We recommend that you use a firewall device to help secure Microsoft Azure Stack Hub. Although firewalls can help with distributed denial-of-service (DDOS) attacks, intrusion detection, and content inspection, they can become a throughput bottleneck for Azure storage services, such as BLOBs, tables, and queues.
For information about how to plan for firewall integration, see Publish Azure Stack Hub services in your datacenter on the Microsoft website. The article lists the inbound and outbound ports and protocols that are required for Azure Stack Hub.