In our Azure landscape we have a couple of VMs. For one of those we have the requirement that it needs to have a DNS name to be able to access it. We had some trouble with private DNS zones in the past so instead we opted to bind a public IP to the machine which would give us a free (.cloudapp.azure.com) DNS.
This VM should not be available from the internet, so we added a NSG on the subnet it lives in which blocks outside traffic but allows virtual network traffic.
On a different, paired, vnet we have a VPN gateway which I can use to access the environment and its internal resources. Now what I'm seeing is that I cannot use the DNS name of this machine to connect to it, unless I open up that previously mentioned NSG to allow all traffic. At first I thought: makes sense, the traffic is routed to the public IP to its seen as "outside" traffic even though I've got the VPN up and running. So I added a local route (route add ...) directing the traffic to the public IP to my VPN gateway address. My reasoning: traffic is now directed over the VPN so from there on Azures internal routing will ensure that the traffic is seen as virtual network traffic and all will be well.
Sufficient to say: this does not work. But I can't seem to figure out why it doesn't, and that's what I would like to know. If there's any other ways to fulfill the requirements that would be OK as well (minus the private DNS option, which doesn't work for VPN either I believe).