We want to use Microsoft Azure and want to provide virtual machines for our customers while having a backend for monitoring and Active Directory. Our network will be something like that:


subnets: (backend with monitoring, ...) customer1-network (server1 on for customer 1) gateway1 (for customer1) customer2-network (server2 on for customer 2) gateway2 (for customer2)

Customer1 connects its router with gateway1 so they can reach server1 - and ONLY server1. They're not allowed to reach server2 or gateway2 or backend-network directly. Their server1 is vm with windows and needs to reach the backend-network, but not server2 or gateway2. The customer has no access to Remote Desktop, only to port 443 and 5499 on server1.

So the questions are:

  1. Can I bind gateway1 to customer1-network?
  2. Is there any method to rescrict access between customers?
  3. Is there a method provided to use NAT instead of announcing the internal networks?
    For example: Customer1 connects via VPN to gateway1 and only gets the internet address ( and not the internal network So server1 can be reached via VPN on and

The only route related thing I found is this site: https://azure.microsoft.com/en-us/documentation/articles/virtual-networks-udr-how-to/
But nothing related to restricting access/VPN :(


For granular restrictions like this you gonna need to create Network Security Groups (NSG). All the configuration is done through PowerShell, but it's kinda self-explanatory if you have any experience configuring firewalls using the console.

What is a Network Security Group (NSG)


Basically, all you need is to block everything and then open only connections between the backend and gateway.

# Create NSG for Subnet1
New-AzureNetworkSecurityGroup -Name "myNSG1" -Location "East US"

# Deny entire Vnet
Get-AzureNetworkSecurityGroup -Name "myNSG1" | Set-AzureNetworkSecurityRule -Name "DENY VNET" -Type Inbound -Priority 1000 -Action Deny -SourceAddressPrefix 'VIRTUAL_NETWORK' -SourcePortRange '*' -DestinationAddressPrefix 'VIRTUAL_NETWORK' -DestinationPortRange '*' -Protocol *

# Allow Backend Vnet
Get-AzureNetworkSecurityGroup -Name "myNSG1" | Set-AzureNetworkSecurityRule -Name "ALLOW BACKEND" -Type Inbound -Priority 999 -Action Allow -SourceAddressPrefix '' -SourcePortRange '*' -DestinationAddressPrefix 'VIRTUAL_NETWORK' -DestinationPortRange '*' -Protocol *

# Allow VMs in the same VNet to communicate
Get-AzureNetworkSecurityGroup -Name "myNSG1" | Set-AzureNetworkSecurityRule -Name "ALLOW SELF" -Type Inbound -Priority 998 -Action Allow -SourceAddressPrefix '' -SourcePortRange '*' -DestinationAddressPrefix 'VIRTUAL_NETWORK' -DestinationPortRange '*' -Protocol *

# Allow Gateway
Get-AzureNetworkSecurityGroup -Name "myNSG1" | Set-AzureNetworkSecurityRule -Name "ALLOW GW" -Type Inbound -Priority 997 -Action Allow -SourceAddressPrefix '' -SourcePortRange '*' -DestinationAddressPrefix 'VIRTUAL_NETWORK' -DestinationPortRange '*' -Protocol *

This is just the basic idea for inbound connections. I didn't test these rules nor completed the setup based in your scenario, but should give you an idea where to start.

You also need to apply it to a subnet or a set of VMs. For subnets:

Get-AzureNetworkSecurityGroup -Name "myNSG1" | Set-AzureNetworkSecurityGroupToSubnet -VirtualNetworkName 'myVnet' -SubnetName 'myVnetSubnet1'
  • Tanks a lot, I really didn't know that there's a documentation describing features like that. I'll take a look at it. – TheRealBecks Sep 24 '15 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.