dual VNET Firewall

Handian Sudianto 7,531 Reputation points
2026-10-11T02:36:05.3133333+00:00

I have 2 VNET on different region, let say vnet1 in region1 and vnet2 in region2.

vnet1 have azure firewall so all VM under vnet1 will go to the firewall when connecting to the internet. Now can we make VM under vnet2 go to the internet thru azure firewall on vnet1?

Azure Virtual Network
Azure Virtual Network

An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marcin Policht 110.1K Reputation points MVP Volunteer Moderator
    2026-10-11T03:31:48.6433333+00:00

    Yep - you can route internet traffic from vnet2 through the Azure Firewall in vnet1 using a feature called forced tunneling over VNet peering. Here is how you set it up:

    1. Peer vnet1 and vnet2. In the peering settings, enable "Allow gateway transit" on vnet1 and "Use remote gateways" on vnet2. (Note: Azure Firewall acts as the "gateway" in this logical configuration).
    2. Create a User Defined Route (UDR) table and associate it with the subnets in vnet2.
    3. Add a route to that UDR table with the prefix 0.0.0.0/0 (all internet traffic) and set the next hop type to Virtual Appliance, using the Private IP address of the Azure Firewall in vnet1.

    If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

    hth

    Marcin

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.