Virtual networks, subnets, peering, Azure DNS, and public vs private endpoints

An Azure virtual network (VNet) is your own private network in Azure. It lets Azure resources such as VMs communicate with each other, with the internet, and with your on-premises networks. When you create a VNet you give it an address space in private IP ranges, such as 10.1.0.0/16, written in Classless Inter-Domain Routing (CIDR) notation, and it lives in one region and one subscription. VNets provide isolation: resources in one VNet cannot reach resources in another until you connect them. You divide a VNet into subnets, smaller address ranges such as 10.1.1.0/24, to organize and secure resources. For example, you might put web servers in one subnet and database servers in another. Resources in different subnets of the same VNet can talk to each other by default. You filter traffic with network security groups (NSGs), which contain prioritized allow and deny rules based on source, destination, port and protocol, and can be attached to a subnet or a network interface.