I have setup a VPN Site-to-Site IPSec connection from on-premis ( to my new Azure virtual network ( The connection is setup with an Azure virtual gateway associated with my Vnet.

I have added a network security group as a "firewall" with ACLs on top of my Azure Vnet to be able secure it.

The ACLs are capturing "internet traffic" against the virtual machines public IP-addresses inside the Vnet, as it should. But traffic over the VPN connection to the same machines but on their private IP-addresses is not captured. How do I restrict incomming traffic over the VPN connection to my Azure Vnet?


NSG's contain some default rules when you create them, one of which is to allow all traffic from the virtual network, your VPN traffic is effectively coming from the Gateway subnet, and so counts as on the VNET and is allowed. If you wish to block it you will need to implement some rules with a higher priority than the default (65000). See this document for more details on the default rules.


As Sam said, we can set the NSG to deny or allow the incomming traffic:
enter image description here

  • I'm not sure this will do what he wants, the traffic he wants to block is coming over the VPN, so it's from the Gateway subnet and so comes under the VirtualNetwork tag, not the Internet one. He would need to either block all traffic coming from the VirtualNetwork tag (which would block all VNet traffic outside the scope of the rule) or setup a rule using specific ranges to block traffic from the VPN. – Sam Cogan Jan 6 '17 at 10:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.