How to block Public IP access and only allow Private IP access in Virtual Machin through VPN only

Question

Hi,

We have Virtual machine in Azure with public ip and private ip. But we want to block Public IP access, only allow to connect VM with private IP through VPN connection. How to configure on this using nsg (network security group), we don't want to procure and use azure firewall.

Please help, it will be very helpful if you share step by step with details.

Answer 1

Hello Rocky Mondal

Welcome to Microsoft Q&A Platform, thanks for posting your query here.

To block public IP access and allow only private IP access to your Azure virtual machine through VPN, you can configure NSG to achieve this.

-Create a Network Security Group (NSG) and associate it with your Azure virtual machine.

• Navigate to your virtual machine in the Azure portal and click on "Networking" from the left-hand menu.
• Click on "Network security group" and then click on "Create".
• Give a name to the NSG and select the resource group and region where the virtual machine is located.
• Click on "Review + create" and then click on "Create" to create the NSG. Ref: https://learn.microsoft.com/en-us/azure/virtual-network/manage-network-security-group?tabs=network-security-group-portal#create-a-network-security-group

-Add an inbound security rule to the NSG to allow traffic from the VPN Gateway to the virtual machine.

• Navigate to the NSG and click on "Inbound security rules" from the left-hand menu.
• Click on "Add" to add a new rule.
• Give a name to the rule, select "Any" as the source IP address, and select "VirtualNetwork" as the source type.
• Select "Custom" as the service, and then select "TCP" as the protocol type and enter the port number you want to allow.
• Select "Allow" as the action and then click on "Add" to add the rule. Ref: https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic

-Add an outbound security rule to the NSG to allow traffic from the virtual machine to the VPN Gateway.

• Navigate to the NSG and click on "Outbound security rules" from the left-hand menu.
• Click on "Add" to add a new rule.
• Give a name to the rule, select "VirtualNetwork" as the destination type, and select "Any" as the destination IP address.
• Select "Custom" as the service, and then select "TCP" as the protocol type and enter the port number you want to allow.
• Select "Allow" as the action and then click on "Add" to add the rule.

-Configure the VPN Gateway to allow traffic from the virtual network to the internet.

With the above configuration, your Azure virtual machine will only allow connections through VPN and block all public IP addresses. Hope this helps.

If the suggested response helped you resolve your issue, please 'Accept as answer', so that it can help others in the community looking for help on similar topics.

Answer 2

Hi,

Can you remove the Public IP and just use private IP which can be connected via VPN ?

Regards,

Karthik Srinivas