Lab: VNet addressing, routes, and effective rules

Outcome

Plan nonoverlapping address space, create a Standard public IP and a test VM, then use a reversible UDR and an NSG conflict to separate routing from authorization evidence.

Do

1. Draw two nonoverlapping CIDR ranges and subnets for workload and tools; leave capacity for growth. Create the VNet/subnets and a small test VM with a Standard static public IP only if direct administration is required for the lab. Record the private/public IP, SKU, zone choice if available, and DNS label.
2. Attempt to add an overlapping subnet range. Record the validation failure, choose a nonoverlapping range, and create it. Inspect Azure’s reserved addresses rather than assigning one to a VM.
3. Associate a route table with workload. Add a temporary route for a harmless test prefix with next hop None. Use Network Watcher Next hop or a supported connection test to record the route and failed reachability; remove the route and verify recovery. Do not point a virtual-appliance route at a VM unless it is configured to forward traffic.
4. Apply a lower-priority allow and higher-priority deny NSG rule for the test flow. Capture the NIC’s effective security rules and IP Flow Verify result, then remove the deny and retest.

Verify

Capture the CIDR plan, overlap failure, public-IP properties and detach/delete state, Next Hop result before/during/after the UDR, and effective-rule output. You should now understand: CIDR prevents address collisions, a route selects a next hop, and an NSG independently permits or denies the selected flow.

Break and fix

1. Use an overlapping prefix; correct the address plan.
2. Blackhole only the test prefix; locate the UDR in effective routes, remove it, and confirm the original next hop.
3. Deny the test port with a higher-priority NSG rule; locate the effective rule, remove it, and confirm access.

Scenario practice

1. Configure: Choose CIDR ranges, subnets, and a Standard public-IP lifecycle for a small public-facing training VM.
2. Diagnose: A VM can resolve a name but cannot connect after a route-table change. Which route, next hop, NSG, and appliance-forwarding facts do you inspect?
3. Distinguish: Contrast public IP with a private IP, UDR with an NSG, and an effective route with an effective security rule.

Clean up

Remove the UDR and test NSG rules, detach/delete the public IP, then delete the VM, route table, VNet, and disposable resource group.

Sources and re-audit

• Virtual network traffic routing, checked 2026-08-22.
• Public IP addresses, checked 2026-08-22.
• IP Flow Verify, checked 2026-08-22.

Re-audit when route, public-IP, or effective-rule semantics change.

Related

vnet · subnet · public-ip-address · route-table · effective-nsg-rules · All labs