Route app gateway v2 through NAT gateway

David 1

Hi Everyone,

We have an AKS cluster set up with an app gateway. We need both autoscaling (only available in v2) and the ability to route traffic to/from the Internet so that Internet<>App Gateway always hops across the the nat gateway.

In other words, we want the traffic to route:
Ingress: nat gateway public IP > nat gateway > app gateway
Egress: app gateway > nat gateway > nat gateway public IP

And we want to prohibit:
Ingress: Internet > app gateway public IP > app gateway
Egress: app gateway > app gateway public IP > Internet

Since v2 requires a public IP and open ports, we can't simply block all inbound on its public IP and force use of the nat gateway IP as that is not allowed by Azure. I'm thinking this needs to be done with UDRs, but I can't figure how to do it in a way Azure finds acceptable.

Is there a solution for this?

Environment: The nat gateway and app gateway are located in the hub vnet. Each have their own subnet. The AKS cluster is located in a spoke vnet with its own subnet. The two vnets are peered together. Currently the nat gateway and app gateway both have their own public IPs.

Thanks!

GitaraniSharma-MSFT 47,416 Reputation points Microsoft Employee

2022-04-06T10:24:50.57+00:00

Hello @David ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

NAT gateway provides outbound internet connectivity for one or more subnets of a virtual network. Inbound initiated traffic is not affected by the addition of NAT gateway.
Refer : https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-gateway-resource

NAT gateway can be integrated with AKS as part of cluster creation, so that instances in a private subnet can connect to external services, but external services cannot initiate a connection. This feature is in public preview.
Refer : https://azure.microsoft.com/en-us/updates/public-preview-nat-gateway-integration-with-aks-2/

Could you please us know why Application gateway's Public IP is not preferrable in your inbound traffic flow?

Regards,
Gita
GitaraniSharma-MSFT 47,416 Reputation points Microsoft Employee

2022-04-08T10:59:45.797+00:00

Hello @David ,

I'm following up on my above comment. Could you please provide an update on this post for further discussion?

Regards,
Gita
GitaraniSharma-MSFT 47,416 Reputation points Microsoft Employee

2022-04-19T05:36:35.597+00:00

Hello @David ,

Could you please provide an update on this post for further discussion?

Regards,
Gita
GitaraniSharma-MSFT 47,416 Reputation points Microsoft Employee

2022-04-27T06:33:33.003+00:00

Hello @David , do you have any updates on this issue?

1 answer

Kumo 1 Reputation point

2022-07-15T09:27:01.023+00:00

Hey,

I'm in the same case here
why do I want my app gateway to use NAT gateway IP address? because I need my app services to have the same inbound and outbound IP.
you can fix that issue for outbound IP using NAT Gateways but inbound IP is a lot harder to make work.
What do you suggest?

Best,
Kumo
Please sign in to rate this answer.
GitaraniSharma-MSFT 47,416 Reputation points Microsoft Employee

2022-07-18T12:01:21.243+00:00

Hello @Kumo ,

Outbound type of userDefinedRouting architecture in AKS requires explicitly sending egress traffic to an appliance like a firewall, gateway, proxy or to allow the Network Address Translation (NAT) to be done by a public IP assigned to the standard load balancer or appliance.

And Azure UDR only supports the following next hop : Virtual appliance, Virtual network gateway, None, Virtual network and Internet.
Virtual Appliance can be any VM or Firewall with IP forwarding option enabled or a load balancer. But NAT gateway is not a supported next hop.
Refer : https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#user-defined

So, the only available outbound connectivity options for AKS are Load balancer, UDR with next hop Azure Firewall/any supported next hop and NAT gateway.
Refer : https://learn.microsoft.com/en-us/azure/aks/egress-outboundtype#overview-of-outbound-types-in-aks
https://learn.microsoft.com/en-us/samples/azure-samples/aks-nat-agic/aks-nat-agic/

Regards,
Gita
Sign in to comment