Restrict access to Azure VM and VPN for customers

Question

We want to use Microsoft Azure and want to provide virtual machines for our customers while having a backend for monitoring and Active Directory. Our network will be something like that:

network: 10.0.0.0/23

subnets: 10.0.0.0/24 (backend with monitoring, ...)

10.0.1.0/29 customer1-network (server1 on 10.0.1.4 for customer 1)
10.0.1.8/29 gateway1 (for customer1)

10.0.1.16/29 customer2-network (server2 on 10.0.1.12 for customer 2)
10.0.1.24/29 gateway2 (for customer2)

Customer1 connects its router with gateway1 so they can reach server1 - and ONLY server1. They're not allowed to reach server2 or gateway2 or backend-network directly. Their server1 is vm with windows and needs to reach the backend-network, but not server2 or gateway2. The customer has no access to Remote Desktop, only to port 443 and 5499 on server1.

So the questions are:

1. Can I bind gateway1 to customer1-network?
2. Is there any method to rescrict access between customers?
3. Is there a method provided to use NAT instead of announcing the internal networks?
   For example: Customer1 connects via VPN to gateway1 and only gets the internet address (1.2.3.4) and not the internal network 10.0.1.0/29. So server1 can be reached via VPN on 1.2.3.4:443 and 1.2.3.4:5499.

The only route related thing I found is this site: https://azure.microsoft.com/en-us/documentation/articles/virtual-networks-udr-how-to/
But nothing related to restricting access/VPN :(

Answer 1

For granular restrictions like this you gonna need to create Network Security Groups (NSG). All the configuration is done through PowerShell, but it's kinda self-explanatory if you have any experience configuring firewalls using the console.

What is a Network Security Group (NSG)

https://azure.microsoft.com/en-us/documentation/articles/virtual-networks-nsg/

Basically, all you need is to block everything and then open only connections between the backend and gateway.

# Create NSG for Subnet1
New-AzureNetworkSecurityGroup -Name "myNSG1" -Location "East US"

# Deny entire Vnet
Get-AzureNetworkSecurityGroup -Name "myNSG1" | Set-AzureNetworkSecurityRule -Name "DENY VNET" -Type Inbound -Priority 1000 -Action Deny -SourceAddressPrefix 'VIRTUAL_NETWORK' -SourcePortRange '*' -DestinationAddressPrefix 'VIRTUAL_NETWORK' -DestinationPortRange '*' -Protocol *

# Allow Backend Vnet
Get-AzureNetworkSecurityGroup -Name "myNSG1" | Set-AzureNetworkSecurityRule -Name "ALLOW BACKEND" -Type Inbound -Priority 999 -Action Allow -SourceAddressPrefix '10.0.0.0/24' -SourcePortRange '*' -DestinationAddressPrefix 'VIRTUAL_NETWORK' -DestinationPortRange '*' -Protocol *

# Allow VMs in the same VNet to communicate
Get-AzureNetworkSecurityGroup -Name "myNSG1" | Set-AzureNetworkSecurityRule -Name "ALLOW SELF" -Type Inbound -Priority 998 -Action Allow -SourceAddressPrefix '10.0.1.0/29' -SourcePortRange '*' -DestinationAddressPrefix 'VIRTUAL_NETWORK' -DestinationPortRange '*' -Protocol *

# Allow Gateway
Get-AzureNetworkSecurityGroup -Name "myNSG1" | Set-AzureNetworkSecurityRule -Name "ALLOW GW" -Type Inbound -Priority 997 -Action Allow -SourceAddressPrefix '10.0.1.8/29' -SourcePortRange '*' -DestinationAddressPrefix 'VIRTUAL_NETWORK' -DestinationPortRange '*' -Protocol *

This is just the basic idea for inbound connections. I didn't test these rules nor completed the setup based in your scenario, but should give you an idea where to start.

You also need to apply it to a subnet or a set of VMs. For subnets:

Get-AzureNetworkSecurityGroup -Name "myNSG1" | Set-AzureNetworkSecurityGroupToSubnet -VirtualNetworkName 'myVnet' -SubnetName 'myVnetSubnet1'