question

SeppeVanWinkel-6255 avatar image
0 Votes"
SeppeVanWinkel-6255 asked SaiKishor-MSFT commented

Cannot connect to azure private link ip on Azure VPN

Hello Guys,

I'm trying to disable the public endpoint on our SQL Server. And only allow traffic from resources hosted on Azure or users that are connected to the Azure VPN on their local machine.


I managed to create the virtual network, subnets, network gateway, and databases without any problem.

However, I seem not to be able to connect to my Azure SQL server over the private link IP.

Setup:
VNET:
10.88.0.0/16
subnets:
SQL:10.88.2.0/24
Gateway:10.88.32.0/24

Virtual Network gateway
P2S on the VNET above with an address pool of 10.90.32.0/24 using Azure AD. (Works fine)

Azure SQL Server
With public access denied
105389-image.png


Also, a private link has been added to the SQL server. It has gotten a private IP of 10.88.2.4.

Unfortunately, I am not able to connect to that IP address from my machine where the VPN is running. (Error: Cannot open server "10.54.2.4" requested by the login. The login failed.) Although the same credentials can be used on the public DNS name if enabled and it works immediately.

Does anyone have any guidance on what I did wrong?

azure-virtual-networkazure-vpn-gateway
image.png (45.1 KiB)
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@SeppeVanWinkel-6255

Thank you for reaching out to Microsoft Q&A. I understand that you are unable to reach the privante link IP from the VPN client after disabling Public endpoint access for the same, Can you confirm if you are trying to reach it via the DNS name or IP address? What is 10.54.2.4 IP address?

If using DNS name, please try using IP address and let me know if connectivity is successfull or not. Looking forward to your update. Thank you!

0 Votes 0 ·

1 Answer

SeppeVanWinkel-6255 avatar image
0 Votes"
SeppeVanWinkel-6255 answered SaiKishor-MSFT commented

@SaiKishor-MSFT

I am connecting to the SQL Server instance with a private link (that has the IP of 10.54.2.4).

And I am trying to connect to the IP, not the DNS name.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@SeppeVanWinkel-6255 To connect to the SQL server instance, you need to use the private endpoint IP that belongs to the subnet/vnet that you are connecting to. From your description, it seems like you need to connect to 10.88.2.4 on port 1433. Ideally the DNS Name of the server should resolve to this IP automatically if you try it from the VNET directly. If resolving from the client machine, make sure to setup DNS forwarding as given here in this document.

Please let me know if you still have any questions and we will gladly assist further. Thank you!


0 Votes 0 ·