Share via

Outbound traffic flow with Azure Firewall & NAT Gateway

Peter Stieber 245 Reputation points
2025-08-13T12:08:34.8666667+00:00

I have a spoke VNet that’s peered with a hub VNet. The hub contains an Azure Firewall, and the firewall subnet has a NAT Gateway associated with it.

I’m trying to understand the traffic flow when a VM in the spoke initiates a connection to an Internet destination (and the traffic is allowed).

How many times does the source IP get translated?

Does the Azure Firewall perform SNAT (changing the source to its own public IP), or does it leave the source as-is?

Since the NAT Gateway is in place, will the source IP be changed twice — first by the firewall, and then again by the NAT Gateway — or only once to the NAT Gateway’s public IP?

Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. G Sree Vidya 4,250 Reputation points Microsoft External Staff Moderator
    2025-08-14T04:57:20.8166667+00:00

    Hello Peter Stieber

    It looks like you're trying to understand the outbound traffic flow when a VM in a spoke VNet connects to the internet through an Azure Firewall and NAT Gateway setup.

    Please check the below details:

    1.Traffic Flow and NAT Behavior in VM in Spoke VNet initiates outbound traffic:

    Traffic is routed to the Azure Firewall in the hub via VNet peering.

    2.Azure Firewall processes the traffic, If the firewall allows the traffic, it will perform SNAT (Source Network Address Translation) unless:

    The destination is within the same VNet or peered VNet.

    You’ve configured Network Rules with “Translate” disabled (only possible with DNAT).

    For Internet-bound traffic, Azure Firewall will perform SNAT by default, using its own public IP.

    3.NAT Gateway on the firewall subnet:

    Does not apply to traffic already SNAT’d by the Azure Firewall.

    NAT Gateway only applies to resources in the subnet that are not performing their own SNAT.

    Since Azure Firewall already SNATs the traffic, NAT Gateway does not re-SNAT it.

    so Final Summary is the VM’s private IP is replaced by the Azure Firewall’s public IP and the NAT Gateway does not perform SNAT on traffic already processed by the firewall.

    • The final source IP seen by the Internet destination is the Azure Firewall’s public IP, not the NAT Gateway’s.

    I hope this helps! If these answers your query, do click the "Upvote" of which might be beneficial to other community members reading this thread.

    If the above is unclear or you are unsure about something, please add a comment below.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.