Securing Web App Using Private Endpoint And Connecting Through Point To Site VPN with Gateway Transit

Authentication Type – Azure Certificate

Now leave this and create self-signed root and client certificate and get back to here.

Create Self-sign root & client certificate

As first step I am going to create root certificate. In Windows 10 machine I can run this to create root cert first.

Open Powershell ISE as run as Admin and run the below powershell command.

$cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature `

-Subject "CN=ARTICLEROOT" -KeyExportPolicy Exportable `

-HashAlgorithm sha256 -KeyLength 2048 `

-CertStoreLocation "Cert:\CurrentUser\My" -KeyUsageProperty Sign -KeyUsage CertSign

This will create root cert and install it under current user cert store.

Then we need to create client certificate. We can do this using

New-SelfSignedCertificate -Type Custom -DnsName REBELCLIENT -KeySpec Signature `

-Subject "CN=ARTICLECLIENT" -KeyExportPolicy Exportable `

-HashAlgorithm sha256 -KeyLength 2048 `

-CertStoreLocation "Cert:\CurrentUser\My" `

-Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")

This will create cert called REBELCLIENT and install in same store location.

Now we have certs in place. But we need to export these so we can upload it to Azure.

To export root certificate,

Right click on root cert inside certificate mmc.

Click on All Tasks- Export

In private key page, select not to export private key,

Select Base-64 encoded X.509 as export file format.

Complete the wizard and save the cert on pc.

To export client certificate,

Right click on root cert inside certificate mmc.

Click on All Tasks- Export

In private key page, select Yes export the private key,

In file format page, leave the default as following and click Next

Define password for the pfx file and complete the wizard.

Only root cert will use in Azure VPN, client certificate can install on other computers or Clients which need Point to site connections.

Now open the exported root certificate as Notepad,

And Copy the certificate data

When you paste certificate data, do not copy -----BEGIN CERTIFICATE----- & -----END CERTIFICATE----- text.

Now go to the Azure portal where the configure now Point to site has ended, and under the Root Certificate Tab, give the certificate a name and paste the certificate data in the public certificate data tab.

Save.

Now Download the VPN Client

Extract the VPN Client and double click on the VPN client setup. In my case I am using 64bit vpn client

After that, we can see new connection under windows 10 VPN page.

Click on connect to VPN. Then it will open up this new window. Click on Connect in there.

Now you can see HubVnet is Connected.

Now Disconnect the VPN So we can check the deployed app service is running or not by browsing the app service URL in Browser.

Please Note: If you make any changes to Peering’s, Removed the existing VPN Client and Re download the VPN Client again and connect, since new changes come with the downloaded VPN Client XML.

Step 8 - Private Endpoint

Search App Service

And select the deployed App service

In Overview – Copy the URL

Paste the URL in the Web Browser and check the app service running or not.

Now you can see your app service is up and running

Now we need to secure the app service by private endpoint, so the app service is not accessible to public and it only access by privately.

Navigate to Networking in App Service,

Click Private endpoints

Click ADD

And select the below highlighted details,

Click OK

It will take 2 to 5min.

Now You can see connection state is Approved.

Also check from Networking Tab is show On.

Do Nslookup, then you will get the private IP and Name

Now click VNet integration under the Outbound Traffic.

Add VNet and Select the HUBVnet and click OK

Now you can see VNet Integrations status is On.

Step 9

Go to the Web App and copy the URL of the application, paste the URL, now we will receive an Error 403 – Forbidden page.

Now you can try the same as connecting the VPN Client. Then you will receive the WebApp service is up and running.

Please Note: If you receive 403 error code in the P2S client, Then add a Host Record and Try again. Then you will receive the WebApp service is up and running.

Host Record – You can see the assigned private IP in the private endpoint as 10.10.0.5

Add the Host record as below,

10.10.0.5 mywebapp02.azurewebsites.net

Summary

We learned how to deploy an Azure Webapp, set up a point-to-site VPN, set up VNet Peering with Gateway Transit, and configure a private endpoint in this tutorial. Please leave a comment in the comment box if you have any questions.