Azure VPN Gateway Terraform Guide

What is this Azure VPN Gateway Terraform page?

This is a practical implementation page for engineers who want to create an Azure VPN Gateway using Terraform. It shows how the Azure building blocks fit together in a real site-to-site pattern instead of giving only a tiny sample with no surrounding explanation.

Why use Terraform for Azure VPN Gateway?

VPN connectivity is usually part of a larger network story. When gateway settings, remote prefixes, shared keys, and connection settings are scattered across manual steps, drift becomes easy. Terraform gives you repeatability, reviewability, and a cleaner way to keep Azure and network changes aligned.

Azure VPN Gateway explained with the 5 Ws

Types and modes you should know before writing the code

One reason VPN Gateway pages become confusing is that many connection styles are described together. This page keeps them separate so the Terraform example stays readable.

Core Azure VPN Gateway components in Terraform

How Azure VPN Gateway works in practice

Think of the deployment as two sides learning to trust each other. Azure publishes one side of the tunnel, the remote device publishes the other, and the connection resource describes how the tunnel should be established.

1. Create a VNet for Azure workloads.
2. Create a dedicated GatewaySubnet inside that VNet.
3. Allocate a public IP for the Azure VPN Gateway.
4. Create the Azure virtual network gateway with gateway type Vpn and usually RouteBased VPN type.
5. Create a local network gateway representing the remote site's public VPN IP and on-premises address ranges.
6. Create the connection resource using a shared key for IPsec/IKE tunnel establishment.
7. Once both sides match on policies and routing, encrypted traffic can move between Azure and the remote network.

Simple Azure VPN Gateway site-to-site diagram

This diagram is intentionally different from the Virtual WAN page. It follows the classic per-VNet Azure VPN Gateway model with a remote site on the other side.

          On-Premises / Branch Office
     +-----------------------------------+
     | VPN Device / Edge Router          |
     | Public IP: 203.0.113.10           |
     | Local Prefixes: 192.168.10.0/24   |
     +----------------+------------------+
                      ||
                      ||  IPsec / IKE Site-to-Site VPN Tunnel
                      ||
+---------------------++--------------------------------------------------+
|                     Azure Public Internet Edge                           |
+---------------------++--------------------------------------------------+
                      ||
                      ||
     +----------------vv------------------+
     | Azure Public IP                    |
     | Attached to VPN Gateway            |
     +----------------+-------------------+
                      |
                      |
     +----------------v-------------------+
     | Azure Virtual Network Gateway      |
     | Type: VPN                          |
     | VPN Type: RouteBased               |
     | SKU: VpnGw1 / AZ SKU as needed     |
     +----------------+-------------------+
                      |
               +------v------+
               | GatewaySubnet|
               | 10.20.255.0/27
               +------+- -----+
                      |
     +----------------v-------------------+
     | Azure VNet                         |
     | 10.20.0.0/16                       |
     | Apps / Data / Private workloads    |
     +------------------------------------+

Azure VPN Gateway Terraform example

This example builds a clean site-to-site design: resource group, VNet, GatewaySubnet, public IP, VPN gateway, local network gateway, and the IPsec connection. It is intentionally production-shaped without becoming overcomplicated.

terraform {
  required_version = ">= 1.5.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 3.100.0"
    }
  }
}

provider "azurerm" {
  features {}
}

locals {
  location            = "South Africa North"
  resource_group_name = "rg-cn-vpngw-san-1"

  vnet_name           = "vnet-cn-hybrid-san-1"
  vnet_cidr           = ["10.20.0.0/16"]
  gateway_subnet_cidr = "10.20.255.0/27"

  gateway_pip_name    = "pip-cn-vpngw-san-1"
  gateway_name        = "vpngw-cn-san-1"
  gateway_sku         = "VpnGw1"

  local_gateway_name  = "lng-onprem-hq-1"
  remote_gateway_ip   = "203.0.113.10"
  remote_prefixes     = ["192.168.10.0/24", "192.168.20.0/24"]

  connection_name     = "conn-cn-azure-to-onprem-1"
  shared_key          = "ReplaceWithStrongSharedKey123!"
  
