I have setup a VPN Site-to-Site IPSec connection from on-premis (192.168.0.0/24) to my new Azure virtual network (10.1.1.0/24). The connection is setup with an Azure virtual gateway associated with my Vnet.
I have added a network security group as a "firewall" with ACLs on top of my Azure Vnet to be able secure it.
The ACLs are capturing "internet traffic" against the virtual machines public IP-addresses inside the Vnet, as it should. But traffic over the VPN connection to the same machines but on their private IP-addresses is not captured. How do I restrict incomming traffic over the VPN connection to my Azure Vnet?