Give a private subnet internet access

vm-app sits in subnet-app, a private subnet, and can't reach updates.example.org on 443 to download updates. It must not get a public IP of its own. Give subnet-app a NAT gateway.

1. Connect to vm-app.

   ssh vm-appType it
   What's this?

   Opens a shell on vm-app, so the next commands run on that VM. In this lab it's a shortcut. In real Azure you'd connect through something like Azure Bastion, or SSH to an address you can reach.

2. Try the site. It fails. Type exit when done.

   curl -sI https://updates.example.orgType it
   What's this?

   Fetches a web address and shows the reply. Tells you whether the web service itself answers, not just the port.

   • -s quiet: no progress bar
   • -I ask only for the headers, not the whole page

3. Create a Standard public IP.

   az network public-ip create -g rg-lab --name pip-nat --sku StandardType it
   What's this?

   Creates a public IP address that you can attach to things like Azure Bastion or a NAT gateway.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change

4. Create the NAT gateway with it.

   az network nat gateway create -g rg-lab --name nat-gw --public-ip-addresses pip-nat --idle-timeout 10Type it
   What's this?

   A NAT gateway gives a subnet explicit outbound internet access through the gateway's public IP.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change

5. Associate it with subnet-app.

   az network vnet subnet update -g rg-lab --vnet-name vnet-app --name subnet-app --nat-gateway nat-gwType it
   What's this?

   Changes a subnet's settings, such as which NSG or route table is attached to it.

   • -g the resource group the resources live in
   • --vnet-name the virtual network
   • --name the name of the thing to look at or change

6. Answer the question below.

   Which wins for internet traffic: a NAT gateway on the subnet, or a user-defined route 0.0.0.0/0 to a virtual appliance?

   NAT gateway

   Gives a subnet outbound internet access through the gateway's public IP.

   User-defined route

   A route you add in a route table: traffic for this range goes to this next hop.

   Prefix

   An address range written as start/bits, like 10.1.0.0/16. The number after the slash is how many leading bits are fixed.

   Appliance

   A VM, such as a firewall, that traffic is routed through.

   Check