Virtual network traffic routing
- Azure automatically creates a route table (router) for each subnet within Azure network and adds system default routes to the table.
- Azure Default route table (System routes) help you to connect any other resource in the same vnet and internet connectity
- Generally route table rules will depend on cidr notation and route table rules work on network id.
rule 1
destination => 192.168.0.0/24 next hop => <some network resoucrce>
vm with ip address 192.168.1.10/24 sending packets to 192.168.0.8 (Now will be rule be honored)
network id of destination in rule => 192.168.0.0 => 192.168.0.x
vm with ip 192.168.1.10 => 192.168.0.8 (is it matching rule ) yes so packet will be sent to configured next hop
rule 2:
destination => 10.11.0.0/16 next hop => resource a
vm with ipaddress 10.15.0.10 is sending the package to 10.11.10.15 now will rule be honored?
rules => 10.11 => 10.11.0.0 => 10.11.x.x
now since destination from vm matches n/w id this rule will be honored
rule 3:
destination => 0.0.0.0/0 next hop => internet
vm with ipaddresses 172.16.0.8 is sending packet to 35.25.20.24
Will the rule be honored?
n/w => it allow all ip address x.x.x.x, since 35.25.20.24 will fall under all this rule will be honored
rule 4:
destination => 10.11.12.0/24 next hop => virtual network
vm with ip address 10.11.12.6 is sendinp packet to 10.11.13.5
since network id's dont match this rule will not be honored
-
Default Rules of System routing Source Address Prefixes Next Hop type Default Virtual network cidr Virtual Network Default 0.0.0.0/0 Internet Default 10.0.0.0/8 None Default 192.168.0.0/16 None Default 100.64.0.0/10 None
-
Network will look like
-
Now can vm in subnet1 communicate with vm in subnet2?
- destination for subnet => 192.168.1.6 => is it matching vnet cidr range => 192.168.0.0/16 => 192.168.x.x => so they top must rule in route table will execute and it will send packet to vnet
-
Now can vm in subnet2 communicate with google
- rule 2 has route which speaks any ip address other vnet idress can be sent to Internet
-
System Default routes cannot be changed, but you can add your own custom rules (user defined routes) which will overrite system default routes.
Different Next Hop Types
- Virtual Appliance: A virtual appliance is a virtual machine that runs a networking application (software) such as firewall. You can find networking appliances in Azure Marketplace Refer Here for networking market place.
- Virtual Network Gateway: This comes into play when we want to connect Azure vnet with our on-premise networks (Express Route/VPN)
- None: Drop the packet
- Virtual Network: forward the packet with in azure virtual network
- Internet: Forward pakcet to Internet.
When to use Custom Routes
- We want to send all the packets from azure vnet through a proxy server
- We want custom/third party firewall to be used with azure virtual network.
- We want to implement connectivity b/w On-premise networks and Azure vnets
Questions for next sessions
- IS it ok for Databases to be accessed over internet?
- No, But how can i do this in azure
- Is it ok to open all of ports of my azure vm to public internet?
- No, But how can i do this in azure
- What is DMZ and How to implement DMZ?
