How to access both VM and blob storage account securely without using Public IPs from the internet

Question

We have a specific requirement where a VM and a blob storage account reside on the same VNet, and both have private IPs. Now, we want to access both of them from the internet using the same solution, such as a public load balancer or P2S VPN. We can't afford to have different solutions to access the VM and storage account. When I mention the internet, there are two aspects to consider: the first is a user's computer from which they will SSH into the VM to copy a file from the storage account present on the same VNet and then parse that file. The second aspect is our application deployed on a k8s cluster running on-premises, which uploads the logs to the blob storage account.

Answer 1

@Jayashankara D M ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I am afraid your statement is misleading when you say "blob storage account reside on the same VNet".

• A storage account cannot reside on a VNET
• Are you talking about Private EndPoint (PE) of the Storage Account residing in the same VNET as the VM?

I shall take it that you are using PE and frame my answer. If my assumption is incorrect, please do let me know.

• If you want remote users to connect to your VM and PE in a VNET, you should consider using a P2S VPN only.
• If you want your OnPrem network to connect to the VNET (VM and PE in the VNET), you should consider using a S2S VPN.
  • This means, your OnPrem should be capable of connecting to the Azure VPN gateway using a VPN Device of it's own
  • You can get a list of Validated VPN devices and device configuration guides here
• A single VPN Gateway resource in VNET is capable of creating both a P2S Connection and S2S Connection
  • See : VPN Gateway SKUs

Since you have a mix of OnPrem network and remote users, you can deploy both.

With S2S and P2S, you should also take care of the DNS part,

For P2S,

• It is mandatory that you use a custom DNS Server located in the Azure VNET or Private DNS Resolver
• In the P2S VPN Client configuration file, you should
  • Add DNS suffixes as ".blob.core.windows.net"
  • Add custom DNS servers as the IP of the custom DNS server in Azure
• This will make sure all DNS traffic for "blob.core.windows.net" goes to Azure and you will get the correct IP Address resolved (of PE)

For S2S,

• You can have your own DNS server at hardcode the value of the PE IP in the zone "blob.core.windows.net"
  • This means no need for a custom DNS Server in the Azure VNET
• Or you can create a Forward lookup zone for "blob.core.windows.net" and send the DNS query to the custom DNS Server in the Azure VNET

This diagram might come in handy,

• 
• Steps 1-6 is DNS resolution
• Step 7 is connecting to PE

Cheers,

Kapil