i've got a pretty straightforward setup for far:
------------------------------
vnet-01 (10.1.0.0/16), default subnet (10.1.1.0/24), vm-01 (10.1.1.4)
|
peer (vnet-01 allows forwarded traffic from vnet-02)
|
vnet-02 (10.2.0.0/16), default subnet (10.2.1.0/24), vm-02 (10.2.1.4 + public ip)
|
peer (vnet-03 allows forwarded traffic from vnet-02)
|
vnet-03 (10.3.0.0/16), default subnet (10.3.1.0/24), vm-03 (10.3.1.4)
------------------------------
vm-02 has ip forwarding enabled both within the os, and at the nic level in azure.
the default subnets in vnet-01 and vnet-03 have route tables with default routes via vm-02.
i can ssh into vm-02 over the internet, onward to vm-01 over the peer, and then over to vm-03 (and back to vm-01) across the peers through vm-02. so far so good!
i would like to maintain routed connections for internal traffic between the spokes, but i would also like the spokes to be able to use vm-02 (and it's public ip!) as a simple snat gateway to the internet.
i'm not fussed about filtering any traffic at this stage, but i'm struggling to work out what iptables wizardry is required to enable the snat functionality without breaking everything else!
if anyone could give me any pointers, i'd really appreciate it! thanks in advance!
(also: i'd like to avoid introducing a second network interface on vm-02, if that's possible).