Enforza Secure NAT Gateway & Firewall (BYOL)

⚠️ Required after deploy — two Azure settings, or the firewall passes no traffic

Enforza is a NAT / egress-firewall network virtual appliance. It can only secure traffic that Azure lets reach it and lets it forward. If you deploy from the Azure portal “Create” button, Azure sets NEITHER of these for you — the appliance will register, show Online, and look healthy while silently dropping every packet that isn’t its own. Before you route traffic through it, you MUST do both:

• 1️⃣ Turn ON IP forwarding (on the NIC). Azure drops any packet whose source IP isn’t the VM’s own until this is enabled. In the portal: your VM → Networking → the network interface → IP forwarding → Enabled, then reboot the VM. The one-click ARM template sets this automatically — deploy that way and you can skip this step.
• 2️⃣ Open the Network Security Group (NSG) so it can act as a firewall. The default NSG only allows the appliance’s own management traffic — it blocks the transit traffic you want to secure before it ever reaches Enforza. Add NSG rules that allow the traffic you intend to route through the appliance (inbound and outbound). For a first bring-up, an allow-all rule from your workload subnets is the quickest proof; then tighten. Enforza does the egress filtering — the Azure NSG must not block the traffic upstream of it.

Both settings ON = the appliance filters traffic. Either one OFF = it drops everything, even though the console still shows it Online.

Getting started

• Deploy. Use the one-click ARM template, or deploy the VM image into the VNet/subnet that will host your firewall. Deploying directly (portal “Create”) means you must complete both required steps above afterwards.
• Come online. The appliance self-registers to Enforza on first boot via Azure instance attestation — no key to enter. It appears in the Enforza console within ~30 seconds of its first heartbeat, as UNCLAIMED.
• Claim it. In the Enforza console open “Claim a firewall” and enter your Azure Subscription ID + VM ID.
• Enable IP forwarding + open the NSG (the two required steps above) before routing production traffic.
• Apply a policy from the console or your GitOps (GitHub) pipeline.
• Route traffic through the firewall with a user-defined route (0.0.0.0/0 → the appliance’s private IP, next hop Virtual appliance) on your workload subnets. For production, run multiple appliances across zones for HA.

Full docs: https://docs.enforza.io