Enabling Internet Access for VNet A via NAT Gateway in VNet B

Question

Enabling Internet Access for VNet A via NAT Gateway in VNet B

Pratima Patil 50

I have two VNets in Azure:

VNet A – where my application resources are deployed.

VNet B – where a NAT Gateway and its Public IP are configured.

I want the resources in VNet A to reach the internet using the public IP of the NAT Gateway in VNet B.

Is this architecture supported by Azure? If yes, what is the recommended setup to achieve this?

VIVEK DWIVEDI 105 Reputation points Microsoft Employee

2025-04-10T14:19:00.66+00:00

Hi @Pratima Patil,

Greetings.
As Praveen mentioned that NAT gateway being a regional resource and local to the VNET cannot be associated to more than one VNET.
However, if you have hub and spoke setup it is recommended to use an Network Virtual Appliance, either VM acting as NVA with IP forwarding enabled, or Azure firewall or 3rd party solution. And route the traffic from Spoke VNET to Hub VNET with the help of Route table on VNET B.
If you still would like to use the same NAT gateway, the following Microsoft document could be useful.

Hub and Spoke with NAT gateway

1 answer

Your answer

VIVEK DWIVEDI 105 Reputation points Microsoft Employee

2025-04-10T14:19:00.66+00:00

Hi @Pratima Patil,

Greetings.
As Praveen mentioned that NAT gateway being a regional resource and local to the VNET cannot be associated to more than one VNET.
However, if you have hub and spoke setup it is recommended to use an Network Virtual Appliance, either VM acting as NVA with IP forwarding enabled, or Azure firewall or 3rd party solution. And route the traffic from Spoke VNET to Hub VNET with the help of Route table on VNET B.
If you still would like to use the same NAT gateway, the following Microsoft document could be useful.

Hub and Spoke with NAT gateway

Answer 1

Praveen Bandaru 2,415 Microsoft External Staff

Hello Pratima Patil

I understand that you are looking to Enabling Internet Access for VNet A via NAT Gateway in VNet B.

If you want to use the same NAT Gateway for VNet A and VNet B, it is not possible by default. A NAT Gateway is designed to be associated with only one VNet and can be linked to multiple subnets within that VNet.

Note: NAT gateway does not support association with multiple VNET's.

To achieve this functionality, consider using a Network Virtual Appliance (NVA) as outlined in the documentation below.

You need to deploy the NAT Gateway, then deploy the NVA in the NAT Gateway VNET. Configure to ensure that all traffic from the spoke VNETS is routed through the NVA. You can configure the NAT Gateway to handle all outbound internet traffic from both the hub and spoke VNETS. Finally, validate the setup by testing the NAT Gateway and ensuring proper routing between the hub and spokes.

Kindly check the below public document for more understanding:
https://learn.microsoft.com/en-us/azure/nat-gateway/tutorial-hub-spoke-route-nat?tabs=portal

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
User's image

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.

Pratima Patil 50 Reputation points

2025-04-10T16:30:32.28+00:00

Hi @Praveen Bandaru ,

I implemented the exact setup following the document you shared.

VNET A returns the NAT gateway IP thats been associated on VNET B. VNET B has the NVA machine.

I have some external systems to reach. So the services in VNET A should access or reach to those external systems via NAT Gateway.

External systems have whitelisted the NAT IP. But if I try to ping from VNET A's virtual machine, it doesn't go beyond the gateway IP of VM itself.
Praveen Bandaru 2,415 Reputation points Microsoft External Staff

2025-04-10T19:08:22.77+00:00

Hello Pratima Patil

Thank you for your response. Please perform a PsPing test from the virtual machine in VNET A to external systems on the specified port and share the results.

Refer to the PsPing documentation for guidance.

Command: psping -t (external resources IP or FQDN):port

Additionally, since we have configured the default route 0.0.0.0/0 to point to the NVA from the "VNET A" VM subnet, all external traffic will first reach the NVA. Therefore, you need to monitor the traffic within the NVA.

Moreover, try accessing any public website and perform a PsPing test for that FQDN on port 443. Capture both results in the NVA and analyze the behavior.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to "Accept Answer " and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Praveen Bandaru 2,415 Reputation points Microsoft External Staff

2025-04-11T18:44:36.02+00:00

Hello Pratima Patil

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
Praveen Bandaru 2,415 Reputation points Microsoft External Staff

2025-04-14T18:35:51.1566667+00:00

Hello Pratima Patil

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
Praveen Bandaru 2,415 Reputation points Microsoft External Staff

2025-04-15T15:09:16.9333333+00:00

Hello Pratima Patil

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.

Share via

Enabling Internet Access for VNet A via NAT Gateway in VNet B

1 answer

Your answer