Azure Point-to-Site VPN forced tunneling with Azure VM Firewall.

Question

Azure Point-to-Site VPN forced tunneling with Azure VM Firewall.

Blackbird IT 1

Hi,

Currently have a bunch of users connecting to Azure VPN Gateway via the Azure VPN Client.
I am working on a project to centralize gateways for users.

I have a router setup in Azure Virtual Machines and want to force P2S clients to use this as a default gateway to comply with ISO standards.

From what I am reading in my searches forced tunneling is not supported on the VPN gateway but I would like to know if i use my own router can this be achieved?

Thanks

1 answer

Your answer

Answer 1

msrini-MSFT 9,291 Microsoft Employee

@Blackbird IT ,

Yes you can go ahead and deploy any Network Virtual Appliance (Router) which has OpenVPN capability to set up Client connecting directly to your router in Azure where you can configure to advertise 0.0.0.0/0 route to your clients.

You don't need VPN gateway or any Azure managed service to do this setup. Azure has a product called vWAN which you can leverage to perform Force tunneling of clients traffic to Internet to P2S gateway and also to Azure Firewall, You can pick any of the above solution to achieve your setup.

Regards,
Karthik Srinivas

Blackbird IT 1 Reputation point

2021-11-11T10:01:35.86+00:00

Thanks msrini-MSFT,

What I am trying to avoid is re-deploying VPN Client. My users already have Azure VPN configured, If I could force tunnel and push a default route to them pointing at my router that would be great.
Do you know if there is a way I can achieve this?

Thanks again!
msrini-MSFT 9,291 Reputation points Microsoft Employee

2021-11-11T10:54:35.107+00:00

Here is the doc which can help you to perform force tunnelling : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-p2s-advertise-custom-routes#forced-tunneling
Blackbird IT 1 Reputation point

2021-11-11T21:46:27.313+00:00

Yeah, I have seen that. It does not allow me to set a Default Gateway of my Router. It will just drop all the internet packets.
Unless I am missing something, I don't see how that will do what I need.
msrini-MSFT 9,291 Reputation points Microsoft Employee

2021-11-12T09:20:23.913+00:00

If you want to route all the traffic to your router, then deleting and using your router directly is the way.

Share via

Azure Point-to-Site VPN forced tunneling with Azure VM Firewall.

1 answer

Your answer