有没有一种方法可以仅从特定的公共 IP 地址集允许点到站点 VPN 连接到 Azure VNet？

Question

I have Azure VNET and a VPN Gateway setup. Point-to-Site VPN connection has been setup, so users can access VMs on the VNET. Is there anyway I can allow VPN connection only if connection is coming from a known public facing IP address from corporate on-prem network?

Answer 1

Point-to-site VPN connection is between a single PC connected to your network and Azure VPN gateway over the internet. The VPN client was assigned private IP address from the address pool. This on-demand connection is initiated by the user and secured by using a certificate. The connection uses the SSTP protocol on port 443 to provide encrypted communication over the internet between the PC and the VNet.

If you only allow some clients to set up VPN connection, you just need to install client certificate on some specific client machine and don't install client certificate on some clients that you don't want to connect to VPN gateway. If you want to restrict the access from some clients to access your VMs on the VNET. The clients should disconnect the VPN connection and restrict it's public IP address in the NSG associated with that Azure VM subnet or NIC.

P2S connections are useful for remote employees or those that only want to establish connectivity when they need it and can disconnect from the Azure VNet when they are finished with their tasks.

You could get more details from this wonderful blog .