event Hub service handles the blocking natively.
      You switch the network connectivity of the Event Hub from "All networks" to "Selected networks".

    You explicitly list the exact public IP addresses or CIDR blocks (like your office IP) allowed to connect. Anyone trying to reach the Event Hub from an unlisted IP is automatically blocked with a 403 Forbidden error.

    1. Virtual Network Service Endpoints:
      If your applications sending data to the Event Hub are hosted on Azure VMs, Function Apps, or AKS inside your own Azure subscriptions, you can use Service Endpoints.

    It isolates the Event Hub so that it only accepts traffic originating from specific subnets within your Azure Virtual Networks.

    Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

    Thank you!

    Was this answer helpful?

    0 comments

  3. AI answer

    2026-07-08T16:58:29.45+00:00

    A dedicated firewall is not strictly required to restrict traffic to Azure Event Hubs. Event Hubs provides built‑in network security features that can be used instead of, or in addition to, a traditional firewall to control access.

    Key options to restrict traffic without a separate firewall:

    1. IP firewall rules on the Event Hubs namespace
      Event Hubs has a built‑in IP firewall at the namespace level:
      • Allow only specific IPv4/IPv6 addresses or ranges in CIDR notation.
      • Any connection from an IP that does not match an allowed rule is rejected as unauthorized.
      • Rules are evaluated in order; the first matching rule determines allow/deny.
      • When IP filtering is enabled, blocked requests include other Azure services, Azure portal, logging, etc., unless explicitly allowed as trusted services.
      • This feature is not supported in the Basic tier.
      IP firewall can be configured via:
      • Azure portal: Networking → Public access → Firewall → Selected networks, then add IP addresses/ranges.
      • Azure CLI: az eventhubs namespace network-rule-set commands.
      • PowerShell: Set-AzEventHubNetworkRuleSet.
      • ARM templates: add IP rules and set defaultAction to Deny (and ensure at least one IP or virtual network rule is present).
    2. Virtual network integration (service endpoints / private endpoints)
      Instead of exposing Event Hubs to the public internet:
      • Use virtual network rules with service endpoints to allow only traffic from specific subnets.
      • Or disable public access and use private endpoints so Event Hubs is reachable only via private IPs in your VNet.
    3. Network Security Groups (NSGs) and Azure Firewall with service tags
      On the VNet side, traffic to Event Hubs can be controlled using:
      • NSGs or Azure Firewall rules that reference the EventHub service tag as destination.
      • This lets outbound rules allow or deny traffic to Event Hubs without managing individual IP ranges.
    4. Network Security Perimeter (NSP)
      Event Hubs can be associated with a Network Security Perimeter to provide a logical network boundary:
      • Define inbound access rules (which IPs/resources/subscriptions can send data to Event Hubs).
      • Define outbound access rules (which external resources Event Hubs can call, e.g., Storage for Capture, Key Vault).
      • Manage access at perimeter level instead of per‑service firewall, and get diagnostic logging for network access attempts.
    5. Protocol/port control at your network edge
      If using your own firewall, restrict outbound ports needed by Event Hubs clients:
      • AMQP: TCP 5671/5672.
      • HTTPS and AMQP‑over‑WebSockets: TCP 443.
      • Kafka: TCP 9093.
        You can choose AMQP‑over‑WebSockets to use only port 443 if that aligns with your network policy.

    In summary, a traditional firewall device is not mandatory. Access can be restricted using Event Hubs IP firewall rules, virtual network rules (service endpoints/private endpoints), NSGs/Azure Firewall with service tags, and Network Security Perimeter, combined with protocol/port controls.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.