  tags = {
    environment = "lab"
    workload    = "networking"
    owner       = "cloudnetworking-io"
    managed_by  = "terraform"
  }
}

resource "azurerm_resource_group" "this" {
  name     = local.resource_group_name
  location = local.location
  tags     = local.tags
}

resource "azurerm_virtual_network" "this" {
  name                = local.vnet_name
  location            = azurerm_resource_group.this.location
  resource_group_name = azurerm_resource_group.this.name
  address_space       = local.vnet_cidr
  tags                = local.tags
}

resource "azurerm_subnet" "gateway" {
  name                 = "GatewaySubnet"
  resource_group_name  = azurerm_resource_group.this.name
  virtual_network_name = azurerm_virtual_network.this.name
  address_prefixes     = [local.gateway_subnet_cidr]
}

resource "azurerm_public_ip" "gateway" {
  name                = local.gateway_pip_name
  location            = azurerm_resource_group.this.location
  resource_group_name = azurerm_resource_group.this.name
  allocation_method   = "Static"
  sku                 = "Standard"
  tags                = local.tags
}

resource "azurerm_virtual_network_gateway" "this" {
  name                = local.gateway_name
  location            = azurerm_resource_group.this.location
  resource_group_name = azurerm_resource_group.this.name

  type     = "Vpn"
  vpn_type = "RouteBased"
  sku      = local.gateway_sku

  ip_configuration {
    name                          = "vpngateway-ipconfig"
    public_ip_address_id          = azurerm_public_ip.gateway.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway.id
  }

  enable_bgp = false
  active_active = false

  tags = local.tags
}

resource "azurerm_local_network_gateway" "onprem" {
  name                = local.local_gateway_name
  location            = azurerm_resource_group.this.location
  resource_group_name = azurerm_resource_group.this.name
  gateway_address     = local.remote_gateway_ip
  address_space       = local.remote_prefixes

  tags = local.tags
}

resource "azurerm_virtual_network_gateway_connection" "s2s" {
  name                = local.connection_name
  location            = azurerm_resource_group.this.location
  resource_group_name = azurerm_resource_group.this.name

  type                       = "IPsec"
  virtual_network_gateway_id = azurerm_virtual_network_gateway.this.id
  local_network_gateway_id   = azurerm_local_network_gateway.onprem.id

  shared_key = local.shared_key

  tags = local.tags
}

output "resource_group_name" {
  value = azurerm_resource_group.this.name
}

output "vpn_gateway_name" {
  value = azurerm_virtual_network_gateway.this.name
}

output "local_network_gateway_name" {
  value = azurerm_local_network_gateway.onprem.name
}

output "connection_name" {
  value = azurerm_virtual_network_gateway_connection.s2s.name
}

output "gateway_public_ip_id" {
  value = azurerm_public_ip.gateway.id
}

location            = "South Africa North"
resource_group_name = "rg-cn-vpngw-san-1"
vnet_name           = "vnet-cn-hybrid-san-1"
gateway_name        = "vpngw-cn-san-1"
gateway_sku         = "VpnGw1"
remote_gateway_ip   = "203.0.113.10"
remote_prefixes     = ["192.168.10.0/24", "192.168.20.0/24"]

terraform init
terraform fmt
terraform validate
terraform plan -out tfplan
terraform apply tfplan

What the Terraform code is doing

Real-world Azure VPN Gateway Terraform use cases

Classic VPN Gateway is still highly relevant because not every organization starts with Virtual WAN or ExpressRoute.

Azure VPN Gateway vs Virtual WAN vs ExpressRoute

The wrong comparison is often the reason teams overbuild or underbuild hybrid networking. This table gives the practical view.

Azure VPN Gateway Terraform best practices

• Plan your address space carefully. Azure prefixes and remote prefixes must not overlap.
• Use a properly sized GatewaySubnet. Do not make it an afterthought, especially if the design may evolve.
• Prefer route-based designs for modern deployments. They fit better with multi-site and advanced routing scenarios.
• Keep shared keys out of plain code. Use secret management or sensitive pipeline variables in real environments.
• Choose the right gateway SKU. Capacity, features, and architecture goals should drive the SKU choice.
• Use active-active where justified. High-availability patterns and more demanding environments often benefit from it.
• Consider BGP early if routing will grow. Dynamic route exchange is often easier than managing many static prefixes later.
• Tag resources consistently. Ownership, cost, and environment tags make later operations easier.

Common mistakes engineers make with Azure VPN Gateway

Frequently asked questions about Azure VPN Gateway Terraform

Related Azure networking pages

These links help users move naturally through the Azure networking section without making the VPN Gateway page feel isolated.