In Azure, you can create a virtual network with one or more subnets. I created one with a single subnet. Then you can assign VMs to that subnet. But at this point, the vms cant see the world, and the world cant see the VMs.

In order to create a gateway for the vlan to access the internet, I create a firewall. The firewall has a required parameter which is the subnet. But its not possible to assign my virtual network's subnet. you have to create a new one.

This seems crazy - it means the vlan and firewall cannot be connected, as there is no route between them.

If you had a rack with a firewall and some servers, you would simply connnect the internal nic to the switch with the servers, and the enternal nic to the internet, and create some conduits and rules. But in Azure, the FW cannot be on the same network as the virutal network, so there is no route between them, the networks are effectively airgapped unless define a VM to act as a gateway, and can assign in two nics, one on the FW subnet and one on the vlan subnet, but this is a lot more work and cost.

Is there an easy way to do this?

Presumably I could create a vm just to act as a gateway, give it two virtual nics, give it a public ip, and the internal nic using the vlan, then make this server the gateway for the other servers, and install ipchains on it, but it seems a waste to use a VM as a firewall/gateway rather than a service? Or is it he easiest way to get a virtual network onto the internet with some basic NAtting?


There are a few issues with your thinking here:

  1. You don't need a firewall to be able access the internet. All Azure VM's have outbound access to the internet by default, unless you block it using NSG's. Adding an Azure Firewall is an expensive waste if all you want is internet access
  2. The subnet you are selecting when deploying an Azure Firewall is just the subnet that the Firewall is going to sit in, which needs to be empty (the subnet, not the network), this has little bearing on the resources that can use the firewall. All resources that are on the same virtual network, but different subnets can use the firewall just by adding a route to send outbound traffic that way. For resources on other virtual networks the networks can be peered to the one containing the firewall and a route created.
| improve this answer | |
  • Thanks! How do you add routes between subnets? This is the piece I am missing. If I dont have a firewall or assign ips, how can I access the servers? Its not very useful them being able to see the internet, if I cant ssh into them? Unfortunately, the service I am trying to run is a suite of jmeter servers, and they have to be on an IP or range I whitelist in the target non-public webserver. This means I have to create real public IPs by hand for each server, or use something like a FW to do SNAT with a fixed IP I can whitelist. Any suggestions? – eos Jul 6 at 21:21
  • Using an Azure Firewall just for inbound NAT translation is a waste of money. If you need all the functionality of the Firewall then that is fine, but if that is all you need look at some other options. You can use an Azure Load Balancer to do inbound NAT, or you can use Azure Bastion as a jump box solution to get to all the internal services – Sam Cogan Jul 6 at 21:23
  • Port forwarding with Load balancer - docs.microsoft.com/en-us/azure/load-balancer/…, Azure Bastion - docs.microsoft.com/en-gb/azure/bastion/… – Sam Cogan Jul 6 at 21:24
  • bastion looks interesting, but it appears to be ssh within a web browser, and not ssh on my local machine. This is presumably ok for typing in commands, but means I cant do things like SFTP or get files on/off the vms to my local machine. For jmeter, I need to get jmx files onto the box, and get log files off the box – eos Jul 6 at 21:29
  • Correct, bastion is browser based. If you need to access using a desktop client then you either need NAT translation using Load Balancer or Firewall, or a public IP on each box (not recommended). If you do still want to go down the FW path then the steps to add a route are here - docs.microsoft.com/en-us/azure/firewall/… – Sam Cogan Jul 6 at 21:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.