Virtual Network

A Virtual Network is the private, isolated network for your Azure resources — a regional address space you carve into subnets, where VMs, databases, and private endpoints attach. Nothing routes in or out except through the rules and gateways you define. It is the boundary almost everything else in Azure builds on.

The address plan still deserves care up front. You can now add or modify a VNet's address ranges even while it is peered (the peering re-syncs), but overlapping ranges between VNets you want to connect remain unfixable except by renumbering one side — peering and on-premises connectivity simply refuse to establish across an overlap. Plan the address space before you create anything, with room for the subnets and growth you have not designed yet.

Address Space and Subnets

A VNet has one or more CIDR address ranges, divided into subnets that group resources and apply routing and security. Subnets reserve five addresses each for Azure's use, and some services (like a VPN gateway or a Managed Instance) require their own dedicated subnet. Size subnets for growth — resizing a populated subnet is disruptive, and running out of addresses mid-project is a self-inflicted outage.

Network Security Groups

A Network Security Group is a stateful set of allow and deny rules, attached to a subnet or a network interface, filtering traffic by source, destination, port, and protocol. Because it is stateful, a return packet for an allowed flow is permitted automatically. NSGs are the basic segmentation primitive — least-privilege rules at the subnet boundary, not a default-allow posture.

Peering and Connectivity

VNet peering joins two VNets into one low-latency, privately routed network, within or across regions. Peering refuses to establish across overlapping address ranges — the concrete reason address planning comes first. Peering is non-transitive: if hub peers with spoke A and spoke B, A and B do not reach each other through the hub without a route and a network virtual appliance or gateway.

Private and Service Endpoints

A private endpoint gives a PaaS service (a storage account, a SQL database) a private IP inside your VNet, so traffic to it never touches the public internet. A service endpoint instead extends the subnet's identity to the service over the Azure backbone. Private endpoints are the stronger, more general model and the modern default for keeping PaaS traffic private.

Routing

Azure provides default system routes; a user-defined route table overrides them to force traffic through a next hop — typically a firewall or network virtual appliance for inspection. Forced tunneling sends internet-bound traffic back on-premises for inspection. Custom routing is how you insert security and control into the path, at the cost of complexity you must maintain.