highFoundationSymptom-first#sql-database#firewall#network#vnet#ip-rule

SQL Database firewall blocking client IP or VNet rule

Client error: Cannot open server. Login failed. Client IP not allowed

Likely source:connectivitysecurityconfiguration

Focused incident mode — strips away everything but this runbook.

Symptoms

  • Client error: Cannot open server. Login failed. Client IP not allowed
  • SQL connection times out despite correct credentials
  • az sql server show shows firewall rules that do not include the client IP

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Current firewall rules

    az sql server firewall-rule list --server <SERVER> --resource-group <RG> --query "[].{name:name,startIp:startIpAddress,endIp:endIpAddress}" -o table

  • VNet rules on the server

    az sql server vnet-rule list --server <SERVER> --resource-group <RG> --query "[].{name:name,vnet:virtualNetworkSubnetId}" -o table

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • Client gets 'Client IP not allowed' error
  • Client IP is outside all rule ranges

Confirm before fixing

az sql server firewall-rule list --server <SERVER> --resource-group <RG> --query "[].{name:name,startIp:startIpAddress,endIp:endIpAddress}" -o table
READ

Review all IP rules

Fix

az sql server firewall-rule create --server <SERVER> --resource-group <RG> --name AllowClientIP --start-ip-address <CLIENT-IP> --end-ip-address <CLIENT-IP>
CHANGE

Add a rule for the client IP

Expected: Successfully created firewall rule.

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
curl -s https://ifconfig.me
READ

Get client IP

2
az sql server firewall-rule list --server <SERVER> --resource-group <RG> --query "[].{name:name,startIp:startIpAddress,endIp:endIpAddress}" -o table
READ

Review firewall rules

3
az sql server firewall-rule create --server <SERVER> --resource-group <RG> --name AllowClientIP --start-ip-address <CLIENT-IP> --end-ip-address <CLIENT-IP>
CHANGE

Add a firewall rule for the client IP

Prevention

  • Use VNet service endpoints instead of IP-based rules for Azure resources.
  • Document firewall rules in source control and audit via Azure Policy.
  • Use Azure Private Link for SQL Database access from on-premises.
  • Set up alerts on firewall rule changes via Azure Monitor activity log.

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.