Direct answer: at the Azure Retail Prices API on 9 November 2026 (eastus, USD, excluding tax/discounts), Azure VPN Gateway's monthly cost is driven mainly by the SKU: Basic $0.036/hour (about $26.28/month), VpnGw1 $0.19/hour ($138.70/month), VpnGw2 $0.49/hour ($357.70/month), VpnGw3 $1.25/hour ($912.50/month), VpnGw4 $2.10/hour ($1,533.00/month) and VpnGw5 $3.65/hour ($2,664.50/month); zone-redundant versions are $0.21/$0.54/$1.38/$2.31/$4.02 per hour. Capacity: Basic 100 Mbps, 10 S2S, 128 P2S; Gw1 650 Mbps, 30 S2S, 250 P2S; Gw2 1 Gbps, 500 P2S; Gw3 1.25 Gbps, 1,000 P2S; Gw4 5 Gbps, 5,000 P2S; Gw5 10 Gbps, 10,000 P2S. Additional S2S tunnels are $0.015/hour (about $10.95/month each), P2S connections beyond 128 are $0.01/hour (about $7.30/month each), and inter-VNet outbound Zone 1 is about $0.035/GB.
This guide is for Azure networking, SRE, hybrid-cloud and procurement teams. It explains VPN Gateway Basic/VpnGw1–5 and AZ versions, S2S/P2S included allowances, extra tunnels/connections, inter-VNet data and the Advanced Connectivity Add-On; provides gateway-only, 1TB/10TB and extra-connection TCO, plus the boundary versus ExpressRoute/Bastion. Prices come from the Azure VPN Gateway pricing page and Azure Retail Prices API (eastus, 9 November 2026); capacity/limits come from Microsoft Learn's VPN Gateway configuration docs. Official price facts, editorial calculations and exclusions are kept separate. This is not procurement advice.
(1) Check capacity/allowance first: Basic is only 100 Mbps/10 S2S/128 P2S; Gw1 650 Mbps/30 S2S/250 P2S; only Gw4/5 reach 5/10 Gbps and 100 S2S. (2) Extra tunnels/connections add cost: S2S beyond 10 is $0.015/hour each, P2S beyond 128 is $0.01/hour each; at large P2S scale, connection fees can exceed the gateway fee. (3) Inter-VNet/P2S outbound is billed as data transfer; AZ versions cost about 10–12% more but provide zone redundancy.
SKU capacity: bandwidth, S2S and P2S
Basic is the smallest: 100 Mbps, up to 10 S2S and 128 P2S, suitable for small/test. VpnGw1 650 Mbps, 30 S2S, 250 P2S; Gw2 1 Gbps, 30 S2S, 500 P2S; Gw3 1.25 Gbps, 30 S2S, 1,000 P2S; Gw4 5 Gbps, 100 S2S, 5,000 P2S; Gw5 10 Gbps, 100 S2S, 10,000 P2S. AZ versions have slightly higher bandwidth (Gw2AZ 1.25 Gbps, Gw3AZ 2.5 Gbps) and zone redundancy.
| SKU | Bandwidth | Max S2S | Max P2S |
|---|---|---|---|
| Basic | 100 Mbps | 10 | 128 |
| VpnGw1 | 650 Mbps | 30 | 250 |
| VpnGw2 | 1 Gbps | 30 | 500 |
| VpnGw3 | 1.25 Gbps | 30 | 1,000 |
| VpnGw4 | 5 Gbps | 100 | 5,000 |
| VpnGw5 | 10 Gbps | 100 | 10,000 |
Source: Azure VPN Gateway pricing page (9 November 2026). AZ bandwidth: Gw1AZ 650 Mbps, Gw2AZ 1.25 Gbps, Gw3AZ 2.5 Gbps, Gw4AZ 5 Gbps, Gw5AZ 10 Gbps.
Unit prices: gateway, AZ, extra tunnels/connections and data
Eastus list prices: Basic $0.036/hour; Gw1 $0.19; Gw2 $0.49; Gw3 $1.25; Gw4 $2.10; Gw5 $3.65; AZ versions $0.21/$0.54/$1.38/$2.31/$4.02. Additional S2S tunnels $0.015/hour (beyond the included 10); P2S beyond 128 $0.01/hour each; inter-VNet outbound Zone 1 $0.035/GB, Zone 2 $0.09, Zone 3 $0.16; P2S outbound at standard data-transfer rates. Advanced Connectivity Add-On $3.25/hour (optional).
| Item | Price (USD) | Monthly/note |
|---|---|---|
| Basic | $0.036/hour | About $26.28/month |
| VpnGw1 | $0.19/hour | About $138.70/month |
| VpnGw2 | $0.49/hour | About $357.70/month |
| VpnGw3 | $1.25/hour | About $912.50/month |
| VpnGw4 / Gw5 | $2.10 / $3.65 per hour | About $1,533.00 / $2,664.50/month |
| AZ versions | $0.21/$0.54/$1.38/$2.31/$4.02 | Gw1AZ–Gw5AZ |
| Additional S2S tunnel | $0.015/hour | About $10.95/month each |
| Additional P2S connection | $0.01/hour | About $7.30/month each (beyond 128) |
| Inter-VNet outbound | $0.035/$0.09/$0.16 per GB | Zone 1/2/3 |
Sources: Azure Retail Prices API (eastus, 9 November 2026) and Azure VPN Gateway pricing page. Monthly prices use 730 hours; tax/discounts excluded.
