Documentation Index

Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt

Use this file to discover all available pages before exploring further.

Private networking overview

  • 3 minute(s) read
Prev Next

Overview

This article provides an overview of the private networking architecture for Turbo360 private hosted instances. It covers how outbound and inbound traffic flows through the Azure infrastructure and the key configuration points you need to understand before setting up private networking.

Business value

Configuring private networking for your Turbo360 private instance ensures that application traffic never traverses the public internet. This reduces the attack surface, satisfies common enterprise network security requirements, and ensures that sensitive cost and monitoring data stays within your virtual network boundary.

How it works

Turbo360 private hosting uses Azure VNet integration and private endpoints to route all application traffic within your virtual network. The core application components — web app and function apps — run on an App Service plan that is VNet-integrated into a dedicated outbound subnet. Inbound access to these components, and to the SQL database and storage account, is secured through private endpoints.

Application outbound traffic

In private hosting mode, Turbo360 communicates with the Azure resources that make up its application infrastructure. When private networking is configured, outbound traffic from the core application components (web app and function apps) flows through the App Service plan. This App Service plan is VNet-integrated into a subnet on your virtual network.

When hosting on a standard App Service plan, each function app and web app has its networking configuration pointing to the same subnet. Traffic from the App Service plan hitting the subnet is then routed to the appropriate destinations — including the SQL database and storage account, which can be connected to the network via private endpoints as described in the next section.

Outbound traffic diagram

Note — Azure Management API & Kovai license activation

Turbo360 services running on the App Service also query the Azure Management API (for cost data and rightsizing) and communicate with a Kovai API for license activation. These flows are not shown in the diagram above to keep the focus on private networking use cases, but both routes travel via the App Service outbound subnet.

Application inbound traffic

The diagram below shows the inbound traffic flow for components in the Turbo360 architecture when configured with private endpoints.

Inbound traffic diagram

Key points:

  • End-user traffic to the Turbo360 web application arrives via a private endpoint.

  • Administrator traffic to the function apps or web app for admin purposes arrives via a private endpoint.

  • Inbound traffic to the SQL database arrives via a private endpoint.

  • Inbound traffic to the storage account arrives via a private endpoint.

  • Inbound traffic to Azure Monitor components (App Insights and Log Analytics) arrives via private link.

  • Outbound traffic from the App Service plan routes through the App Service outbound subnet and then accesses PaaS resources such as the SQL database via the subnet associated with the private endpoint.

FAQs

  1. Can I use an App Service Environment to simplify the web app and function app networking?
    Yes. An App Service Environment (ASE) simplifies networking configuration for the app service resources. Contact us and we can guide you through the process.

  2. How many subnets do I need?
    This depends on your requirements. The minimum is 2: one for App Service outbound, and one for all private endpoints. You can split private endpoints across different subnets or reuse an existing subnet. We generally recommend 2 dedicated subnets for Turbo360 so you can easily restrict access to Turbo360-specific use cases.

  3. What are the requirements for the App Service outbound subnet?
    The minimum subnet size is /26. The subnet must be delegated to Microsoft.Web and should be dedicated exclusively to this App Service plan. For more information, see Azure App Service VNet integration overview.