Third-party VPN inside Azure Virtual Desktop

Question

Third-party VPN inside Azure Virtual Desktop

Martin Garrix 30

Hi, I have an Azure Virtual Desktop session and installed PureVPN onto it. Issue: Unable to connect to dedicated IP (Singapore). Error code from PureVPN: 5040 Methods tried:

Switching protocols inside PureVPN for the connection but it only allows IKEv2
Disable firewall on the virtual desktop but still unable to connect
Reinstalled with latest version of PureVPN

Another detail is that I also tried with Ivacy VPN and also couldn't connect to the dedicated server.

Sedat SALMAN 14,180 Reputation points MVP

2023-04-11T12:02:49.6333333+00:00
It's possible that the issue you're facing with connecting to the VPN inside your Azure Virtual Desktop session is related to network restrictions or limitations on the Azure Virtual Network (VNet) side. Here are some steps to troubleshoot and potentially resolve the problem:

Check the Network Security Group (NSG) rules: Ensure that the required ports and protocols are allowed in the NSG rules for both inbound and outbound traffic. VPN connections may require specific ports (such as 500, 4500, or others) to be opened depending on the VPN protocol being used.

Verify Virtual Network Gateway settings: If your Azure Virtual Desktop is connected to a Virtual Network Gateway, make sure that the required VPN protocols are enabled on the gateway.

Review your VPN client configuration: Check the settings in your PureVPN client to ensure they are correct and compatible with the Azure environment.

Test connectivity without a dedicated IP: Try connecting to a non-dedicated IP address on the VPN service to determine if the issue is specific to the dedicated IP.

Contact PureVPN support: Reach out to PureVPN's customer support team to inquire about any known issues, compatibility concerns, or additional troubleshooting steps when using their VPN service within an Azure Virtual Desktop environment.

Consider using Azure VPN Gateway: If you continue to face issues with third-party VPN solutions, you might want to explore using Azure VPN Gateway, which is designed to work seamlessly with Azure Virtual Network.

If none of these solutions work, it's possible that there may be an issue with the VPN service or compatibility between the VPN client and the Azure Virtual Desktop environment. You may need to explore alternative VPN solutions or consult with Microsoft Azure Support for further assistance.
KarishmaTiwari-MSFT 20,777 Reputation points Microsoft Employee Moderator

2023-04-12T16:30:29.13+00:00

@Martin Garrix In general, using 3rd party VPNs can get a bit complex.
You need to configure a split tunnel to maintain connection of the VM to the fabric as well as the AVD Service endpoints. Please don’t disable the windows firewall as it can break many things.
Martin Garrix 30 Reputation points

2023-04-13T09:38:52.8966667+00:00

Thank you @Sedat SALMAN and @KarishmaTiwari-MSFT Is there any documentation regarding to the split tunnel you mentioned ?
KarishmaTiwari-MSFT 20,777 Reputation points Microsoft Employee Moderator

2023-04-19T01:59:37.1566667+00:00

@Martin Garrix Please refer to this:
https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm#split-tunneling-configuration-overview

1 answer

Your answer

Sedat SALMAN 14,180 Reputation points MVP

2023-04-11T12:02:49.6333333+00:00

It's possible that the issue you're facing with connecting to the VPN inside your Azure Virtual Desktop session is related to network restrictions or limitations on the Azure Virtual Network (VNet) side. Here are some steps to troubleshoot and potentially resolve the problem:

Check the Network Security Group (NSG) rules: Ensure that the required ports and protocols are allowed in the NSG rules for both inbound and outbound traffic. VPN connections may require specific ports (such as 500, 4500, or others) to be opened depending on the VPN protocol being used.

Verify Virtual Network Gateway settings: If your Azure Virtual Desktop is connected to a Virtual Network Gateway, make sure that the required VPN protocols are enabled on the gateway.

Review your VPN client configuration: Check the settings in your PureVPN client to ensure they are correct and compatible with the Azure environment.

Test connectivity without a dedicated IP: Try connecting to a non-dedicated IP address on the VPN service to determine if the issue is specific to the dedicated IP.

Contact PureVPN support: Reach out to PureVPN's customer support team to inquire about any known issues, compatibility concerns, or additional troubleshooting steps when using their VPN service within an Azure Virtual Desktop environment.

Consider using Azure VPN Gateway: If you continue to face issues with third-party VPN solutions, you might want to explore using Azure VPN Gateway, which is designed to work seamlessly with Azure Virtual Network.

If none of these solutions work, it's possible that there may be an issue with the VPN service or compatibility between the VPN client and the Azure Virtual Desktop environment. You may need to explore alternative VPN solutions or consult with Microsoft Azure Support for further assistance.
KarishmaTiwari-MSFT 20,777 Reputation points Microsoft Employee Moderator

2023-04-12T16:30:29.13+00:00

@Martin Garrix In general, using 3rd party VPNs can get a bit complex.
You need to configure a split tunnel to maintain connection of the VM to the fabric as well as the AVD Service endpoints. Please don’t disable the windows firewall as it can break many things.
Martin Garrix 30 Reputation points

2023-04-13T09:38:52.8966667+00:00

Thank you @Sedat SALMAN and @KarishmaTiwari-MSFT Is there any documentation regarding to the split tunnel you mentioned ?
KarishmaTiwari-MSFT 20,777 Reputation points Microsoft Employee Moderator

2023-04-19T01:59:37.1566667+00:00

@Martin Garrix Please refer to this:
https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm#split-tunneling-configuration-overview

Answer 1

@Martin Garrix I have summarized our conversation in the comments above, in this answer for clarity and for others to reference.

Q: Guidance regarding using 3rd Party VPN with Azure Virtual Desktop.

A: In general, using 3rd party VPNs can get a bit complex.
You need to configure a split tunnel to maintain connection of the VM to the fabric as well as the AVD Service endpoints. Please don’t disable the windows firewall as it can break many things.

Q: Is there any documentation regarding the split tunnel path suggested above?

A: You can use this as a starting point, it also applies for AVD: Optimizing RDP Connectivity for Windows 365 - Microsoft Community Hub

Also, it is advised to have these URLs excluded from the VPN: https://learn.microsoft.com/en-us/azure/virtual-desktop/safe-url-list?tabs=azure#session-host-virtual-machines

If you have any questions at all, let me know in the "comments". Comment is the fastest way of notifying the experts.

If this answer helped or steered you in the right direction, don't forget to 'Accept answer' and hit 'Yes' to 'was this ans helpful', wherever the information provided helps you, as this can be beneficial to other community members for remediation of similar issues.

Share via

Third-party VPN inside Azure Virtual Desktop

1 answer

Your answer