Is there a VPN solution in Azure that can assign a static public IP to the clients connected for me to achieve full tunnelling? may be in P2S VPN?

Question

Is there a VPN solution in Azure that can assign a static public IP to the clients connected for me to achieve full tunnelling? may be in P2S VPN?

P2S VPN does not have full tunneling. Is there any other alternate solution?

Answer 1

• No, you can’t assign a static public IP address to the clients for a VPN solution in Azure as the client address pool that needs to be defined while deploying a VPN gateway in Azure is a subnet of the IP address spaces that the virtual network is created out of.

But you can configure forced tunnelling in your Azure virtual network on your VPN gateway subnets as illustrated below. In the below image, forced tunnelling is shown for Site-to-Site VPN scenario but it can also be implemented for Point-to-Site VPN scenarios in the same way. The Frontend subnet is not force tunneled. The workloads in the Frontend subnet can continue to accept and respond to customer requests from the Internet directly. The Mid-tier and Backend subnets are forced tunneled. Any outbound connections from these two subnets to the Internet will be forced or redirected back to an on-premises site via one of the Site-to-site (S2S) VPN tunnels as shown below.

This allows you to restrict and inspect Internet access from your virtual machines or cloud services in Azure, while continuing to enable your multi-tier service architecture required. If there are no Internet-facing workloads in your virtual networks, you also can apply forced tunneling to the entire virtual networks.: -

• Also, please note that you can *configure the above for your P2S clients by securing the Internet traffic via Firewall Manager and advertising the 0.0.0.0/0 route to your VPN clients. This makes your clients send all internet bound traffic to Azure for inspection. Then, firewall SNATs the packet to the PIP of Azure Firewall for egress to Internet. For this purpose, setup the Azure Firewall Policy to allow P2S traffic to Internet and to advertise all the traffic from 0.0.0.0/0 to your VPN clients, you would need to break them into two smaller subnets 0.0.0.0/1 and 128.0.0.0/1 as mentioned in the below documentation: -

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-p2s-advertise-custom-routes#forced-tunneling

Also, you can add the code below in your ‘azurevpnconfig.xml’ file that can be directly downloaded from the templates section if the above said subnets cannot be added in ‘Default Routes’ on the portal.

 <clientconfig>
  <includeroutes>
   <route>
     <destination>0.0.0.0</destination><mask>1</mask>
   </route>
   <route>
     <destination>128.0.0.0</destination><mask>1</mask>
   </route>
 </includeroutes>
 </clientconfig>

Answer 2

Then, firewall SNATs the packet to the PIP of Azure Firewall for egress to Internet. For this purpose, setup the Azure Firewall Policy to allow P2S traffic to Internet and to advertise all the traffic from 0.0.0.0/0 to your VPN clients

Could you provide further details on this? It appears to be a multi-step process to configure the P2S connection, enabling VPN-connected clients to direct outbound traffic through either the static IP address or the FW PIP.