1

I have two VNETS (VNET1 and VNET2). VNET1 allows many site2site and point to site connections. VNET2 contains an internal load balancer and a set of VMs for the back end pool of that load balancer. I have successfully setup VNET peering between VNET1 and VNET2 which allows on-premise clients in VNET1 to access the internal load balancer in VNET2 but it also allows them to access the VMs in VNET2 which I want to avoid.

I'm trying to limit on-premise clients connected to VNET1 so they can only see the internal load balancer on VNET2 (not the VMs in the backend pool). I've tried setting up an NSG on the subnet where the VMs reside by creating following rules (note the the load balancer is on a different subnet within VNET2 with no NSG applied to it).

  1. Rule1: Allow LoadBalancer IP to VM subnet (backend VM pool).
  2. Rule2: Deny all other VnetInBound traffic (this overrides the default AllowVnetInBound).

The above rules prevents VNET1 from seeing anything in VNET2 but also prevents sending to the load balancer for some reason. Anyone have any ideas on how this configuration could be implemented?

0

I have successfully setup VNET peering between VNET1 and VNET2 which allows on-premise clients in VNET1 to access the internal load balancer in VNET2 but it also allows them to access the VMs in VNET2 which I want to avoid.

When you access the internal LB reside on Vnet2 from Vnet1, the LB doesn't change source ip address in the data package, it will just change destination ip address (LB ip address) into the specific ip address of VMs which reside on backend pool. That is the function of internal LB, so we should not deny the access to VMs in Vnet2 from clients in Vnet1.

The above rules prevents VNET1 from seeing anything in VNET2 but also prevents sending to the load balancer for some reason. Anyone have any ideas on how this configuration could be implemented?

That is the expected behavior, as i have explained above, we need to add another inbound rule in that NSG to allow the source ip address of clients in Vnet1, or allow source any. As for the port, you can add some specific ports in that rule.

  • Thanks for the response and I think I understand. I believe what you are essentially saying is that any client that I want to have access to the internal load balancer must also have direct access to the VMs in the backend pool of that load balancer which prevents me from achieving my goal of only allowing access to the internal load balancer. Is that correct? – Stephen Schleicher Jun 16 '18 at 16:27
  • If the internal load balancer was located in VNET1 and allowed me to create a back end pool from VMs in VNET2, it would work because then I could turn off gateway transit which would restrict on-premise clients to stay in VNET1. I believe, however, that internal load balancers must target VMs in the same VNET if I understand the documentation correctly (even if the VNETs are peered). – Stephen Schleicher Jun 16 '18 at 20:47
  • @StephenSchleicher, Yes your understanding is fully correct. If my answer above is helpful, please accept it for helping others clarify these similar questions. Thanks. – Nancy Xiong Jun 17 '18 at 3:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.