Currently, Azure does not allow for SQL Databases to be accessed through a Service Endpoint over a VPN Gateway. My idea to circumvent this limitation is to set up an Azure VM to function as a proxy so that all communication with the SQL Database happens through this instance (whose traffic to and from the SQL Database can then be routed over a Service Endpoint). However, I have been unable to get this solution working and could use some guidance.
I have an AWS environment set up with VPN connectivity established to my Azure environment. I have a Private Hosted Zone set up using Route53 to resolve the domain name of my SQL Database to the public IP address of the corresponding Microsoft.Sql regional endpoint (this is the IP address the domain name of my SQL Database resolves to when I access the SQL Database from my proxy VM). My route table is configured to forward traffic to this IP address through my Virtual Private Gateway.
On the Azure side, I have the route table of my gateway subnet configured to forward traffic destined for the Microsoft.Sql regional endpoint public IP address to my proxy VM as if it were a virtual appliance. The network interface of the proxy VM is set to allow IP Forwarding. The route table attached to the subnet of the proxy VM is configured to route traffic destined for the private CIDR of my AWS VPC back through the VPN Gateway.
For simplicity, the security groups in both the AWS and Azure environments are set to allow all inbound and outbound traffic between the private IP addresses of both environments and the Microsoft.Sql regional endpoint public IP address.
What currently works:
My EC2 instance in the AWS VPC can ping and ssh into my proxy VM over the VPN using its private IP address. The proxy VM can access my SQL Database over the Service Endpoint using its private IP address.
What doesn't work:
I can not successfully ping or ssh into the proxy VM from my EC2 instance by attempting to connect to the Microsoft.Sql regional public IP address (the one I've configured to be forwarded to the proxy VM) nor the domain name of my SQL Database (the record I set up in Route53 for the Microsoft.Sql regional public IP address). When I perform a packet capture on the proxy VM, I see no inbound traffic from my EC2 instance. The traffic shoes up as accepted in my VPC flow logs.
I understand that this is what SQL Database Managed Instances are for, however I don't have the option of using that service.
I currently have not configured any forwarding with iptables nor done any special host setup on the proxy VM, as I first wanted to see the network traffic show up in the packet capture and then verify that I can successfully connect to the proxy VM instance before attempting to set up any kind of forwarding to the SQL Database.
Moreover, is this type of solution to circumvent the limitations of Service Endpoints in Azure even possible? Is there a simpler method?
Thanks and best wishes.