1

Hello,

I recently received a subscription to Azure and setup a VM with a virtual network VPN to my on-prem. That all is working fine and dandy. I can contact all the resources on my LAN. My problem now is that I’m trying to route traffic from my Azure VM across my LAN to my DMZ. Everything I have tried thus far has been unsuccessful.

So the virtual network is setup as a site-to-site VPN that connects to my Sonicwall via a tunnel interface. Traffic to my Azure network is routed from my LAN network to VPN and proper access rules in place. LAN to DMZ is wide open on the Sonicwall. DMZ to LAN is heavily restricted. I assume I need to just allow access from DMZ to LAN to pass traffic to the VPN but I can’t seem to get my access rules to work correctly.

Thanks in advance!

4 Spice ups
2

OK, so the VPN works. Fantastic! Now you want that same VPN to allow access from Azure to your DMZ. Keep in mind that DMZs by default are already internet facing and segregated from your LAN by design. Does it make more sense to connect over the WAN connection?

In general, VPNs will connect to the resources you allow them to. So, if the DMZ is in the allowable list, Azure can connect. By default, your VPN will only connect tot eh local lan. In Sonicwall, you would need to build an Address Group made up of address objects (the subnets you want to allow the Azure side to connect to). Then you add this to the network tab on your vpn connection.

3 Spice ups
3

Dang, I can’t believe I didn’t even think about connecting it over the WAN instead… I will go that route instead. Thanks!

4

Create a route on the Azure VM to Route all the VPN to LAN traffic through the VPN. Why not using a VPN to your LAN and LAN to VPN and avoid the complexity of it?