Route all outcoming traffic from Azure VM via Azure Firewall to on promise

Question

We are utilizing a Hub and Spoke network topology within our Azure environment and are aiming to establish a network architecture that mirrors this setup. Specifically, we have an Azure VM located in a Spoke (subnet) that is paired with the Hub Vnet housing the Azure firewall. The primary purpose of the Azure Firewall is to restrict all internet connections and direct traffic towards the On-premise network. Both the Azure network and the on-premise network are linked through an S2S VPN connection. To define a route for the Azure VM to follow, ensuring it passes through the hub towards the On-premise network and subsequently to the Internet, what steps should be taken?

The goal in the end is (a PoC) that we connect an Azure VM to the Internet exclusively through the On promises network.

Answer 1

@Salem Elaiba ,

I am afraid this won't be possible. Resource specific traffic routing is not possible.

I am not sure how Azure VDI is configured, however, if this is a part of a subnet, then you can still use Azure Route Tables (UDR).

• This is a pretty straight forward process and any other method proposed would only increase the complexity
• You must configure Forced Tunneling only.
• Both on
  • Azure VPN Gateway : https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-tunneling
  • Azure Firewall : https://learn.microsoft.com/en-us/azure/firewall/forced-tunneling#forced-tunneling-configuration
• Once you have done this, all traffic will be routed via Azure Firewall and Azure VPN Gw to your OnPremises.

Before doing this, I would suggest you deploy a testVM in Azure and make sure Forced tunneling is properly configured for this VM.

If this works, then please make the configuration changes in the VDI environment.

Looking at the Networking components and concepts for AVD, this should be supported.

• In a forced-tunneling scenario, all internet-bound traffic that originates on Azure virtual machines (VMs) is routed, or forced, to go through an inspection and auditing appliance. Unauthorized internet access can potentially lead to information disclosure or other types of security breaches without the traffic inspection or audit.
• User-defined routes (UDRs) can be used to override Azure default system routes. You can also use UDRs to add extra routes to a subnet route table.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks, Kapil