title: Azure web app can't see VM through vnet-to-vnet connection
body: <p>I have a VM running a WebAPI service that I want to hit from an Azure web app using a vnet-to-vnet conneciton. As such, I have the VPNs configured as follows:</p>
  <h2>Virtual Machine - VMVnet</h2>
  <pre><code>Address Space: 10.1.0.0/16
  Subnet: 10.1.0.0/24
  Gateway Subnet: 10.1.1.0/27
  Private IP: 10.1.0.4
  </code></pre>
  <p>I also opened the target port up in Windows Firewall.</p>
  <h2>Web App - AppVnet</h2>
  <pre><code>Address Space: 10.2.0.0/16
  Subnet: 10.2.0.0/24
  Gateway Subnet: 10.2.1.0/27
  </code></pre>
  <p>I also have Virtual Network Gateways configured for both, each with a connection going to the other.</p>
  <p>Now, after I connect the app to AppVnet and sync the routes from the app service plan's networking section, I should be able to hit the VM using its private IP from the app code. When I try, I get the following error:</p>
  <pre><code>An attempt was made to access a socket in a way forbidden by its access permissions
  </code></pre>
  <p>I also tried setting up <a href="https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview" rel="nofollow noreferrer">Virtual Network Peering</a> between the networks, but that didn't work either.</p>
  <p>Is what I'm trying to do even possible with Azure web apps? I saw <a href="https://stackoverflow.com/questions/49145308/azure-app-service-and-vnet-to-vnet-connectivity">this question</a>, which seemed like what I was looking for but the information in it is a bit lacking.</p>
  <p>If not, I <em>have</em> tried this with a point-to-site configuration with the app connected to the VM's vnet, and it worked fine. Would it be preferable to set up a second nic on the VM using the AppVnet and connect all apps through that?</p>