Add firewall rules

Using the Azure portal:

1. Select your Azure Database for PostgreSQL flexible server.

2. In the resource menu, under the Settings section, select Networking.

   

3. To create a firewall rule that allows connections from the public IP address of the client machine you're using to connect to the portal, select Add current client IP address (###.###.###.###).

   

4. Add a new firewall rule to the grid. The portal automatically generates the Firewall rule name, but you can change it to any valid name you prefer. Set the Start IP address and End IP address to the public IP address from which you're connected to the Azure portal.

   

5. To create a firewall rule that allows connections from any public IP address, select Add 0.0.0.0 / 255.255.255.255.

   

6. To create a firewall rule that allows connections from any IP address allocated to any Azure service or asset, select Allow public access from any Azure service within Azure to this server.

   

   Important

   Allow public access from any Azure service within Azure to this server creates a firewall rule whose start and end IP addresses are set to 0.0.0.0. The presence of this rule configures the firewall to allow connections from IP addresses allocated to any Azure service or asset, including connections from the subscriptions of other customers.

7. Select Save.

   

8. A notification informs you that the changes are being applied.

   

9. When the process completes, a notification informs you that the changes were applied.

   

Use the az postgres flexible-server firewall-rule create command to add firewall rules to a server.

az postgres flexible-server firewall-rule create \
  --resource-group <resource_group> \
  --server-name <server> \
  --name <rule> \
  --start-ip-address <start_ip_address> \
  --end-ip-address <end_ip_address>

If you try to add a firewall rule on a server that isn't in the Ready state, you get an error like this:

Code: InternalServerError
Message: An unexpected error occured while processing the request. Tracking ID: '<tracking_id>'

If you try to add a firewall rule with an invalid name, you get an error like this:

The firewall rule name can only contain 0-9, a-z, A-Z, '-' and '_'. Additionally, the name of the firewall rule must be at least 3 characters and no more than 128 characters in length. 

If you try to add a firewall rule with a name that matches the name of another existing firewall rule, you don't get an error, but the rule is updated with the values you provide for --start-ip-address and --end-ip-address.

If you pass an invalid IP address for the --start-ip-address and --end-ip-address parameters, you get an error like this:

Incorrect value for ip address. Ip address should be IPv4 format. Example: 12.12.12.12.

If you pass a value for --start-ip-address that's bigger than the value you pass for --end-ip-address, you get an error like this:

The end IP address is smaller than the start IP address.

If you try to add a firewall rule to a server that doesn't have public access enabled, you get an error like this:

Firewall rule operations cannot be requested for a private access enabled server.

To allow public access from any Azure service within Azure to your server, you must create a firewall rule whose start and end IP addresses are both set to 0.0.0.0.