0

I try to setup custom NVA (simple router with application specific functions) for my azure VNET.

My network:

internet <->subnet 1 with NIC1(NVA) <-> subnet 2 with NIC2 (NVA) and VM

I wish to filter in NVA VM traffic to/from internet.

As far as i understand i can use UDR to route outgoing traffic from VM to internet via NVA (and also i set forwarding flag on NVA NICs).. this step work ...

But after that i have problem . my simple NVA just forward packet from one interface to another (its simple router) - > so packet from NIC2 (with src IP of VM, and dst IP of internet service) forwarded to NIC1 and send to subnet 1 with original src IP (with src IP of VM, and dst IP of internet service)... and i cant see any answer from internet service.

So I have questions:

  • can i create working solution for my case (when NVA not using NAT)

  • can somebody tell me why my traffic drop somewhere and i can not see anwer in VM (i understand that traffic must not go thru my NVA, but why i can not see answer?)

  • has Azure roadmap any plan to support source-based routing policy (as linux have) in UDR ?

Aleksey Ryabkov
  • 3
  • 2
  • Hi Aleksey and welcome to SO. Networking questions are off-topic here and should be asked at https://serverfault.com/ – CSharpRocks Jul 07 '19 at 23:32

1 Answers1

0

When you send the traffic via NVA which is indented to Internet, SNAT is done on NVA so that the return traffic will be received by the NVA and sent back to VM.

This is the general behavior. If you are not using NVA for filtering of traffic and just for monitoring purpose, you can achieve your ask by the new feature called Virtual Network Tap. Using this technique, you can mirror all the traffic which is initiated by the VM to an NVA without using complex UDR and still maintain Source IP as your VM's Public IP address.

Reference: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tap-overview

msrini-MSIT
  • 1,444
  • 1
  • 7
  • 11
  • well i undestand it. could you explain in more detail how traffic send from vm to internet and why traffic from VM (to Internet via NVA) dropped when NVA not using SNAT? – Aleksey Ryabkov Jul 11 '19 at 07:13
  • When you have a UDR in place, the traffic from Source VM to Internet reaches your NVA with Source IP as the Private IP not the public IP. Then NVA forwards the packet to the destination. So, the return traffic will flow to the NVA not the VM. Without UDR, the packet which leaves VM will have Source IP as Public IP and it will work fine. – msrini-MSIT Jul 11 '19 at 08:35