2

I have an Azure Virtual network and I connect to the network using Point-to-point with the VPN client downloaded from Azure. This works as expected as I can now RDP to VMs in the VNet if required.

I also have an Azure SQL Server instance and in the firewall section I have added the VNet above to the Virtual networks rule list.

With my work laptop, I was now hoping that I would be able to connect to the VNet using the VPN client and then be able to access the SQL database using SSMS. However, when I try and connect I get a message telling me that I cannot access the server and instead need to add my client IP to the Firewall rule list, which is what I was trying to avoid doing.

Is there something else I need to be doing here to get this working?

Improve this question
1

1 Answer 1

Reset to default
3

Is there something else I need to be doing here to get this working?

If you just use an Azure SQL Database, which is a Paas in Azure, itself is not located inside a VNet. You can directly add the client Public IP in the firewall of Azure SQL Server. Whereas this is not your expectation. You need to make it inside a VNet, then you can do these followings.

If you are using a SQL Managed instance which located inside a VNet, want to access the Database instance from on-premises with a private address, you need to make a VPN connection or ExpressRoute connection between the on-premise and the Managed Instance VNet.

Now, you have a P2S VPN connection, you still need to make VNet peering with Gateway Transit between the P2S VNet with SQL instance VNet. Note: To use remote gateways or allow gateway transit, the peered virtual networks must be in the same region. To do so, make the following very specific changes under the Peering settings.

In the VNet that hosts the VPN gateway, go to Peerings, then to the Managed Instance peered VNet connection, and then click Allow Gateway Transit.

In the VNet that hosts the Managed Instance, go to Peerings, then to the VPN Gateway peered VNet connection, and then click Use remote gateways.

Once the peering complete, you can check the status on the Azure portal. You need to remove the VPN client and re-download it and re-install it on your laptop, this will make the route update on your client side.

If you've established on-premises to Azure connection successfully and you can't establish a connection to Managed Instance, check if your firewall has an open outbound connection on SQL port 1433 as well as 11000-12000 range of ports for redirection.

For more reference, you can read Connect your application to Azure SQL Database Managed Instance.

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

Thanks for the response. I'm not sure I understand though. I have the PAAS solution not the managed instance. Are you saying that the only way to get my work laptop to talk to the database is to use the Firewall IP rule and that the VPN rule will not work, even though I have set up a Point-to-point VPN connection from laptop to VPN.
Yes, You just could access the resource in the VNet what gatewaysubnet reside in via P2S VPN with private IP address, could not access the other resources in Azure. Also the Paas SQL database is public service, not in a vnet, you could not fully control it essentially. Here is a similar case, social.msdn.microsoft.com/Forums/azure/en-US/…

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.