Sql-server – Add Azure SQL Server in to Azure VNET

Edit:

This is not possible. See this: Currently, you can specify network ACLs for endpoints only. You can’t specify an ACL for a virtual network or a specific subnet contained in a virtual network. Also, the Virtual Network Security Whitepaper might be useful.

Have a look here

Basically, yes, you can have your front-end-server in one vnet, and your back-end server in another, and then restrict the access to the back-end using ACL's.

What you cannot do is restrict communication between the back-end servers using ACL's if they are in the same VNet. You need Windows Firewall or other measures for that.

To configure this, once you have your back-end servers in a VNet, use the "Endpoints" configuration of the back-end servers and add your HTTPS/443 endpoint. Then, still on this endpoint, click "MANAGE ACL" on the bottom. Now, PERMIT your front-end network or just the /32 IP Address(es), and DENY everything else (0.0.0.0/0)

See the guide for more details

NSG's could, I suppose have been implemented as part of the vNet, but actually the current approach provides more flexibility, especially if you are using templates to deploy.

vNets are your containers that provide communication between between VM's and a boundary between your environment and the outside world. Inside vNets you will create subnets to organise your network as you like and configure routing rule to define how traffic flows (if you don't like the defaults). vNets also provide the functionality to hook into things like VPN's and Express route.

NSG's are your firewalls that determine what traffic is allowed through. The important thing to note is that NSG's can be applied to individual machines, or to subnets. This distinction means you can apply an NSG to subnet and it can control what traffic is allowed in both from teh outside world, but also from other subnets on your network. Alternatively you can define it at the VM/NIC level and lock things down just for that VM.