You have an on-premises server named Server1 that runs Windows Server. Server1 contains an app named App1 and a firewall named Firewall1. You have an Azure subscription. Internal users connect to…

Microsoft Application Request Routing (ARR) Version 2 is an IIS module that acts as a reverse proxy, typically requiring inbound ports to be opened on the perimeter firewall for external access.

Azure Application Gateway is a web traffic load balancer and WAF for web applications, primarily used for Azure-hosted applications or requiring inbound access through a public IP, which would necessitate inbound firewall rules for on-premises backends.

Azure Relay's Hybrid Connections allows secure exposure of on-premises services, like those using WebSockets, to the public internet without opening inbound firewall ports. It works by establishing an outbound connection from the on-premises server to Azure Relay, and internet clients then connect to the Relay service, facilitating bidirectional communication over this established outbound tunnel.

Web Application Proxy is an on-premises reverse proxy that publishes internal web applications to the internet, but it still requires inbound ports (typically 443) to be opened on the perimeter firewall to the WAP server.