Setting up a VPN server in Azure that supports secure access for employees, vendors, and customers requires a carefully planned architecture to address different access levels, security boundaries, and scalability. Here’s a solid approach with Azure-native and custom options, along with a proposed build.
🔐 Goal:
- Provide VPN access via Azure to:
- Internal employees (full access to internal resources)
- Vendors (limited network segments)
- Customers (highly isolated environments)
🧱 Solution Overview:
Option 1: Azure Native (Recommended for Simplicity + Integration)
Use Azure VPN Gateway with:
- Point-to-Site (P2S) VPN: For users connecting from anywhere (SSL/IPSec)
- Site-to-Site (S2S) VPN: For vendors or partners with permanent networks
- Network segmentation via NSGs + custom routing
Option 2: Custom VPN Server (OpenVPN/StrongSwan/Algo VPN) on Azure VM
Deploy your own VPN solution (more control, better user management options, useful for advanced customization or cost optimization).
🏗️ Recommended Build (Azure Native + Role Segmentation)
🔧 Resources to Deploy:
| Component | Description |
|---|---|
| Azure Virtual Network (VNet) | Create VNet with subnets: internal, vendor, customer, gateway |
| Azure VPN Gateway | Use Route-based VPN Gateway (for P2S + S2S) |
| Azure AD Authentication | (Optional) for conditional access |
| Network Security Groups (NSGs) | Enforce access restrictions on each subnet |
| Private DNS Zones | Internal name resolution |
| Azure Bastion / Jumpbox (Optional) | Secure admin access if needed |
| Azure Firewall / 3rd-party NVA (Optional) | Deep traffic inspection if compliance is needed |
🔑 VPN Configuration
🔹 Point-to-Site (P2S)
- Authentication options:
- Azure AD (recommended for employees)
- RADIUS (for vendor/customer identity integration)
- Certificate (for simple isolated access control)
- Tunnel Types: SSTP / IKEv2 / OpenVPN
- Use different root certs per group if using certificate auth
🔹 Site-to-Site (S2S)
- For vendor/customer offices that need static access
- Use shared key/IPSec/IKE policies
🧰 Deployment Example (Terraform/Az CLI/ARM Bicep available upon request)
- Create VNet & Subnets
- Deploy VPN Gateway in GatewaySubnet
- Configure P2S with multiple address pools per group:
- bash
z network vnet-gateway update \ --name vpn-gateway \ --resource-group vpn-rg \ --address-pool "172.16.10.0/24" "172.16.20.0/24" "172.16.30.0/24"- Employees:
172.16.10.0/24 - Vendors:
172.16.20.0/24 - Customers:
172.16.30.0/24
- Employees:
- Apply NSGs with granular allow/deny
- Integrate Azure AD or RADIUS
🔐 Security Best Practices
- MFA (especially for vendors)
- Conditional Access Policies
- Split tunneling OFF unless explicitly needed
- Logging via Azure Monitor + Network Watcher
- Automate cert/identity rotation