- Implementation of encrypted tunnels to connect local networks to the Microsoft cloud.
- Different connection architectures depending on whether it is for individual users or corporate headquarters.
- Use of open source tools and managed services to optimize security and control.
- Integration of advanced authentication using Active Directory and digital certificates.
If you've ever felt a little exposed while browsing the web or need your team to access office files without anyone eavesdropping, setting up a VPN is the ultimate solution. Basically, we're talking about creating a encrypted tunnel that protects your data, allowing you to enter a private network as if you were physically connected to the site's router, even if you are thousands of miles away.
In the Microsoft Azure ecosystem, we're fortunate to have several paths to achieve this. From the simplest, managed option, which saves you headaches, to much more hands-on configurations using Linux and open-source software for those who want full control over your packagesWhether you're looking to work remotely securely or simply protect your digital identity, here's all the technical support you need to achieve it.
Managed options: Azure VPN Gateway
For those who don't want to get too bogged down with the command console, Azure offers the VPN GatewayThis tool allows you to establish two types of connections: Site-to-Site (S2S), which links two entire networks, and Point-to-Site (P2S), which connects an individual computer to the cloud. To set up an S2S connection, we first need to create a Virtual Network (VNet) with a consistent IPv4 address space, ensuring there are no overlaps with the local network.
A critical point is the creation of the GatewaySubnetThis is not just any subnet; it's the space where the gateway will reside and must be named exactly as such. A size of /27 or higher to ensure that there are enough IPs available for the gateway instances, especially if we enable active-active mode for high availability.
Once the gateway is deployed, which can take about 45 minutes to become operational, we need to configure the Local Network GatewayThis object is the representation of our physical site in Azure; here we define the public IP address of our local router and the network prefixes we want to route. To complete the process, we create the VPN connection defining a shared key (PSK) that must be identical at both ends for the handshake to be successful.
Virtual WAN: Microsoft's global network
As infrastructure grows, the conventional gateway can fall short, and that's where this comes into play. Virtual WANThis service simplifies large-scale connectivity by creating a "hub" or connectivity center. Instead of managing each tunnel separately, Virtual WAN allows for the centralized management of user VPN connections, making it easier for clients to connect. OpenVPN or IKEv2.
User configuration in Virtual WAN is very flexible. We can choose between authentication using certificates from Azure, Radius, or even integration with Microsoft Entra ID. The most convenient thing is that the system generates a configuration ZIP file which the user simply downloads and installs on their computer, eliminating the need to Configure and set up a VPN on Windows 11 manually in each network parameter on the client.
For traffic to flow, we need to link our virtual networks to the Virtual WAN Hub. Here we can experiment with the routing tables and decide whether traffic is automatically propagated or if we prefer to define static routes. It is an ideal solution for companies that need a robust global network with a optimized performance.
Custom implementations with Linux and StrongSwan
If you prefer not to rely entirely on managed services, you can set up your own VPN server using a Linux virtual machine with strongSwanThis alternative is especially useful if you want to avoid the costs of a Virtual Gateway or if you need precise control over encryption. The secret here lies in configuring the server as a internal router Through the use of iptables.
For this to work, it is vital to activate the IP forwarding in the Linux kernel. In the strongSwan configuration, we define the parameters of ikev2 and encryption algorithms (such as AES256). A key technical detail is the use of UDR-tables (User Defined Routes) in Azure; without them, the virtual machines on the network would not know how to respond to traffic coming from the VPN, as the traffic would be trapped on the VPN server.
For individual users, strongSwan allows you to create connections Host-to-Site by generating our own PKI. We created a Certificate Authority (CA), signed a certificate for the server and another for the client. Once the certificate was imported into the certificate store Trusted certification entities On Windows, the connection is established transparently and extremely securely.
Moving forward with SoftEther VPN and Active Directory
Another gem of open source is SoftEtherVPNThis software is incredibly versatile, supporting protocols like SSTP, L2TP/IPsec, and OpenVPN all in one instance. One of its biggest advantages is its ability to integrate with a server. RADIUS linked to Active Directoryallowing employees to use their usual corporate credentials to log into the VPN.
To implement this, the SoftEther VM is deployed in a DMZ subnet and configured SecureNATSecureNAT is essentially a combination of DHCP, DNS, and virtual NAT that assigns IPs to clients without requiring the creation of additional subnets in Azure. For authentication, the role is installed. Network Policy Server (NPS) on a Windows Server domain controller, configuring the SoftEther server as an authorized RADIUS client.
In terms of safety, we cannot leave the machine exposed to the elements. It is essential to apply Hardening: change the SSH port, install fail2ban to block brute-force attacks and force the use of TLS 1.2 By disabling outdated versions like SSL 3.0, we have a professional gateway that withstands external attacks.
Specialized connections: Azure Files and Storage
Sometimes we don't need the entire network to be connected, but simply to access shared folders. Azure Files without the data traveling over the public internet. The trick to this is to create a Private Endpoint (private endpoint). This assigns a private IP address from the VNet to the storage account, causing traffic to be automatically routed through the VPN tunnel.
The challenge here is name resolution. If the client tries to connect to storageaccount.file.core.windows.netThe public DNS will give you the public IP address and bypass the VPN. The solution is to implement a Azure DNS Private Resolver or a VM acting as a DNS forwarder. This way, the name resolves to the Private IP address of the endpoint and the network unit is mounted invisibly and securely.
Passionate writer about the world of bytes and technology in general. I love sharing my knowledge through writing, and that's what I'll do on this blog, show you all the most interesting things about gadgets, software, hardware, tech trends, and more. My goal is to help you navigate the digital world in a simple and entertaining way.