Question Regarding Azure VPN Gateway(P2S) Traffic Segmentation

Question

Hello,

We are looking for guidance regarding a current Azure VPN Gateway behavior that appears to be by design according to Microsoft documentation.

Scenario

The environment contains multiple IP ranges connected through the same Azure VPN Gateway. The customer's requirement is to prevent communication between specific IP ranges that share the same gateway connection.

Based on the documentation reviewed, traffic between connected networks behind the same gateway is currently allowed, and the customer understands this behavior is expected.

Customer Concerns

The customer would like clarification on the following:

1. Is there a supported method to prevent communication between IP ranges connected through the same Azure VPN Gateway without requiring a significant redesign or high operational overhead?
2. What is the recommended Microsoft approach for implementing traffic isolation in this scenario?
3. Are there any service limitations, design considerations, or best practices that should be considered when trying to isolate networks behind the same gateway?
4. Is this capability currently on the Microsoft product roadmap, or is there any planned enhancement that would allow administrators to block communication between specific IP prefixes behind the same VPN Gateway?

Any additional information regarding this issue would be greatly appreciated.

Answer 1

Hello LeRoy, Kevin,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that your question regarding Azure VPN Gateway(P2S) Traffic Segmentation.

The Azure VPN Gateway provides VPN connectivity and route propagation, but it is not a firewall and does not natively enforce per-user or per-prefix deny rules directly on the gateway. The correct Microsoft-supported solution is to assign P2S users to deterministic IP pools using Azure VPN Gateway User Groups, then enforce access using NSGs, Azure Firewall, NVA, or downstream ACLs based on those assigned P2S source IP ranges. - https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-about, https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

The best practice to resolve is to:

• Configure P2S User Groups / Policy Groups so each user category receives a dedicated VPN client address pool.
• Use NSG rules if the target resources are Azure VMs/subnets.
• Use Azure Firewall or an NVA if traffic must be inspected centrally or if the destination is another branch, S2S site, ExpressRoute network, or shared hub route.
• Do not rely on custom traffic selectors as a security control because they control IPsec negotiation scope, not full traffic authorization.
• Validate the result with effective routes, NSG rules, Azure Firewall logs, and client source IP assignment.

After users are mapped to separate P2S IP pools and the appropriate deny/allow policies are applied, the customer can reliably block unwanted access without changing the VPN authentication model or opening an Azure Support case, unless the documented configuration fails after validation.

Use the below resource links for more reading and steps:

• About User Groups and IP Address Pools for P2S connections - https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-about
• Assign IP addresses from defined pools to P2S VPN users - https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-create
• Azure virtual network traffic routing- https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview
• Azure Firewall in a hybrid network - https://learn.microsoft.com/en-us/azure/firewall/tutorial-hybrid-portal

I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.

---

Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.

Answer 2

This behavior is expected (by design). Azure VPN Gateway functions as a routing service and does not provide policy-based filtering or segmentation between address prefixes that are learned through the same gateway. Once routes are exchanged, traffic between connected networks is routed unless another network security control is introduced.

There is no supported feature I'm aware of within Azure VPN Gateway to selectively block communication between specific IP ranges behind the same gateway. You can implement traffic isolation using Azure Firewall, a network virtual appliance, or by redesigning the network topology to enforce segmentation. Network Security Groups would not filter traffic that transits the VPN Gateway (no support for associating an NSG to the GatewaySubnet for active gateway traffic filtering).

When designing for isolation, plan for network segmentation early, minimizing overlapping trust boundaries behind a single gateway, and centralizing traffic inspection through Azure Firewall or an NVA when granular filtering is required. The hub-and-spoke architecture with centralized security services represents the typical best practice for these scenarios.

I'm not aware of any publicly announced roadmap item or planned enhancement that would add prefix-level traffic filtering within Azure VPN Gateway. For future feature availability, the best sources are the Azure Updates site, official Microsoft documentation, or submitting feedback through the Azure Feedback portal.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 3

hi LeRoy, Kevin & thx for sharing urs issue here at Q&A portal,

what u've described is expected behavior. Azure VPN Gateway routes traffic between connected networks based on the effective routes it learns, but it doesn't provide policy-based filtering to selectively block communication between specific prefixes behind the same gateway. If u need traffic segmentation, Microsoft's recommended approach is to enforce it elsewhere in the network. For Azure VNets, that typically means using NSGs, Azure Firewall, or a third-party network virtual appliance, depending on where the traffic flows. If the traffic is transiting through a hub-and-spoke architecture, Azure Firewall is a common choice because it provides centralized policy enforcement.

There isn't a built-in feature on Azure VPN Gateway to deny traffic between selected connected networks while allowing other routes over the same gateway. Achieving that solely at the VPN Gateway layer would require redesigning the topology, such as separating networks behind different gateways or introducing a security layer that inspects and filters the traffic.

I'm not aware of any public roadmap indicating that Azure VPN Gateway will add prefix-level traffic filtering. If this capability is important for your scenario, I'd recommend submitting it through the Azure feedback channels and discussing it with Microsoft support or your account team. They can confirm whether there are any planned enhancements that haven't yet been publicly announced.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/