---
title: Security Group should restrict UDP access from the internet
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Security Group should restrict UDP
  access from the internet
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Security Group should restrict UDP access from the internet
 
## Description{% #description %}

Azure network security groups should only allow internet access to commonly abused UDP service ports when explicitly required. Broad exposure of these services lets attackers use DDoS amplification against the Azure virtual network and external devices.

The ports are 53 (DNS), 123 (NTP), 161 (SNMP), 389 (CLDAP), and 1900 (SSDP). A network security group fails when an inbound Allow rule opens one of these ports to the internet and no higher-priority Deny rule blocks it. This rule treats `*`, `0.0.0.0/0`, `::/0`, `Internet`, and `Any` as internet sources. It counts port ranges that include these ports, and security rules with the TCP, UDP, or Any protocol. It does not evaluate security rules that list multiple source address prefixes, or just-in-time (JIT) access rules created by Microsoft Defender for Cloud.

## Remediation{% #remediation %}

Delete each inbound Allow rule that opens port 53, 123, 161, 389, or 1900 to the internet, or change its source to specific IP addresses. See [Create, change, or delete Azure network security groups](https://learn.microsoft.com/en-us/azure/virtual-network/manage-network-security-group).

## References{% #references %}

- [Create, change, or delete Azure network security groups](https://learn.microsoft.com/en-us/azure/virtual-network/manage-network-security-group)
- [Azure network security groups overview](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview)
- [az network nsg rule](https://learn.microsoft.com/en-us/cli/azure/network/nsg/rule)
- [CIS Microsoft Azure Foundations Benchmark](https://www.cisecurity.org/benchmark/azure)