N8
Operating Systems Azure

NethSecurity 8.8 on Azure User Guide

| Product: NethSecurity 8.8 on Azure

Overview

This guide covers deploying NethSecurity 8.8 on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

NethSecurity is a free, open source (GPL 2.0) Unified Threat Management (UTM) firewall by Nethesis. It is built on OpenWrt (the Linux kernel, BusyBox, procd, netifd, uci and dropbear) and adds Nethesis's own packages and a modern Vue.js administration interface. It is a network security appliance, not a general purpose server OS: you manage it from the command line over SSH or from its web dashboard. This image is the official NethSecurity x86 64 build, adapted by cloudimg to run as a first class Azure virtual machine.

Because NethSecurity is an agentless system (no cloud-init, no Azure Linux Agent, no systemd), cloudimg adds one small first boot service so the image behaves like any other Azure VM: it reads the SSH key you supply at deploy time from the Azure Instance Metadata Service and installs it, and it reports provisioning success to the Azure fabric so the VM comes up cleanly.

What's included:

  • NethSecurity 8.8.0, the current stable release, official x86 64 build (community edition)
  • Agentless Azure integration: your SSH key is injected at first boot from the Instance Metadata Service, with no baked in credential
  • eth0 configured for DHCP so the VM gets its Azure address and routes automatically
  • Firewall open for SSH (22), the web UI (9090) and HTTPS (443); everything else is rejected
  • NethSecurity's Vue.js web administration dashboard on HTTPS port 9090, self signed
  • Per machine identity: dropbear regenerates its SSH host keys on first boot, and the hostname is taken from Azure
  • Gen2 Hyper V (UEFI) virtual machine support
  • 24/7 cloudimg support

Platform: Microsoft Azure (Gen2 Hyper V / UEFI) Default user: root (key only; no password)

Security posture

This image ships with no known credential. There is no default password and no baked in SSH key:

  • The root account has no password and password authentication is disabled in dropbear (PasswordAuth and RootPasswordAuth are both off), so every login is by key. NethSecurity's stock image sets a well known default root password on first boot; cloudimg removes that behaviour so no two machines ever share a secret.
  • The only key that works is the public key you supply when you create the virtual machine. NethSecurity has no Azure agent, so cloudimg's first boot service reads that key from the Instance Metadata Service and installs it into dropbear.
  • No SSH host keys are baked into the image. dropbear generates its own on first boot, so two machines built from this image never share a host identity.
  • The firewall rejects all inbound traffic on the Azure interface except SSH (22), the web UI (9090) and HTTPS (443). Your Azure Network Security Group is the outer boundary and should be scoped to your management address.
  • NethSecurity's built in banip intrusion prevention ships enabled. cloudimg disables only its SSH log scraping (which would otherwise permanently ban your own address if you fumble a key, since this is a key only cloud VM); banip's threat feed blocklisting remains available for you to enable from the dashboard.

Prerequisites

Before deploying this image, ensure you have:

  1. An active Microsoft Azure subscription
  2. Access to the Azure Portal or Azure CLI
  3. An SSH key pair for VM access
  4. Familiarity with Azure VM management

Recommended VM Size: Standard_B2s (2 vCPU, 4 GB RAM) or larger. Enabling deep packet inspection, intrusion prevention (Suricata / threat shield) or many concurrent VPN tunnels benefits from more memory — size up accordingly for production UTM workloads.

Step 1: Deploy the Virtual Machine

Deploy from the Azure Marketplace listing, supplying your own SSH public key. The key is injected at first boot from the Instance Metadata Service.

az vm create \
  --resource-group my-rg \
  --name my-nethsecurity \
  --image <cloudimg-nethsecurity-marketplace-image> \
  --size Standard_B2s \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard

Scope the Network Security Group so that inbound 22 (and 9090 for the dashboard) is reachable only from your management address.

Step 2: Connect over SSH

NethSecurity's default (and only) administrative user is root. Connect with the private key that matches the public key you supplied:

ssh -i ~/.ssh/id_rsa root@<vm-public-ip>

There is no password prompt: password authentication is disabled, so only your key works.

Step 3: Verify the image on the VM

Once connected, confirm the release and that the cloudimg first boot service ran (it injects your key and reports provisioning to Azure, then drops a sentinel file):

cat /etc/openwrt_release
ls -l /etc/cloudimg-imds.done

Confirm your SSH key is installed and password authentication is disabled (no baked credential):

cat /etc/dropbear/authorized_keys
uci get dropbear.@dropbear[0].PasswordAuth

Step 4: Verify networking and the firewall

eth0 is configured for DHCP so the VM takes its Azure address automatically. The firewall opens SSH, the web UI and HTTPS:

uci show network.wan
ip -4 addr show eth0 | grep inet
netstat -ltn | grep -E ':22|:9090|:443'

Step 5: The NethSecurity web dashboard

NethSecurity's administration interface listens on HTTPS port 9090 with a self signed certificate. Before you can log in, set a root password over SSH (the dashboard authenticates as root against the system password; SSH itself remains key only):

passwd

Then, if your Network Security Group allows inbound 9090 from your address, browse to:

https://<vm-public-ip>:9090/

Log in as root with the password you just set. On first login the dashboard runs a short setup wizard where you assign interface roles (WAN / LAN), configure DNS and enable the security features (firewall zones, threat shield, DPI, VPN) you need. This image ships eth0 as a single DHCP WAN interface suitable for a management or single armed deployment; to use NethSecurity as a routing gateway, attach a second Azure network interface for the LAN side and assign it in the wizard.

Step 6: Updating the image

NethSecurity does not ship an unattended update daemon (its automatic updates are a feature of the optional NethSecurity Enterprise subscription, which is inert in this community image). You update in one of two honest ways:

  • Package updates with apk (NethSecurity 8.x uses apk-tools, which replaced opkg): refresh the package index and add available updates.
apk list --installed | wc -l
  • Whole system upgrade with sysupgrade: NethSecurity releases are applied by flashing a newer image with sysupgrade -k, which preserves your /etc/config settings. For a cloud VM the simplest path to a new release is to deploy a newer cloudimg image and migrate your configuration (the dashboard can export and import a full backup).

Subscribe to NethSecurity security advisories and apply updates or re deploy on a schedule that suits your risk posture.

Support

This image is supported 24/7 by cloudimg. For assistance, contact support through the Azure Marketplace listing.