Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
Route traffic from an Azure Container Apps Env (Dedicated) through vnet gateway?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(28.799999999999997, 19%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
awf09j
40
Reputation points
Hi, I have a vnet with two subnets - Subnet A and Subnet B. I've also got a vnet gateway that enables communication between my on-prem data center and a particular address space, within which Subnet A resides. Subnet B is not directly routable from on-prem and is dedicated to my container apps environment. When I make a request from a VM within Subnet A, I am correctly able to resolve the traffic against my on-prem service. However, when I make a request from a container within Subnet B, it is not resolved and eventually times out.
How do I guarantee that traffic from Subnet B is correctly routed through the vnet gateway? I've set up a user defined route/route table that's associated with the subnet and added a rule which should route all requests in the destination CIDR block to the gateway, but it just...doesn't?
Any advice?
Azure VPN Gateway
Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
Azure Container Apps
Azure Container Apps
An Azure service that provides a general-purpose, serverless container platform.
{count} vote
-
MayankBargali-MSFT 70,986 Reputation points Moderator2023-12-04T10:46:20.56+00:00 @awf09j Thanks for reaching out.
As per the document "These connections aren't routed down a VPN."
If you're trying to route outbound traffic from a container in Subnet B through the VNet Gateway to your on-premises network, it's not possible to do so using a user-defined route or route table. Outbound connections from a container in Subnet B use an outbound IP address that is assigned by Azure and may change over time, and these connections are not routed down a VPN.
-
awf09j 40 Reputation points
2023-12-04T17:35:32.5166667+00:00 @MayankBargali-MSFT are you certain? here's an example in the docs of how to route all container apps traffic to a firewall. https://learn.microsoft.com/en-us/azure/container-apps/user-defined-routes#route-all-traffic-to-the-firewall
here's an doc discussing using UDR's. https://learn.microsoft.com/en-us/azure/container-apps/networking?tabs=workload-profiles-env%2Cazure-cli#environment-selection
beyond that, the CIDR block that i'm trying to route is in the private address space. if i choose virtual network gateway rather than virtual appliance, why wouldn't that work?
-
awf09j 40 Reputation points
2023-12-04T17:38:39.3733333+00:00 further, if this isn't the solution...what alternative method is recommended for allowing my container apps environment to communicate with my on-prem network? our security team expects me to use our secure tunnel.
-
MayankBargali-MSFT 70,986 Reputation points Moderator
2023-12-07T03:28:01.3+00:00 @awf09j Thanks for your response. Let me get the reconfirmation and check with networking expert if there is any alternative.
-
awf09j 40 Reputation points
2023-12-12T19:24:53.08+00:00 Sounds good, let me know if you have an update please @MayankBargali-MSFT
-
MayankBargali-MSFT 70,986 Reputation points Moderator
2023-12-15T02:09:46.8366667+00:00 @awf09j Apology for the delay. Once I heard back will keep you posted.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(220.8, 17%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECR%3C/text%3E%3C/svg%3E)
Cristiano Rodrigues 0 Reputation points MVP2024-01-05T19:02:38.87+00:00 Hi @MayankBargali-MSFT , I have the same problem, do you have an estimated answer?
Sign in to comment
Sign in to answer