TCO: gateway-only and AZ versions
At 730 hours/month, excluding traffic/extra connections: Basic $26.28; Gw1 $138.70; Gw2 $357.70; Gw3 $912.50; Gw4 $1,533.00; Gw5 $2,664.50. AZ versions: Gw1AZ $153.30; Gw2AZ $394.20; Gw3AZ $1,007.40; Gw4AZ $1,686.30; Gw5AZ $2,934.60. AZ versions cost about 10–12% more than the same non-AZ SKU for zone redundancy.
| SKU | Non-AZ monthly | AZ monthly | AZ premium |
|---|---|---|---|
| Basic | 26.28 | — | — |
| VpnGw1 | 138.70 | 153.30 | About 10.5% |
| VpnGw2 | 357.70 | 394.20 | About 10.2% |
| VpnGw3 | 912.50 | 1,007.40 | About 10.4% |
| VpnGw4 | 1,533.00 | 1,686.30 | About 10.0% |
| VpnGw5 | 2,664.50 | 2,934.60 | About 10.1% |
Editorial calculation: hourly fee ×730; traffic/extra connections/tax/discounts excluded; AZ/non-AZ regional availability follows official pages.
TCO: 1TB/10TB inter-VNet traffic and extra connections
At inter-VNet outbound Zone 1 $0.035/GB: 1TB (1,024GB) about $35.84; Gw1 $138.70+$35.84=$174.54; Gw3 $912.50+$35.84=$948.34; Gw5 $2,664.50+$35.84=$2,700.34. 10TB (10,240GB) about $358.40; Gw1 $497.10, Gw3 $1,270.90, Gw5 $3,022.90. Extra connections: Gw1 with 30 S2S (+20 × $10.95 = $219.00) → $357.70; Gw1 with 250 P2S (+122 × $7.30 = $890.60) → $1,029.30. At large P2S scale, connection fees can exceed the gateway fee.
| Option | 1TB/month | 10TB/month |
|---|---|---|
| Gw1 | 174.54 | 497.10 |
| Gw3 | 948.34 | 1,270.90 |
| Gw5 | 2,700.34 | 3,022.90 |
| Gw1 + 30 S2S | 357.70 (excl. traffic) | — |
| Gw1 + 250 P2S | 1,029.30 (excl. traffic) | — |
Editorial calculation: Zone 1 inter-VNet $0.035/GB; 1TB=1,024GB, 10TB=10,240GB; P2S outbound/public IP/tax/discounts excluded; actual data rates vary by zone/direction.
Hidden costs: seven items beyond the gateway
Common add-ons: additional S2S tunnels ($0.015/hour each beyond 10), additional P2S connections ($0.01/hour each beyond 128), inter-VNet/P2S outbound ($0.035–$0.16/GB or standard data transfer), public IP (required for the gateway, billed separately), active-active/second gateway (HA extra), AZ premium (about 10–12%), Advanced Connectivity Add-On ($3.25/hour, optional) and ExpressRoute/VNet peering (hybrid architecture extra).
| Cost item | Trigger | Control |
|---|---|---|
| Additional S2S tunnels | >10 | Consolidate sites/use ExpressRoute |
| Additional P2S connections | >128 | Plan by concurrency/users; choose a higher SKU |
| Inter-VNet/P2S outbound | Cross-region/egress | Same region, compression, locality |
| Public IP | Gateway deployment | Plan/reuse |
| Active-active/second gateway | HA | Match RTO |
| AZ premium | Zone redundancy | Match business tier |
| Advanced Add-On | High-bandwidth tunnels | Enable as needed |
Sources: Azure VPN Gateway pricing/config docs (9 November 2026). Editorial summary; billing follows official pages and bills.
How to choose: S2S, P2S and the ExpressRoute boundary
For small/test, few sites and low bandwidth, Basic (100 Mbps/10 S2S/128 P2S); general production, Gw1 (650 Mbps/30 S2S/250 P2S); more P2S users/higher bandwidth, Gw2/Gw3; 5–10 Gbps and 100 S2S, Gw4/Gw5; zone redundancy, AZ versions. VPN fits site-to-site/remote access with low cost and fast deployment; ExpressRoute fits stable high bandwidth/low latency/SLA, but circuit/port/carrier/gateway costs are higher. Bastion is only an operations jump host, not a VPN replacement. Hybrid designs can use VPN as backup and ExpressRoute as primary.
| Scenario | Prefer | Check first |
|---|---|---|
| Test/small/low bandwidth | Basic | 100 Mbps, 10 S2S, 128 P2S |
| General production | VpnGw1 | 650 Mbps, 30 S2S, 250 P2S |
| More P2S/higher bandwidth | Gw2/Gw3 | P2S connection fees, bandwidth |
| 5–10 Gbps/100 S2S | Gw4/Gw5 | Throughput, extra tunnels |
| Zone redundancy | AZ versions | About 10–12% premium |
| Stable high bandwidth/low latency/SLA | ExpressRoute | Circuit/port/carrier/gateway |
Editorial selection framework, not a vendor recommendation; features/compliance/regional availability follow official docs and business requirements.
