0

I am currently struggling with Azure Virtual Network Peerings.

Setup:

az network vnet create --location "westeurope" --name "someEUvnet01" --resource-group "someRG01" --address-prefix 10.0.0.0/16 --subnet-name "someEUvnet01subnet01" --subnet-prefix 10.0.0.0/24
az network vnet create --location "northcentralus" --name "someNAvnet01" --resource-group "someRG01" --address-prefix 10.1.0.0/16 --subnet-name "someEUvnet01subnet01" --subnet-prefix 10.1.0.0/24
az network vnet peering create --name "someEU1NA1" --resource-group "someRG01" --remote-vnet "someNAvnet01" --vnet-name "someEUvnet01" --allow-vnet-access
az network vnet peering create --name "someNA1EU1" --resource-group "someRG01" --remote-vnet "someEUvnet01" --vnet-name "someNAvnet01" --allow-vnet-access

My problem is the fact that when I remove the allow-vnet-access parameter, the inter-vnet traffic stops completely.

When adding it - as I did the traffic is possible - but due to the default rule, that is added to the Network Security Group by default: https://docs.microsoft.com/de-de/azure/virtual-network/network-security-groups-overview#inbound

which contains VirtualNetwork as Source and Destination with ALLOW by default (unable to change that rule) - ALL of the traffic between the VNETs is open...

I can workaround this issue by defining a Rule, that is preventing any traffic (FROM * TO * ON PROTOCOL * PORT * DENY), but this would prevent access from AzureLoadBalancers too.

This can then be avoided by writing a rule that allows this dedicated access to the Instances (FROM "AzureLoadBalancer" TO * ON PROTOCOL * PORT * ALLOW) but this would be not necessary at all when the default rule would not ALLOW any traffic - from any Virtual network...

Did I miss something?!

Cheers, Matthias

New contributor
Matthias R. Wiora is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

Matthias R. Wiora is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.