Azure Web Role can't see VM's internal IP (but VM can see web role)

Question

I have a web role (WR) and a virtual machine (VM) hosted on Azure, both are within the same Virtual Network (VNet), and on the same subnet.

If I look at the azure portal and go to the VNet page, the dashboard shows both my VM and my WR are on the network with internal IP addresses as I expect:

VM: 10.0.0.4
WR: 10.0.0.5

I can Remote Desktop to both machines, from the VM, I can ping 10.0.0.5 and get a response, from the WR, if I ping 10.0.0.4 all I ever get is a Timeout.

I've been following the instructions from: http://michaelwasham.com/2012/08/06/connecting-web-or-worker-roles-to-a-simple-virtual-network-in-windows-azure/ and there is no mention of any additional settings I need to do to either machine - but is there something I'm missing?

Do I need to open up the VM to be contactable?

Extra information:

• At the moment, the VM has an Http and Https end point available publicly, but I aim to turn those off and only use the WR for that (hence wanting to connect using the internal IP).
• I don't want to use the public IP unless there is absolutely no way around it, and from what I've read that doesn't seem to be the case.

Answer 1

为了完整起见，请将我的评论移到一个答案：当虚拟网络允许双向通信时，您需要通过防火墙启用ICMP，这样才能使ping正常工作。