Skip to content

Inbound SFTP to a Storage Account (Firewall DNAT)

Some workloads must receive files from an external party over SFTP. Your storage account uses a private endpoint and has public access disabled, so the external party can't reach it directly. This is by design: see Limits. For these cases the platform can open one controlled entry point on the hub firewall: a DNAT rule on a custom port.

Check with your platform team

This pattern needs a public IP address on the hub firewall and a DNAT rule. Whether your platform offers it, which regions it covers and who approves it depends on your organisation. Start with an exception request, not with code.

How it works

DNAT (destination network address translation) rewrites the destination of incoming traffic. The external client connects to the public IP address of the firewall on a custom port. The firewall translates that to the SFTP endpoint of your storage account on port 22, and forwards it over the private path.

External client -> firewall public IP : custom port -> DNAT -> storage account FQDN : 22

Each storage account gets its own custom port, so the firewall knows where to send each connection. The port is not 22. Only the source addresses you name in the rule can connect.

When to use it

Use this pattern when all of these are true:

  1. The storage account uses a private endpoint and has public access disabled.
  2. SFTP is enabled on the storage account.
  3. The external party is outside your private network (it can't use VPN or private routing).

If the other side can reach your private network, use a normal firewall rule instead.

What to request

Field Description
Storage account Name of the storage account, and the environment (dev, tst, acc, prd)
Source The public IP address(es) of the external party. Ask them for a fixed, small set of addresses.
Region The region of the firewall the external party will connect to. If your platform has a firewall per region, choose the region that fits your workload.
Port A free custom port. Your platform team keeps a register of assigned ports and gives you the next free one.
Rationale Which party, which data, and why SFTP is needed
Review date When the rule should be reviewed or removed

What the platform team does

The platform team adds a NAT rule to the firewall rule configuration, in every platform environment that should get it, and deploys it. The technical details are in Firewall rules.

What you give the external party

After the rule is deployed, send the external party:

  1. Host: the public IP address of the firewall in the chosen region (your platform team gives you this value).
  2. Port: the custom port assigned to you.
  3. Protocol: SFTP.
  4. The credentials for the storage account's SFTP user, through a secure channel. You manage these.

Test the connection from the external party's side. Remove the rule when the data exchange ends.