User-Defined Routes and Custom Routing in Azure

Evaluate Route Propagation and Override Behaviors

System Routes and User-Defined Overrides

Azure automatically manages traffic using system routes, which are default paths created for every subnet. While these routes enable basic connectivity, administrators often need to override them to meet specific security or architectural needs. By creating a route table and associating it with a subnet, you can manually define the path for specific traffic patterns using User-Defined Routes (UDRs). This configuration allows for precise control over how data moves between different parts of your cloud environment.

Route Selection and Precedence

When multiple routes exist for the same destination, Azure uses the Longest Prefix Match (LPM) algorithm to select the most specific path. If two routes have identical prefixes, Azure follows a strict priority order to determine the effective path. Custom configurations always take precedence over default Azure behaviors, resolving conflicts in complex network designs. The priority order is:

• User-defined routes (UDR)
• Border Gateway Protocol (BGP) routes
• System routes

Next Hop Types and BGP

A next hop defines the intermediate device or location where traffic is sent before reaching its final destination. Azure supports several next hop types to control traffic flow, including a Virtual Appliance for third-party firewalls, a Virtual Network Gateway for VPN or ExpressRoute, and the Internet for direct public access. Additionally, BGP allows on-premises networks to propagate routes into Azure. This propagation can be disabled on specific subnets to maintain tighter control, except for the gateway subnet.

Forced Tunneling and Security

Administrators often implement forced tunneling by creating a UDR for the 0.0.0.0/0 address prefix. This configuration redirects all internet-bound traffic to a Network Virtual Appliance (NVA) or an on-premises gateway for inspection. This is a critical strategy for maintaining compliance and ensuring that all outbound data passes through a centralized security stack. It also prevents virtual machines from communicating directly with the public internet without oversight.

Verification and Effective Routes

To confirm that routing is behaving as expected, you must examine the effective routes on a specific Network Interface (NIC). This view provides a synthesized list of all active paths, including default system entries, manually configured UDRs, and routes learned via BGP. Using tools like Azure Network Watcher's Next Hop feature can further help diagnose if a custom route is incorrectly dropping or misdirecting traffic. This verification step is essential for troubleshooting connectivity issues in a production environment.

Service Endpoints and Longest Prefix Match

It is important to note that service endpoints can also influence the route table by adding specific public IP addresses for Azure services. These routes are automatically managed by Azure and are only added to the subnets where the endpoint is enabled. Because these routes have very specific prefixes, they often take precedence over more general routes due to the longest prefix match rule. This behavior ensures that traffic to services like Azure Storage stays on the Microsoft backbone network.

Define and Implement Custom Routes

Types of Network Routes

Azure automatically creates and manages several types of routes within your virtual network. System routes are default paths that cannot be modified, while subnet default routes facilitate communication within subnets. When you configure virtual network peering or enable service endpoints, Azure automatically adds corresponding routes. Additionally, BGP routes propagate from on-premises gateways, and users can create custom UDRs to override these defaults.

Steps to Create User-Defined Routes

To direct traffic through custom paths, you must explicitly configure and apply custom routing rules. This process involves a sequence of deployment steps that configure how traffic is handled. This systematic association ensures that only the targeted subnets adhere to your custom traffic rules:

• Create a route table resource in your Azure subscription.
• Associate the route table with one or more subnets in your virtual network.
• Define custom routes specifying the destination prefix and the next hop type.

Next Hop Categories

When defining custom routes, choosing the correct next hop type is critical for routing behavior. You can direct traffic to a VPN gateway to send data securely to on-premises networks. Alternatively, selecting the Internet option allows direct outbound traffic. For advanced filtering, directing traffic to a virtual appliance lets you intercept and inspect packets before they proceed.

Route Selection Order

When a packet is forwarded, Azure evaluates the routing table to find the longest prefix match. If multiple matches share the same prefix length, Azure falls back on a predefined evaluation order. Custom user-defined routes are evaluated first, followed by BGP routes. System routes are evaluated last, serving as the default fallback when no custom rules apply.

Security Filtering with Network Security Groups

To complement custom routes, Network Security Groups (NSGs) are used to filter traffic entering or leaving your subnets. These resources contain security rules that allow or deny traffic based on protocol, port ranges, and IP addresses. You can associate an NSG with a subnet or directly with a NIC to enforce strict security boundaries. By combining custom routing with NSG rules, you establish robust control over your network topology.

Effective Routes Verification

The combination of system routes, BGP routes, and UDRs determines the active network paths for any resource. You can view these effective routes directly through the Azure Portal, PowerShell, or Azure CLI. Analyzing this list is the most reliable way to troubleshoot connectivity issues and verify that your custom routes are properly applied. It helps confirm that traffic flows exactly as intended across your virtual boundaries.

Implement and Associate Route Tables for Targeted Traffic Control

Network Virtual Appliance Integration

Custom routing allows you to insert an NVA into your traffic path for deep packet inspection. To support this configuration, you must enable IP forwarding on the NVA's network interface to let it process transit traffic. You then define the NVA's private IP address as the next hop in your route table. Finally, associating this route table with the correct subnet ensures all outbound traffic is routed through the security appliance.

Hybrid Connectivity and Forced Tunneling Setup

Custom routing plays a vital role in hybrid environments that connect Azure to on-premises data centers. Forced tunneling is a specific setup that redirects all internet-bound traffic back to your local infrastructure using a virtual network gateway. This setup ensures that cloud-based resources undergo local security auditing and comply with corporate governance policies. It prevents virtual machines from accessing the public internet directly.

System Route Selection Logic

Azure relies on a strict priority hierarchy when multiple routing paths to a destination exist. The system always prioritizes the most specific destination prefix first using longest prefix match. If prefix lengths are identical, Azure prioritizes UDRs over both BGP routes and default system routes. This behavior guarantees that your custom security and architecture designs cannot be bypassed by default system paths.

Automated Route Management

For large enterprise environments, Azure Virtual Network Manager helps automate and centralize your routing policies. This service allows you to create routing configurations that handle up to 1,000 routes, far exceeding standard manual configuration limits. It automatically applies the correct route tables to new virtual networks as they are deployed. This automation reduces administrative overhead and ensures consistent security policies as your cloud footprint scales.