Can we externally access the client network through the public IP address of the Azure VPN Gateway?

Question

My concern is that I don't want to buy a public IP address from my local provider, Azure is far cheaper. I have two scenarios, I hope the Az VPN Gateway with P2S config can help.

First scenario: Users can access the enterprise LAN through VPN:

I am configuring my local enterprise router as the client in the P2S config. Users's laptops can also be configured as clients in the P2S config of the Az VPN Gateway. This should enable them to access the local router through the VPN.

Second scenario: I want to configure port forwarding on my local enterprise router, so some applications can be accessible through the public IP.

Is it possible to access my local router through the public IP address of the Az VPN Gateway? In other terms, is there a way to forward that traffic from the Az VPN Gateway public IP to my local router, so I can in turn forward it to my LAN?

Answer 1

I am configuring my local enterprise router as the client in the P2S config. Users's laptops can also be configured as clients in the P2S config of the Az VPN Gateway. This should enable them to access the local router through the VPN.

Yes, by enabling Local router through the VPN local enterprise router and Users laptops can also be configured as clients in the P2S config of the Azure VPN Gateway

Once connected to the Azure VPN Gateway, users will be able to access your enterprise LAN securely as if they were on the local network.

Second scenario: I want to configure port forwarding on my local enterprise router, so some applications can be accessible through the public IP.

Azure VPN does not provide native port forwarding to forward traffic from its public IP to a specific device on your on-premises network, including your local router. To achieve port forwarding, you will need to use other services like Azure Load Balancer.

Secure access to Azure resources or connections between Azure resources and on-premises resources are both possible with the help of the Azure VPN Gateway It does not provide a way to forward traffic from the Azure VPN Gateway public IP to your local router. To access the local router through the public IP address of the Az VPN Gateway you can make use of NAT gateway refer this refer this MsDoc

Answer 2

@Imran I am afraid that my second scenario can not work.

It seems like NAT Gateway can only be attached to Azure VNETs, provides SNAT automatically, and provides DNAT only for responses to outbound traffic. No way to link it to an on-premise network.

However, it is possible to have NAT on VPN Gateway, but it doesn't support P2S config.

Exact limitations below:

• NAT is supported on the following SKUs: VpnGw2~5, VpnGw2AZ~5AZ.
• NAT is supported on IPsec cross-premises connections only. VNet-to-VNet connections or P2S connections are not supported.
• Every Dynamic NAT rule can be assigned to a single connection.

I will keep searching...