How to create a simple Azure VPN Gateway solution for your home office access of your Cloud and On-premises environments over encrypted tunnel

Azure VPN Gateway is a service that can be used by organizations to set up remote access for their users or employees to securely access organization computing environments from the comfort of a home office without exposing the systems to the public internet.

Azure VPN Gateway acts a communication bridge between your virtual machine on your virtual network and your On-premises network. Employees connected to On-premises network would be able to access your cloud resources via the VPN gateway. VPN Gateway also enables communication between private cloud and public cloud to communicate with each other.

The step that i used to create Azure VPN Gateway solution for my home office remote access to Azure

Create a Virtual Network

Create a Virtual Machine

Create Azure VPN Gateway

Generate, download and extract Azure certificate

configure Azure VPN gateway

Download Azure VPN Client after configuring the VPN Gateway

Install the Client certificate

install the VPN Client

Connect to Azure VPN

Test the connection

To simply the solution I only created the solution using one virtual network.

1. Navigate to your Azure console and on the search bar, search for “Virtual networks” and thencreate the Virtual network

wizard for creating a virtual network

Follow the wizard to create resource group or use existing resource group. Select the region that you want to create your Virtual network.

create Azure virtual network

For IP address space you can use the assigned default IP address for the Virtual Network (VNet) and default subnet IP

virtual network ip address space

For security and tagging screen, leave the default settings and thenReview and create your virtual network.

2 .Create a new virtual machine and do not associate it with any public IP address. Note : To simplify my solution , I is created create only one virtual machine in the same region as my virtual network . You is set can set the setting similar to what i have set below . For SSH key , you is use can use exist key if you have an exist ssh key store locally in your system , otherwise create a new ssh key . Also for public inbound port rule , set it to none since we do n’t want the VM to be access over the public internet .

create a vm

For the Disks screen, leave the settings to much default settings. On the networking screen, select the Virtual network you created in previous step above and leave the Subnet as default Subnet. Do not associate any public IP with your virtual machine, therefore select none. Keep the remaining configuration as default.

Don’t make any changes to the following screens : Management, Advanced and Tags. Next, Review and create the virtual machine.

3. Create a Virtual network gateway in the same region as the VNet and your VM. Set the Gateway type as VPN and VPN type as Route-based. For the SKU which define how much connection a given gateway can handle, set it to VpnGW1. For the Gateway subnet address range, use the default subnet address range. A new IP address will be created for the network gateway and you should give it a name.

Next, skip the tag screen and then, Review and create your virtual network gateway. Azure should start to provision your virtual network gateway.

4 . Next we is need need togenerate a certificate so that we can configure the VPN Gateway so that clients can connect remotely via the VPN Gateway. Go here for information on how you generate a client certificate. You will use the certificate to configure the VPN gateway so that clients can connect to the gateway.

5. Once you have generated the client certificate, Download the certificate and extract it , once you extract it, you will see the following files, Client Certificate and Root Certificate. You will use the data inside the Root Certificate to configure Azure VPN Gateway. The Client Certificate will be installed on our computer so that we can remotely connect and authenticate with our on Azure VPN.

content of extract certificate zip filesample root certificate datum

6. Use the root certificate data to configure Azure VPN gateway. Go to the VPN Gateway you create and under the setting menu option , select “ point – to – site configuration ” and thenselect “ configure now ” . add your ip address pool that the client can use to connect remotely . For Tunnel type , select the “ ikev2 and sstp ( SSL ) ” option and the select authentication type as “ Azure certificate ” . Next is copy copy the datum from the root certificate as show below and name it as “ p2srootcert ” and save your change . After save , the “ Download VPN client ” button show below will be activate / enable .

configuring your Azure VPN Gatewayactivated “Download VPN client” button

7. Download the VPN Client, you will use it later to install Azure VPN client on your computer. Note: If you were an organization, this is the client that you would install in all your users or employees computer so they can remotely connect to Azure.

content of the VPN Client zip file after extracting the zip file

8 .Install the Client certificate locally on a client computer. The Client certificate will be used to authenticate your local client to your Azure VPN environment using the root certificate data that you added to your Azure VPN Gateway. Double click on the “clientcert” file and follow the wizard to install the Client certificate.

Client certificate installation wizard

8 .install the VPN Client that you downloaded from Azure. Note: I implemented my VPN Gateway solution using Windows 11 device. I did not try the solution on previous version of windows or a Mac device. For Mac, there is a procedure available on Azure documentation.

10. After successful installation of VPN client, go to your start menu or window search bar and search for the VPN and thengo to windows VPN settings. You will see that the VPN you installed is listed

window vpn setting display the vpn client the instal vpn client

11. Click the “Connect” button associated with the VPN client you installed and Connect to Azure VPN. follow the wizard step , if you see message , ask if you want to update routing table click “ continue ” and say “ Yes ” .

connecting to Azure VPN

Once you are connected, your windows VPN settings should show that you are connected to your Azure VPN.

windows vpn setting displaying that my device is connected to my Azure VPN

12 .Next, test that you can connect to the virtual machine that you have in Azure. Go back to Azure console, copy the private IP address of your virtual machine.

13. Open a terminal window, e.g. Git bash, and try and ping the virtual machine on Azure .You should be able to successfully ping the VM on Azure using a private IP address.

ping the vm on Azure

14. Continue testing the connection by SSH tunneling into your VM, using the following commands ssh azureuser@<YOUR_VM_PRIVATE_IP> -i <YOUR_SSH_KEY> . The connection is be will be successful as show below .

successful connected to a VM on Azure

15. Test that you can run updates on the VM on Azure or install Apache web server.

From AWS console we can view our session that is connected to Azure VPN Gateway

Conclusion :

Azure VPN Gateway is offer offer a simple solution to setup a secure remote connection to your Azure cloud environment and your On – premise resource .