NAT Gateway for Managed VNet IR

Amrale, Siddhesh 0

How can I make Azure Managed VNet IR to make requests through a static public I.P?

I don't want to create and manage VM's and neither I want to whitelist entire microsoft range of public ips.

Problem Statement :
I have create a public ip 20.75.234.9 which is attached to a nat gateway which is attached to a vnet then I have a subnet and a nic which is connected to a private endpoint to a data factory. In data factory I created integration runtime and told it to use virtual networking. Then I create a pipeline which sends request to a function app through that integration runtime. The function app only accepts requests from 20.75.234.9. But when I run this pipeline function app receives request from different ip like 74.235.251.34 instead of 20.75.234.8

Any Solutions ?

Vinodh247 27,551 Reputation points MVP

2025-02-11T01:19:09.4566667+00:00
Hi ,

Thanks for reaching out to Microsoft Q&A.

Your issue is that adf's managed VNet IR does not natively support routing outbound traffic through a NAT Gateway. Instead, Managed VNet IR uses a set of Microsoft-managed outbound IPs that can dynamically change.

Probable Options to try:

Use Azure Firewall with NAT Rule (Recommended)

Since Managed VNet IR cannot directly use a NAT Gateway, the best approach is to introduce Azure Firewall in your Virtual Network. You can configure Azure Firewall to have a static public IP and use NAT rules to route outbound traffic through this static IP.

Steps to Implement:

Deploy Azure Firewall in the same VNet as your Managed VNet IR.

Assign a static public IP (ex: 20.75.234.9) to the firewall.

Configure a UDR (User-Defined Route) on the subnet where the Managed VNet IR is deployed:

Set the next hop to Azure Firewall for outbound traffic.

Create NAT Rules in Azure Firewall to translate outbound traffic to your static public IP.

Whitelist the static public IP (20.75.234.9) in your Function App.

This setup ensures that all outbound requests from the Managed VNet IR go through Azure Firewall and appear from your static IP.

Use a Selfhosted Integration Runtime

If you want to avoid an Azure Firewall setup, an alternative is to deploy a SHIR inside an Azure VM with a NAT Gateway. However, since you do not want to manage VMs, this might not be ideal.

Why NAT gateway Alone dont work?

Managed VNet IR traffic does not use your NAT Gateway for outbound internet requests. Instead, it uses Microsoft's predefined IP ranges, which are not customizable. This is why your Function App sees requests coming from an unexpected IP.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.

Share via

NAT Gateway for Managed VNet IR

Your answer