I have two VNETS (VNET1 and VNET2). VNET1 allows many site2site and point to site connections. VNET2 contains an internal load balancer and a set of VMs for the back end pool of that load balancer. I have successfully setup VNET peering between VNET1 and VNET2 which allows on-premise clients in VNET1 to access the internal load balancer in VNET2 but it also allows them to access the VMs in VNET2 which I want to avoid.
I'm trying to limit on-premise clients connected to VNET1 so they can only see the internal load balancer on VNET2 (not the VMs in the backend pool). I've tried setting up an NSG on the subnet where the VMs reside by creating following rules (note the the load balancer is on a different subnet within VNET2 with no NSG applied to it).
- Rule1: Allow LoadBalancer IP to VM subnet (backend VM pool).
- Rule2: Deny all other VnetInBound traffic (this overrides the default AllowVnetInBound).
The above rules prevents VNET1 from seeing anything in VNET2 but also prevents sending to the load balancer for some reason. Anyone have any ideas on how this configuration could be implemented?