User-defined routes (UDRs)

User-defined routes (UDRs) in Azure are custom routing rules that allow you to control how network traffic flows within your virtual networks. By default, Azure automatically creates system routes that handle traffic between subnets, virtual networks, and the internet. However, there are scenarios … User-defined routes (UDRs) in Azure are custom routing rules that allow you to control how network traffic flows within your virtual networks. By default, Azure automatically creates system routes that handle traffic between subnets, virtual networks, and the internet. However, there are scenarios where you need more granular control over traffic paths, and this is where UDRs become essential. UDRs are created within route tables, which are then associated with one or more subnets. When a route table is linked to a subnet, all traffic leaving that subnet follows the rules defined in the UDR. Each route specifies an address prefix (destination) and the next hop type, determining where traffic should be sent. The next hop types available include: Virtual Network Gateway (for routing to on-premises networks via VPN or ExpressRoute), Virtual Network (for routing within the VNet), Internet (for routing to public endpoints), Virtual Appliance (for sending traffic through a network virtual appliance like a firewall), and None (to drop traffic entirely). Common use cases for UDRs include: forcing all internet-bound traffic through a firewall or security appliance for inspection, routing traffic between spokes in a hub-and-spoke topology through a central hub, creating network segmentation by controlling which subnets can communicate, and implementing forced tunneling to route all traffic back to on-premises data centers. When configuring UDRs, you specify the virtual appliance's private IP address as the next hop when routing through network virtual appliances. It is important to enable IP forwarding on the NIC of the appliance to ensure proper packet handling. Route selection follows the longest prefix match rule, meaning more specific routes take precedence. UDRs override default system routes, giving security engineers precise control over traffic patterns to meet compliance requirements and implement defense-in-depth strategies within Azure environments.