In Azure, you can create a virtual network with one or more subnets. I created one with a single subnet. Then you can assign VMs to that subnet. But at this point, the vms cant see the world, and the world cant see the VMs.
In order to create a gateway for the vlan to access the internet, I create a firewall. The firewall has a required parameter which is the subnet. But its not possible to assign my virtual network's subnet. you have to create a new one.
This seems crazy - it means the vlan and firewall cannot be connected, as there is no route between them.
If you had a rack with a firewall and some servers, you would simply connnect the internal nic to the switch with the servers, and the enternal nic to the internet, and create some conduits and rules. But in Azure, the FW cannot be on the same network as the virutal network, so there is no route between them, the networks are effectively airgapped unless define a VM to act as a gateway, and can assign in two nics, one on the FW subnet and one on the vlan subnet, but this is a lot more work and cost.
Is there an easy way to do this?
Presumably I could create a vm just to act as a gateway, give it two virtual nics, give it a public ip, and the internal nic using the vlan, then make this server the gateway for the other servers, and install ipchains on it, but it seems a waste to use a VM as a firewall/gateway rather than a service? Or is it he easiest way to get a virtual network onto the internet with some basic NAtting?