Azure Bastion — SKUs, AzureBastionSubnet and NSG rules, peering and roles, forced tunnelling, and connection failures
Reaching VMs without public IPs through Azure Bastion — what Developer, Basic, Standard and Premium each allow (peering, native client, IP connect, shareable links, private-only, session recording), the /26 AzureBastionSubnet and its exact NSG rules, the Reader roles a user needs, why forced tunnelling and a linked privatelink.azure.com zone break it, SKU upgrade problems, and the target-VM causes of failed sessions.
markdownreferencev1891H-GZ4Mstage: operatetrust: officialservice: networkinginterface: portalinterface: cliAzure BastionBastion Developer SKUBastion Basic Standard PremiumAzureBastionSubnet /26Bastion NSG rulesGatewayManager 443ports 8080 5701AllowAzureCloudOutboundBastion native client az network bastion sshIP-based connectionshareable linkprivate-only Bastionsession recordingBastion forced tunneling not supported0.0.0.0/0 Bastionprivatelink.azure.com management.privatelink.azure.comarm-frontdoor-prod.trafficmanager.netBastion peered VNet VM not visibleReader role BastionFailed to add subnetBastion SKU upgradeBastion SKU downgrade
Azure Bastion
SKUs
| Developer | Basic | Standard | Premium | |
|---|---|---|---|---|
AzureBastionSubnet / public IP | No / No (shared infrastructure, free) | Yes / Yes | Yes / Yes | Yes / No if private-only |
| VMs in peered VNets, concurrent sessions | No | Yes | Yes | Yes |
| RDP to Linux, SSH to Windows, custom ports | No | No | Yes | Yes |
| Native client (CLI), file transfer, IP-based connect, shareable links | No | No | Yes | Yes |
| Private-only deployment, session recording | No | No | No | Yes |
Downgrading isn't supported. Upgrades go up a tier (about 10 minutes) and need Contributor or Owner on the resource group; from Developer you must first create AzureBastionSubnet. New features stay off after an upgrade until you enable them under Configuration.
The subnet and its NSG
AzureBastionSubnet, /26 or larger (bigger allows more scale units), Standard public IP. If you put an NSG on it, it needs all of these:
| Direction | Source → destination | Ports |
|---|---|---|
| Inbound | Internet (or your public ranges) → any | 443 |
| Inbound | GatewayManager → any | 443 |
| Inbound | AzureLoadBalancer → any | 443 |
| Inbound | VirtualNetwork → VirtualNetwork | 8080, 5701 |
| Outbound | any → VirtualNetwork (target VMs) | 22, 3389 (and custom ports) |
| Outbound | any → AzureCloud | 443 |
| Outbound | VirtualNetwork → VirtualNetwork | 8080, 5701 |
| Outbound | any → Internet | 80 |
Target VMs need 22/3389 open from the Bastion subnet, not from the internet.
Failures
| Symptom | Cause → fix |
|---|---|
Portal Deploy Bastion: Failed to add subnet | Create AzureBastionSubnet yourself first |
| Sessions fail after adding a default route | Forced tunnelling isn't supported: no 0.0.0.0/0 UDR to an NVA on AzureBastionSubnet, and don't propagate a default route from VPN, ExpressRoute or Route Server to it |
Sessions fail when privatelink.azure.com is linked to the Bastion VNet | management.azure.com then resolves into that zone. Add a CNAME management → arm-frontdoor-prod.trafficmanager.net in it |
| A VM in a peered VNet doesn't appear | The user needs Reader on the VM, its NIC, the Bastion resource and the peered VNet |
| Connection blocked | A missing NSG rule from the table above, Azure Firewall in the path, or the guest firewall |
| Session starts then fails | Target VM stopped, RDP or SSH service down, VM agent unhealthy, NLA settings, guest firewall |
| Moving the VNet to another resource group | Not supported with Bastion in it: delete Bastion, move, redeploy |