How to Restrict On-Premises Access to Specific Endpoints in a Hub-and-Spoke VNet Architecture with Site-to-Site VPN?

I have a question related to this topic: https://learn.microsoft.com/en-us/answers/questions/1361035/how-to-allow-and-restrict-resources-in-site-to-sithttps://learn.microsoft.com/en-us/answers/questions/1361035/how-to-allow-and-restrict-resources-in-site-to-sit.

Description:

I have a VNet with a VPN Gateway set up, which acts as a hub and has peerings with three other VNets that host my production, testing, and development resources. Within each of these VNets, there are specific endpoints that the on-premises device should have access to (addresses are just examples):

Production: 10.100.1.2 Testing: 10.100.2.2 Development: 10.100.3.2

According to the first topic, I should modify the NSG rules in all three VNets. However, I found another topic: https://learn.microsoft.com/en-us/answers/questions/767869/site-to-site-vpn-subjects-to-nsg, which suggests that once traffic enters the Azure network via the VPN gateway in the hub VNet, it is treated as originating from within the Azure network itself. Consequently, my NSG rules would not work as intended, and the on-premises device would have access to all my resources.

What is the proper way to address this issue?

How to Restrict On-Premises Access to Specific Endpoints in a Hub-and-Spoke VNet Architecture with Site-to-Site VPN?

To restrict on-premises access to specific devices within an Azure VNet, you can use several methods. The most effective methods are listed below:

1. The most secure method is to use Azure Firewall, although it may not be the most cost-effective option.

2. The second approach is using Network Security Groups , which are cost-effective and easiest way.

NSG Rule

If you want to block specific endpoints in an Azure VNet from a VPN network, you can configure the Network Security Group rules. You can specify the NSG rule with the source set to the VPN network range and the destination set to the IP addresses or subnets of the Azure-connected resources.

Firewall configuration

You can follow the Azure Firewall in a hybrid network for restricting the traffic from VPN ranges to Azure Vnet.

Refences:

Filter network traffic with a network security group using the Azure portal

How to block network traffic with Azure Virtual Network Manager - Azure portal