Azure UDR Tips: Overcoming 0.0.0.0/0 Limitations to Redirect Default Traffic to On-Premise Gateway
Half of the difficulties in Azure Networking come from UDR setting
In Azure, the default route (0.0.0.0/0) for Azure VMs is directed to the Internet by default. See Azure Virtual network traffic routing - 0.0.0.0/0 prefix
When a subnet is created, Azure creates a default route to the 0.0.0.0/0 address prefix, with the Internet next hop type. If you don't override this route, Azure routes all traffic destined to IP addresses not included in the address prefix of any other route to the internet.
If I want to change the default route (0.0.0.0/0) to the on-premise gateway instead of default outbound access / Azure Firewall / NVA. how should I do it?
Set up UDR for Spoke VNet
Most of the demand for this typically arises within the Spoke VNet, so we need to create an Azure Route Table (a.k.a UDR) specifically for the Spoke VNet.
- Add new default route and set next hope type - Virtual Network Gateway
| Name | Address prefix | Next hop type | Next hop IP address |
|---|---|---|---|
| default-route | 0.0.0.0/0 | Virtual Network Gateway | - |
- Associate subnets with this type of need
- Propagate gateway routes:
YesorNoare acceptable, because 0.0.0.0/0 includes 10.255.0.0/16. Here we use the default valueYes
Adjust Local Network Gateway
The configuration below routes any traffic destined for the 10.255.0.0/16 network through the Local Network Gateway (lng-tf-onprem). Since we now need to cover the entire 0.0.0.0/0 address space, this setting must be adjusted accordingly.
Due to "The prefix must be between 1 and 32", 0 cannnot be entered
So Replace the original address space with 0.0.0.0/1 and 128.0.0/1 to represent 0.0.0.0/0
0.0.0.0/0 = 0.0.0.0/1 + 128.0.0.0/1
Connectivity Result
Use curl ifconfig.me to verify the external IP
[BONUS] Adjust specific destination routes instead of 0.0.0.0/0
If I only want 8.8.8.8/32 to go through on-premise gateway while keeping other routes unchanged, what should I do?
Set up specific UDR for Spoke VNet
Propagate gateway routes: Yes . You need to receive gateway routes from Virtual Network Gateway, otherwise packets will not reach the on-premise gateway.
Append specific route into Local Network Gateway
Connectivity Result
