Azure 私有端点 - 监听限制

Question

I'm experiencing some deeply frustrating issues when trying to connect to a SQL server Private Endpoint. Setting aside for a moment a complete specification of the problem, I'd like answers to the following questions

1. Is it the case that a SQL Server Private Endpoint will only listen to connections from an Azure Virtual Machine? I have seen it suggested by 3rd parties that this is the case but cannot find this explicitly documented by MS. (To clarify, if only VMs can connect, then this would mean, for example, that an Azure Load Balancer could not use Private Endpoint as a backend resource; and, for example, that an on-premise VM could not connect to a Private Endpoint through a VPN - is that correct?)

2. Presuming the answer to the above question is Yes, then does the restriction apply such as to prevent Private Endpoint from listening to connections forwarded from an Azure VM interface?

(For example, say a firewall in a VM in Azure. Inside the firewall VM, the IP 192.168.0.10 is configured. In Azure, the VM interface is associated with only a single IP address which is IP 192.168.0.6. In this scenario, the firewall VM will respond to ARP requests with ARP responses saying "I have 192.168.0.10", but 192.168.0.10 is not associated by Azure configuration with any Azure virtual network interface. In said case, will a connection to the Private Endpoint using source address 192.168.0.10 work? Or is it the case that the PE will listen for connections only with a source address 192.168.0.6?)

Answer 1

To answer your questions:

1. It's possible that use a private endpoint as backends in the Azure Load balancer because Azure LB supports NIC or IP address as the backend target. Also, the on-premise VM surely can connect to a private endpoint through VPN tunneling, read this document for more details.
2. A VM by default sends all outbound traffic to the IP address that's assigned to the primary IP configuration of the primary network interface. So it will use source address 192.168.0.6 when connecting to the private endpoint. Read the network interface constraints .