Share via

Secure Access Design for Azure App Service Behind Public Gateway with VPN and IP Restrictions

Yasemin Aykalkan (Zer A.Ş.) 40 Reputation points
2025-04-30T17:00:13.0366667+00:00

Hi everyone,

We have an App Service running in Azure, and we are trying to implement strict and secure access controls — both for external integrations and internal users via VPN. We’ve configured the App Service’s access restrictions to allow only specific IP addresses and subnets. At the same time, we want to avoid exposing the default domain (*.azurewebsites.net) publicly without proper protections. Some external systems need to access the App Service over the internet — we want to allow these based on whitelisted IPs. Meanwhile, internal users are expected to connect through VPN.

To support each scenarios, we placed the App Service behind an Azure Application Gateway (Public Tier, WAF v2) that already had a WAF policy in place and was actively in use.

However, this architecture — as expected — introduced a critical issue:

The App Service must allow the public IP of the Application Gateway to receive traffic. As a result, the App Service becomes publicly accessible, since the client’s original IP address is not preserved when requests pass through the gateway.

To secure the setup, we tried using a Private Endpoint for the App Service and restricted access to only trusted VNets. Our intent was to ensure that external clients would not be able to resolve the private DNS unless they were connected to a secure network or VPN.

However, this introduced another challenge:

For the Application Gateway to remain healthy and forward traffic properly, it must be able to resolve the App Service’s private DNS name and connect to its private IP. This forced us to either: Deploy the Private Endpoint and Private DNS Zone in the same VNet as the Application Gateway, or Host them in a separate VNet and configure VNet peering between the gateway VNet and the App Service VNet.(Adding a virtual network link to the private DNS zone seemed sufficient for DNS resolution, but I assume it wasn't enough to route traffic to the private IP — so peering became necessary.)

The core issue is this:

Initially, we thought combining Application Gateway with a Private Endpoint would provide the necessary isolation and control. However, once the Application Gateway is able to resolve the private DNS and reach the Private Endpoint, any request, regardless of the client’s real IP, VNet, or VPN status, is treated as trusted internal traffic. In effect, the gateway becomes a public entry point into the Private Endpoint — which defeats our IP/VPN restriction strategy and brings us back to the original problem.

Could you please review our current architecture and confirm whether any misconfigurations might be at play? We're also looking for secure design recommendations that:

Protect the App Service from unauthorized public access

Allow access via whitelisted external IPs

Support internal access via VPN

Use WAF for external traffic inspection

Thanks in advance for your insights and guidance!

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,185 questions
Accepted answer
  1. Praveen Bandaru 3,145 Reputation points Microsoft External Staff Moderator
    2025-04-30T17:52:40.25+00:00

    Hello Yasemin Aykalkan (Zer A.Ş.)

    I understand that you were dealing with a complex setup involving your Azure App Service, Application Gateway, and Private Endpoints.

    Based on your description, it appears you want to ensure your App Service is not publicly accessible, while allowing trusted external IPs and providing secure internal access via VPN. Here’s a summary to enhance your architecture and security:

    1. Configure access restriction rules on your App Service to allow access only from the Application Gateway's public IP address using IP-based restrictions.
    2. If you want to connect privately to the App Service, you can deploy a private endpoint and target the App Service. This will establish an internal connection only within the VNET range, allowing access only to the App Service. Check the document for private endpoints for Azure App Service apps.
    3. Maintain robust WAF policies to inspect incoming traffic, protecting against common threats with custom rules as needed.
    4. Ensure VNet peering is configured correctly if your Application Gateway and App Service are in separate VNets, and that the Application Gateway has a route to the App Service's private IP.
    5. If you want to connect the App Service through the Application Gateway using a Hostname, you need to configure a DNS record pointing to the Application Gateway's frontend Private IP. Only then will the traffic pass through the Application Gateway privately.
    6. If you want to configure a single private IP for Application Gateway in its preview state, do not use it in a production environment. You need to configure both public and private frontend IP's on Application Gateway. Reference Document Application Gateway frontend IP address configuration
    7. Utilize Azure AD for Identity and Access Management to ensure only authenticated users can access your App Service.
    8. After implementing these changes, use tools like Azure Network Watcher to monitor network traffic, ensuring only whitelisted IPs can reach your Application Gateway and that the App Service remains inaccessible directly from the internet.
    9. Are you using Azure VPN Gateway for your internal users to connect via VPN

    Hope the above answer helps! Please let us know do you have any further queries.

    Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.