90-day checklist
Use the first 90 days to close “sites/users/bandwidth → SKU → gateway/connections → pilot → cutover → review.” Weeks 1-2: inventory sites, P2S users, peak bandwidth and inter-VNet traffic; weeks 2-4: choose SKU/AZ/active-active; weeks 4-6: deploy a pilot and test throughput/latency/reconnect; weeks 6-8: configure S2S/P2S, routing/NSG; weeks 8-10: cut over and monitor tunnels/connections; weeks 10-12: cost review, scale up/down. Do not buy Gw5 for a hypothetical future 10 Gbps.
FAQ
How is Azure VPN Gateway billed?
Gateway SKU hourly fee + additional S2S tunnels/P2S connections + data transfer. Basic $0.036/h, Gw1 $0.19, Gw2 $0.49, Gw3 $1.25, Gw4 $2.10, Gw5 $3.65; AZ versions $0.21–$4.02/h.
What is the difference between Basic and Gw1?
Basic 100 Mbps, 10 S2S, 128 P2S; Gw1 650 Mbps, 30 S2S, 250 P2S. Gw1 is about $138.70/month vs Basic $26.28/month.
How are extra connections billed?
S2S beyond 10 is $0.015/hour each (about $10.95/month); P2S beyond 128 is $0.01/hour each (about $7.30/month). Gw1 at 250 P2S is about $1,029.30/month excluding traffic—possibly more than the gateway fee.
How much more are AZ versions?
About 10–12%: Gw1AZ $153.30 vs Gw1 $138.70; Gw3AZ $1,007.40 vs $912.50; Gw5AZ $2,934.60 vs $2,664.50.
How is inter-VNet traffic billed?
Outbound Zone 1 $0.035/GB, Zone 2 $0.09, Zone 3 $0.16; inbound is free. 1TB is about $35.84; 10TB about $358.40.
VPN or ExpressRoute?
VPN is lower cost/faster to deploy, suited to S2S/P2S and backup; ExpressRoute offers stable high bandwidth/low latency/SLA but costs more in circuits/ports/carriers/gateways. Use VPN as backup and ExpressRoute as primary when needed.
Can Bastion replace a VPN?
No. Bastion is an operations jump host; VPN handles site-to-site/remote access. Their roles differ.
When should we use Gw4/Gw5?
When you need 5–10 Gbps, 100 S2S or large-scale P2S; Gw4 is about $1,533/month and Gw5 about $2,664.50/month, plus traffic/connections.
Research method and limitations
This article separates “official price facts” from “editorial calculations.” Basic/VpnGw1–5 and AZ gateway hourly fees, extra S2S/P2S, inter-VNet outbound and the Advanced Add-On come from the Azure VPN Gateway pricing page and Azure Retail Prices API (eastus, 9 November 2026); bandwidth/S2S/P2S allowances and AZ bandwidth come from Microsoft Learn's VPN Gateway configuration/pricing docs. TCO, hidden costs and the 90-day checklist are editorial.
Eight limitations: (1) only eastus list prices, excluding tax/discounts/enterprise agreements; (2) 730 hours/month; (3) public IP/active-active/second gateway/ExpressRoute/peering combinations are excluded; (4) data rates vary by zone/direction—scenarios use Zone 1 $0.035/GB; (5) no real throughput/latency/reconnect benchmark; (6) P2S concurrency/connection behavior depends on clients/authentication/region—benchmark; (7) the full Virtual WAN/ExpressRoute architecture is out of scope; (8) prices/features change, so recheck official pages and bills before purchase.
Sources and basis
- Microsoft Azure, VPN Gateway Pricing: azure.microsoft.com/en-us/pricing/details/vpn-gateway. SKU/bandwidth/S2S/P2S, extra tunnels/connections, data, AZ, Advanced Add-On. Accessed 9 November 2026.
- Azure Retail Prices API (productName contains VPN Gateway, eastus): prices.azure.com/api/retail/prices. 0.036/0.19/0.49/1.25/2.10/3.65, AZ, 0.015/0.01, 0.035/GB. Accessed 9 November 2026.
- Microsoft Learn, VPN Gateway configuration settings: learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings. SKU/bandwidth/active-active/AZ. Accessed 9 November 2026.
Data cut-off 9 November 2026; prices/availability follow the Azure official page and bill; this is not procurement, commercial or legal advice.