NAT Gateway for Managed VNet IR

Question

How can I make Azure Managed VNet IR to make requests through a static public I.P?

I want to pull data from 'xyz.com/books' api. This API provider doesn't allow requests from everyone. They only allow requests from IPs which are whitelisted. I have created a pipeline in data factory and I am trying to pull data from this API. To get this data I want to give this 3rd party API provider some public ip that they can whitelist. I don't want to manage VMs. So, I prefer not to use it. I prefer whatever requests this Azure provided IR does goes through a single whitelisted public ip (which I will give to 3rd party). So, I can get the data

I don't want to create and manage VM's and neither I want to whitelist entire microsoft range of public ips.

Any Solutions ?

Answer 1

Hi Amrale, Siddhesh,

I understand that NAT Gateway essentially allows you to do Network Address Translation for any Virtual Networks or Subnets in your Azure Infrastructure. You can deploy the NAT Gateway, then configure it with a Public IP Address or a Public IP Prefix, and link it to your Subnet. However, even with a NAT Gateway, you cannot link Azure Integration Runtimes to a Public IP Address.

Try the below workaround :

1. Deploy Azure VM
   • Create one Azure VM per Data Factory (for three environments).
   • Place each VM in a subnet with restrictive Network Security Group (NSG) rules to limit internet access.
2. Configure NAT Gateway
   • Deploy a NAT Gateway with a single public IP address (instead of a public IP address prefix).
   • Link the subnet to the NAT Gateway.
3. Set Up Integration Runtime
   • Install the self hosted Integration Runtime package on the VM.
   • Create the Integration Runtime in the ADF portal.
   • Use the generated authentication key to link the Integration Runtime software on the VM with the Integration Runtime in ADF.
4. Verify Public IP Address
   • Run an API query from an ADF pipeline (e.g., using IPify) to check the public IP address.
   • Open a webpage on the VM and visit a public IP lookup site to confirm the NAT Gateway-assigned IP address.
   Note: You need all your ADF Pipelines to run on the Shared Integration Runtime you deploy in order for this to work.

Kindly check the following article to get more details on the implementation: https://medium.com/@petrutbelingher/exposing-azure-data-factory-through-controllable-ip-addresses-eac20eb07adb

Unfortunately, you cant get one static public IP address without creating VM and hosting IR there.

Hope it helps. Kindly accept the answer by clicking on Accept answer button . Thankyou

Answer 2

Hi ,

Thanks for reaching out to Microsoft Q&A.

Your issue is that adf's managed VNet IR does not natively support routing outbound traffic through a NAT Gateway. Instead, Managed VNet IR uses a set of Microsoft-managed outbound IPs that can dynamically change.

Probable Options to try:

1. Use Azure Firewall with NAT Rule (Recommended)

Since Managed VNet IR cannot directly use a NAT Gateway, the best approach is to introduce Azure Firewall in your Virtual Network. You can configure Azure Firewall to have a static public IP and use NAT rules to route outbound traffic through this static IP.

Steps to Implement:

1. Deploy Azure Firewall in the same VNet as your Managed VNet IR.
2. Assign a static public IP (ex: 20.75.234.9) to the firewall.
3. Configure a UDR (User-Defined Route) on the subnet where the Managed VNet IR is deployed:
   • Set the next hop to Azure Firewall for outbound traffic.
   1. Create NAT Rules in Azure Firewall to translate outbound traffic to your static public IP.
   2. Whitelist the static public IP (20.75.234.9) in your Function App.

This setup ensures that all outbound requests from the Managed VNet IR go through Azure Firewall and appear from your static IP.

---

2. Use a Selfhosted Integration Runtime

If you want to avoid an Azure Firewall setup, an alternative is to deploy a SHIR inside an Azure VM with a NAT Gateway. However, since you do not want to manage VMs, this might not be ideal.

---

Why NAT gateway Alone dont work?

Managed VNet IR traffic does not use your NAT Gateway for outbound internet requests. Instead, it uses Microsoft's predefined IP ranges, which are not customizable. This is why your Function App sees requests coming from an unexpected IP.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.