Explicit outbound connectivity method mandatory for special subnets?

Question

Hi,

Taking advantage of the default outbound access retirement, we are going to try converting all subnets to private. For the subnets where we have virtual machines this is not a problem, since they have a route table with rules to redirect all outbound traffic through a firewall. However, we have a doubt about subnets that host other types of Azure resources: the GatewaySubnet (hosting a VPN Gateway), the subnet used to deploy a PostgreSQL Flexible Server instance, or the subnet where an Application Gateway is deployed. Do these subnets require an explicit outbound connectivity method, or can they be made private without configuring one?

Answer 1

Hi, no: for “special” subnets an explicit egress method is not needed (and is not supported for GatewaySubnet), GatewaySubnet uses managed egress and does not need to be managed with NAT GW or UDR 0.0.0.0/0; PostgreSQL Flexible Server in delegated subnet manages egress itself (only configure private DNS/PE); Application Gateway does not require outbound NAT (put NSG with GatewayManager tag allowed and UDR only to reach backends); rule of thumb: explicit egress (NAT GW/LB outbound/Public IP) is needed for VMs, these subnets can remain private respecting the NSG/UDR exceptions provided by the service.