Hub, Spoke - S2S VPN Trafice via Azure Firewall

Question

Hello,

Recently I have create a system like below image

I have config 3 VNET:

1. VNET test(10.19.0.0/16) : in this vnet, I config a subnet(10.19.0.0/24) and a test VM (OS window server 2022) with a public IP named publicIPDev. I want to remote to this test VM, then connect VPN Site-to-Site to Hub, then connect remote desktop to VM on VNET Spoke
2. VNET hub(10.18.0.0/16): in this vnet, I config 3 subnets:
   1. Subnet for VPN (10.18.2.0/24): this subnet I also create a VPN Site-to-Site
   2. Subnet for Firewall(10.18.1.0/24): this subnet I also create a Firewall. The firewall rule configuration is:
      1. Basic firewall SKU
      2. Assigned a public IP
      3. Not enabled Firewall Management NIC
      4. Use basic firewall policy.
      5. Create a network rule collection. Select allow. then create a rule like below:
         1. Name: AllowRDP rule
         2. Protocol: TCP
         3. Source type, IP address.
         4. Source: 10.18.0.0/24. - this is address space of vnetHub
         5. Destination type,:IP address.
         6. Destination Address: 10.12.0.0/16. - this is address space of vnetSpoke
         7. Destination Ports: 3389.
   3. Subnet for testing(10.18.0.0/24): this subnet I create a VM called VMHub, this VM is just assigned a private IP (10.18.0.4)
3. VNET spoke(10.12.0.0/16): This subnet I config a subnet(10.12.0.0/24). In this subnet, I also create a VM called VMSpoke, this VM is just assigned a private IP (10.12.0.4)

VNET hub and VNET spoke is also peer. I follow instruction to create peering in this link https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit

I also config 2 route table:

1. A route table UDR hub to spoke, I set as below
   1. I set a route with below config:
      1. Destination type: IP addresses
      2. Destination IP addresses/CIDR range: 10.12.0.0/16 - this is Vnet spoke address space
      3. Next hop type: Virtual appliance
      4. Next hop address: Firewall's private IP
   2. Attach to Subnet for VPN (10.18.2.0/24)
2. A route table UDR default route. I understand that this default route will allow outbound traffic for VM in Vnet Spoke. I set as below
   1. I set a route with below config:
      1. Destination type: IP addresses
      2. Destination IP addresses/CIDR range: 0.0.0.0/0
      3. Next hop type: Virtual appliance
      4. Next hop address: Firewall's private IP
   2. Attach to Subnet of Vnet Spoke (10.12.2.0/24)

In test VM, I config and connect successfully to VPN. And from there, I can connect Remote desktop to VMHub via private IP: 10.18.0.4

However, I cannot connect Remote desktop to VMSpoke via private IP: 10.12.0.4.

The VM VMSpoke's port 3389 is opened. When I connect from testVM through VPN to VMHub, in VMHub i can conenct remote desktop to VMSpoke

Please help me to review my configuration

Answer 1

@lucas ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well

In the Route Table "UDR default route",

• Please add a more specific route, VNET Test's address range to be precise.
• In the peering between the two VNETs, make sure
  "Allow 'vnet-2' to receive forwarded traffic from 'vnet-1'"
  is enabled on both the peering.

Once done, try to initiate traffic from the VMTest to VMSpoke,

• And see if the traffic is logged at the firewall
• This will tell us if the traffic is reaching the VNET Hub or not
• And if the Firewall allows/denies the traffic

Cheers,

Kapil