Skip to content

🧠 What is Point-to-Site (P2S) VPN?

Image

Image

Point-to-Site VPN allows:

  • A single client machine (laptop)
  • To connect securely to Azure VNet
  • Over an encrypted tunnel

Real-world uses

  • Developers accessing private DBs
  • Admins managing VMs securely
  • Work-from-home access
  • Zero-Trust style access

🧱 Final Architecture (Mental Model)

Developer Laptop
   |
   |  OpenVPN / SSL Tunnel
   |
Azure VPN Gateway
   |
GatewaySubnet
   |
Azure VNet
   |
Private Subnets → VM / App / DB

No on-prem firewall required. No public exposure.

STEP 0️⃣ Prerequisites (Must Have)

Requirement Notes
Azure VPN Gateway Route-based only
SKU VpnGw1 or higher
VNet address space Must NOT overlap P2S pool
Client OS Windows / Linux / macOS

STEP 1️⃣ Choose P2S Authentication Method

Azure supports 3 methods:

Method Use Case Recommendation
Certificate Labs / learning ✅ Start here
Azure AD Enterprise ⭐ Best
RADIUS Legacy ❌ Rare

👉 This tutorial uses Certificate-based auth (best for learning).

STEP 2️⃣ Define P2S Address Pool

This is the IP range given to VPN clients.

⚠️ Must NOT overlap:

  • VNet CIDR
  • On-prem CIDR

Example

VNet        → 10.0.0.0/16
On-prem     → 192.168.1.0/24
P2S clients → 172.16.201.0/24

STEP 3️⃣ Configure P2S on VPN Gateway (Portal)

VPN Gateway → Point-to-site configuration → Configure now

Settings

Field Value
Address pool 172.16.201.0/24
Tunnel type OpenVPN (SSL)
Authentication Azure certificate
Root certificate Upload

📌 Do NOT save yet — we need certificates first.

STEP 4️⃣ Create Root Certificate (On Your Laptop)

This cert proves “I trust clients signed by me”

Create root key

openssl genrsa -out root.key 2048

Create root certificate

openssl req -x509 -new -nodes \
  -key root.key \
  -sha256 -days 365 \
  -out root.crt

✔ root.key → keep secret ✔ root.crt → upload to Azure

STEP 5️⃣ Upload Root Certificate to Azure

VPN Gateway → Point-to-site → Root certificates
Field Value
Name root-cert
Public cert data content of root.crt 
cat root.crt

Copy entire output (including BEGIN/END).

STEP 6️⃣ Generate Client Certificate

Each laptop must have its own client cert.

Client key

openssl genrsa -out client.key 2048

Client CSR

openssl req -new \
  -key client.key \
  -out client.csr

Sign with root certificate

openssl x509 -req \
  -in client.csr \
  -CA root.crt \
  -CAkey root.key \
  -CAcreateserial \
  -out client.crt \
  -days 365 \
  -sha256

STEP 7️⃣ Install Client Certificate on Laptop

🔹 Windows

  1. Double-click client.crt
  2. Install → Current User
  3. Store → Personal

🔹 Linux

sudo cp client.crt /etc/ssl/certs/
sudo cp client.key /etc/ssl/private/

🔹 macOS

  • Import into Keychain Access
  • Mark as trusted

STEP 8️⃣ Save P2S Configuration

Now go back to Azure Portal and Save P2S config.

⏳ Takes ~5 minutes

STEP 9️⃣ Download VPN Client

VPN Gateway → Point-to-site → Download VPN client

This gives:

  • Windows installer
  • OpenVPN config for Linux/macOS

STEP 🔟 Connect to VPN

🔹 Windows

  • Open Azure VPN Client
  • Click Connect

🔹 Linux

sudo openvpn --config azurevpnconfig.ovpn

🔹 macOS

  • Import .ovpn into Tunnelblick / Viscosity

STEP 1️⃣1️⃣ Validate VPN Connection (CRITICAL)

✔ Check client IP

ip addr   # Linux
ipconfig  # Windows

Expected:

172.16.201.x

✔ Test private VM access

ping 10.0.1.4
ssh user@10.0.1.4

✔ Works = VPN successful ❌ Fails = routing / NSG issue

✔ Check Azure Effective Routes

VM → Networking → Effective routes

You should see:

172.16.201.0/24 → Virtual network gateway

🔐 Security Best Practices

Rule Why
Use OpenVPN only Secure & flexible
Rotate client certs Prevent abuse
Disable unused certs Least privilege
Use Azure AD auth Enterprise-grade
Combine with Private Endpoint Zero Trust

🧠 Common Problems & Fixes

Issue Cause Fix
VPN connects but no access NSG blocks Allow VNet CIDR
DNS not resolving No private DNS Configure DNS
Overlapping CIDR Bad IP plan Redesign ranges
Client cert rejected Wrong root cert Re-upload

🏁 Final Mental Model

Root Certificate   → Trust authority
Client Certificate → User identity
P2S Pool           → Client IPs
VPN Gateway        → Entry point
VNet               → Private resources