How to use Azure VPN with Azure NAT Gateway and route all P2S VPN traffic

Question

Hello everyone,

Is it possible to use Azure VPN with Azure NAT Gateway and route all P2S VPN traffic through a NAT Gateway connected to this VPN?

I connected Azure NAT Gateway to the Virtual Network,

• in the p2s VPN connection settings I specified to route all traffic through the VPN tunnel, announcing routes 0.0.0.0/1,128.0.0.0/1,
• changed the connection configuration of the Azure VPN client to version 2   to force tunneling all traffic.

But all this was unsuccessful - traffic could not be routed through the remote gateway and I don't have internet connectivity when using VPN.

Thank you for your help. I spent ages trying to figure out why VPN doesn't work like VPN for all connections.  

Answer 1

@Oles Samolevsky ,

To answer your question,

"Is it possible to use Azure VPN with Azure NAT Gateway and route all P2S VPN traffic through a NAT Gateway connected to this VPN?"

• No
• This is not possible.

Summary:

#Point1

• See : Forced tunneling
• Internet connectivity is not provided through the VPN gateway. As a result, all traffic bound for the Internet is dropped.
• This means, VPN Gateway as a stand alone resource cannot provide you with internet connectivity.

#Point2

• You cannot combine NAT Gateway and Azure VPN because NAT Gateway cannot be attached to gateway subnet where the VPN resides.
• See : FAQ | Can a NAT gateway be attached to a gateway subnet?
  • 

What you can do is,

Consider deploying a NVA or Azure Firewall on the VNET and route all traffic to the Firewall from the VPN Gateway.

• You should advertise additional custom routes 0.0.0.0/1 and 128.0.0.0/1 to the P2S Clients.
• On the GatewaySubnet, attach a UDR with routes 0.0.0.0/1 and 128.0.0.0/1 pointing to the nextHop as the NVA's/Azure Fierwall's IP Address
• Now, this Firewall will provide you with Internet connectivity

I would suggest you instead consider using Virtual WAN Hub routing intent with Internet Traffic Routing Policy

• 

Hope this helps.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

---

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.