Share via

Questions about VPN

Marcos Vinicius Silva Reis 100 Reputation points
2023-09-12T02:57:56.05+00:00

I'm in a project and I have a question about which path to follow. I need my user to connect to a VPN to be able to access the internet on their computer, and for the user's exit IP to be a pre-defined fixed IP, for example 189.120 .225.65

I would like to know if it is possible? and if there is technology that makes it easier

I tried to use OpenVPN cloud, I was able to connect but my IP remains the same without the VPN

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,558 questions
Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,509 questions
Azure NAT Gateway
Azure NAT Gateway
NAT Gateway is a fully managed service that securely routes internet traffic from a private virtual network with enterprise-grade performance and low latency.
38 questions
0 comments
Accepted answer
  1. GitaraniSharma-MSFT 49,586 Reputation points Microsoft Employee
    2023-09-12T04:06:14.6666667+00:00

    Hello @Marcos Vinicius Silva Reis ,

    Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

    I understand that you would like to configure your Point to site VPN in a way that users can access Internet via their P2S VPN connection using a specific public IP 189.120 .225.65 instead of their local ISP public IP.

    Azure Point to Site VPN do not have a Public IP. Only the VPN gateway has a Public IP which is used for Site-to-Site VPN connections. Point to Site VPN make use of the configured address pool to allocate an IP address to the connected VPN client or local machine and this is a private IP. So, the Public IP of the clients still remains the ISP Public IP.

    To configure Azure P2S VPN with a single static IP address, you would need to force tunnel the VPN traffic to the VPN gateway and configure Azure Firewall manager to provide Internet connectivity via SNAT.

    However, Internet connectivity is not provided through the VPN gateway. As a result, all traffic bound for the Internet is dropped.

    Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-p2s-advertise-custom-routes#forced-tunneling

    Hence, you need to introduce another resource such as Azure Firewall or a NVA (Network Virtual Appliance) which can take care of the Internet connectivity.

    But there is another limitation on the traditional VPN gateway (when I say traditional VPN gateway, I mean a VPN gateway without vWAN solution, which is deployed directly into a Vnet) as below:

    Traditional VPN gateways do not have the EnableInternetSecurity flag option. This flag is needed and must be set to true for your clients to be properly configured for forced-tunneling/accessing Internet via the VPN gateway.

    Refer: https://learn.microsoft.com/en-us/powershell/module/az.network/set-azvirtualnetworkgateway?view=azps-10.1.0

    The P2S VPN gateway under Virtual WAN Hub has this option. Refer: https://learn.microsoft.com/en-us/powershell/module/az.network/update-azp2svpngateway?view=azps-10.1.0

    So, in order to reach the Internet via Azure P2S VPN gateway, you need to deploy a secured virtual WAN hub with Azure firewall manager and add the P2S VPN Gateway to allow your egress traffic that will be controlled by a firewall policy. Refer: https://learn.microsoft.com/en-us/azure/firewall-manager/secure-cloud-network

    When you secure internet traffic via Azure Firewall (Firewall Manager), you can advertise the 0.0.0.0/0 route or any custom route to your VPN clients. This makes your clients send the internet bound traffic to Azure for inspection. Then, firewall SNATs the packet to the PIP of Azure Firewall for egress to Internet.

    To do this, you need to setup an Azure Firewall & then configure a Policy to allow P2S traffic to Internet.

    You can also use a NVA instead of Azure Firewall as per your requirement.

    To advertise custom route to your VPN clients, refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-p2s-advertise-custom-routes

    You can also add the route directly in your downloaded azurevpnconfig.xml file as below:

    Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/azure-vpn-client-optional-configurations#add-custom-routes

    You can refer the below doc which explains how to configure forced tunneling for Virtual WAN Point-to-site VPN:

    https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-forced-tunnel

    Another reference for you:

    https://learn.microsoft.com/en-us/answers/questions/589858/index.html

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    1 person found this answer helpful.
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.