Azure Networking: VNets, Subnets, NSGs, Routes, DNS, NAT, Peering, and Private Endpoints

An Azure virtual network is a private IP address space for Azure resources. Subnets divide it into policy and routing boundaries. Network security groups filter traffic, route tables influence paths, DNS resolves names, NAT Gateway provides stable outbound connectivity, peering joins VNets, and private endpoints give supported services private IP addresses.

Lab: 45 minutes · Cost: VNet/subnet/NSG are generally not separately charged; NAT Gateway, public IPs, peering traffic, Private Link, firewall, and gateways can be billable · Cleanup: delete the lab resource group.

How should you plan address space?

Start with non-overlapping RFC 1918 ranges and leave room for growth. Example:

Azure reserves addresses in every subnet. Some services require dedicated or delegated subnets and minimum sizes. Check current product guidance before finalizing an enterprise IP plan.

How can you create the VNet?

Ways to build

Choose the Azure tool you want to use. The underlying resource stays the same.

Azure portalAzure CLIAzure PowerShell

Azure portal

1. Search Virtual networks → Create.
2. Select subscription and resource group.
3. Enter vnet-northstar-dev-001 and a region.
4. Add 10.20.0.0/16.
5. Create snet-app and snet-data.
6. Review security options instead of accepting public exposure by habit.
7. Create, then open Subnets, Peerings, DNS servers, and DDoS protection to learn the blade.

Azure CLI

bash

WrapCopy

AZURE_RG="rg-northstar-dev-001" AZURE_LOCATION="eastus" AZURE_VNET="vnet-northstar-dev-001" az network vnet create \ --resource-group "$AZURE_RG" \ --name "$AZURE_VNET" \ --location "$AZURE_LOCATION" \ --address-prefixes 10.20.0.0/16 \ --subnet-name snet-app \ --subnet-prefixes 10.20.1.0/24 az network vnet subnet create \ --resource-group "$AZURE_RG" \ --vnet-name "$AZURE_VNET" \ --name snet-data \ --address-prefixes 10.20.2.0/24

Azure PowerShell

powershell

WrapCopy

$AppSubnet = New-AzVirtualNetworkSubnetConfig -Name "snet-app" -AddressPrefix "10.20.1.0/24" $DataSubnet = New-AzVirtualNetworkSubnetConfig -Name "snet-data" -AddressPrefix "10.20.2.0/24" New-AzVirtualNetwork ` -Name "vnet-northstar-dev-001" ` -ResourceGroupName "rg-northstar-dev-001" ` -Location "eastus" ` -AddressPrefix "10.20.0.0/16" ` -Subnet $AppSubnet, $DataSubnet

How do NSGs work?

NSGs contain prioritized allow/deny rules for inbound and outbound traffic. Azure evaluates lower priority numbers first. Default rules exist. Associate NSGs with subnets for consistent policy and, when required, network interfaces for additional precision.

Do not add 0.0.0.0/0 SSH or RDP rules for convenience. Use Bastion, a private connection, or time-bound controlled access.

What do routes, NAT, and service endpoints do?

Azure supplies system routes. A user-defined route can send traffic through a firewall or appliance. NAT Gateway gives supported subnets scalable outbound internet access with stable public IPs; it does not accept unsolicited inbound connections. Service endpoints keep service traffic on the Azure backbone but the service still has a public endpoint. Private endpoints place a network interface with a private IP in your VNet.

Why is DNS critical for private endpoints?

Applications still use the service's normal hostname. Private DNS must resolve that hostname to the private endpoint IP inside the network. A private endpoint without correct DNS often produces confusing timeouts or sends clients to the public endpoint.

Link the service-specific private DNS zone to each VNet that must resolve it. Hybrid networks need DNS forwarding or Azure DNS Private Resolver design.

How do Bicep and Terraform fit?

Bicep:

Terraform uses azurerm_virtual_network, azurerm_subnet, azurerm_network_security_group, and explicit association resources. Production modules should validate CIDRs, expose only intentional inputs, and avoid implicit dependencies.

How do you troubleshoot networking?

1. Resolve the hostname from the actual client.
2. Inspect the effective route table.
3. Inspect effective NSG rules.
4. Confirm source and destination IPs and ports.
5. Use Network Watcher connection troubleshoot and flow logs where supported.
6. Check resource firewalls and application listeners.
7. Confirm asymmetric routing is not introduced by an appliance.

Verify and clean up

The VNet lab is inside the resource group. Delete the group after all dependent labs, or remove only its network resources when safe.

Official references

• Azure Virtual Network documentation
• Azure network security groups
• Azure Private Link
• Azure DNS Private Resolver