Issue with Azure Blob Storage Connectivity via P2S VPN

Question

I am writing to request assistance regarding an issue we are currently facing while trying to connect our local systems to Azure Blob Storage through an Azure VPN connection.

Plan and Current Configuration:

1. We have set up an Azure VPN using OpenVPN to enable local developers to access Azure Blob Storage from their local networks.
2. The Azure VPN has been configured successfully, and the virtual network is connected to the Blob Storage.
3. The Azure VPN connection status shows as successful, and we can confirm the VPN itself is functioning as expected.

Issue:

Despite the successful connection status on Azure, we are currently unable to access Azure Blob Storage from our local network. This prevents developers from interacting with the Blob Storage in their local environments.

Request for Assistance:

We would appreciate any guidance or troubleshooting steps you could provide to resolve this connectivity issue. Specifically, we would like to understand if there are any additional configurations required on either the Azure or local network side to establish proper connectivity to Azure Blob Storage.

Answer 1

You need to implement a private endpoint for this to work - service endpoints are not supported in hybrid scenarios. Follow https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints and refer to https://learn.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-storage-portal?tabs=dynamic-ip

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

Hello Dhanasekaran Kuppusamy

Greetings!

You can use private endpoints for your Azure Storage accounts to enable secure data access for clients on a virtual network (VNet) via a Private Link. Each storage account service uses a separate IP address from the VNet address space. Network traffic between VNet clients and the storage account travels over the VNet and a private link on the Microsoft backbone network, avoiding public internet exposure.

Service endpoints are not supported in hybrid scenarios.

Check the reference document: https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.