This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(19.2, 84%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPA%3C/text%3E%3C/svg%3E)
Hi,
I have a question around azure P2S VPN offering, I set it up nicely and installed VPN client on VM, which is able to access azure resources available on that Vnet, But i have a different requirement where I have two VMs where i have installed and connected via VPN client, is it possible Vm1 to be able to accesss VM2 ? currently, i am not able to do so, considering both are in same subnet, they should be able to access each other but i am not able to do so so far ?
So, i did some trials and what I found is client to client connectivity is possible if tunnel type is openVPN, and i validated the same , i changed the tunnel type to openVPN and it worked, now my two VMs (in obsoletely different network) can connect to each other via VPN allocated IPs. Unfortunately i cant find this documented in azure VPN documentation.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(188.79999999999998, 3%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EH%3C/text%3E%3C/svg%3E)
IWe have been testing this. Using Azure p2s flavor OpenVpn and even with an Azure FW the clients can communicate because they are in the same subnet. We are trying to prevent the client to client communication.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(131.20000000000002, 46%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
I have a laptop and a router device connected using Open VPN to an azure vpn gateway
one has ip x.x.x.2 and the other has x.x.x.3 from the VPN Gateway and they can both ping eachother
how do you restrict this connectivity?
VPN clients can't communicate with each other over the VPN but where are these VMs hosted? You mention they are on the same subnet, are these VMs in Azure already or on premises? They should be able to communicate with each other using their local (LAN) IPs, not the Azure VPN IP address.
@Alan Kinane Thanks for the response, basically in my case these two VMs may or may not be hosted on azure , we dont control these client VMs , but what we need is a way so that these VMs can talk to each other via VPN tunnel, because thier local network doesnt allow any inbound communication on them.
Just to give you more insight on what i am trying to do here is, I want to build tunnel between 2 or more github actions agents (runner) so that they can talk to each other, Github restrict all inbound port into thier runners, hence nobody could reach out to GH runners from outside. I was able to install VPN client into it and it got connected to VPN gateway and i can ping it now from my server VM (hosted in same Vnet) successfully but i also wants to ping it from any other VM where i have installed VPN client but not able to do so.
when I says both VM are on same vnet, i mean they share address from same VPN gateway hence there might be possibility of thier connection.
I have a laptop and a router device connected using Open VPN to an azure vpn gateway
one has ip x.x.x.2 and the other has x.x.x.3 from the VPN Gateway and they can both ping eachother
how do you restrict this connectivity?
You should be able to create NSG rules to override the default VNET AllowAll rule. You will have to explicitly block this traffic.
dont seem to be able to add NSGs to a VNET gateway subnet