Azure Networking Cost Calculator

Azure networking is modular, and each component has its own billing profile:

• Virtual Network (VNet): The VNet itself is free. You pay for resources _in_ it.
• Public IP Address: £0.0128/hour (idle) or £0.0064/hour (in-use). The "in-use" rate applies when the IP is actively receiving traffic.
• NAT Gateway: £33/month per gateway + £0.18 per million processed bytes. No pause mode; billing only stops on deletion.
• Virtual Network Peering: Data passing through peer links is charged (~£0.016/GB); VNets in the same region are cheaper than cross-region.
• Load Balancer: ~£0.21/hour (Standard + Basic pricing varies slightly). High-traffic scenarios add rule and data processing charges.
• Application Gateway: ~£0.25/hour + capacity unit charges. Often forgotten in cost plans because it's regional.
• Express Route / VPN Gateway: Standing monthly charges regardless of traffic volume.

NAT Gateway is perhaps the most deceptive networking cost because it has no pause state. Unlike a Virtual Machine (which you deallocate to stop charges), a NAT Gateway charges a standing fee of ~£33/month simply for existing. If you provision a NAT Gateway for a dev or test environment and "pause" it by removing traffic, the charge continues until you explicitly delete the resource.

Teams often discover this months later: they find an idle NAT Gateway in a dev subscription and realize it's been charging £33/month for three months = £99 wasted. Multiply across all subscriptions and environments, and NAT Gateway becomes a material cost-avoidance target.

Best practice: Use NAT Gateway only in production or long-running environments. For dev/test workloads, use a load balancer's SNAT capability or managed outbound rules on NSGs to avoid the standing charge entirely.

A public IP address in Azure costs £0.0128/hour if idle (unused), or £0.0064/hour if in-use. "In-use" typically means it's associated with a running VM, load balancer, or Application Gateway. But the distinction is often invisible to engineers: allocate a public IP for a temporary VM, delete the VM, and forget to delete the public IP. The charge persists.

Over a year, a single idle public IP costs ~£112. Across a large infrastructure with orphaned IPs, this becomes significant. Many teams run quarterly audits to find and delete orphaned public IPs.

Best practice: Use lifecycle policies and tagging to track public IP age. Delete IPs not actively used for inbound access. For outbound-only traffic, prefer NAT Gateway (if the cost is justified) or managed outbound rules to avoid public IP charges entirely.

VNet peering allows two virtual networks to communicate directly. Intra-region peering is relatively cheap (~£0.0048/GB GBP-equivalent), but cross-region peering is more expensive (~£0.016/GB). The difference reflects Microsoft's backbone costs: same-region traffic stays within a local cluster, while cross-region uses expensive inter-datacenter bandwidth.

For architectures that hub-and-spoke multi-region, every byte of spoke-to-spoke traffic routes through the hub and incurs two peering charges (spoke-to-hub + hub-to-spoke). High-traffic cross-region spoke communication can become a material cost driver.

Best practice: Keep high-traffic workloads on the same region where feasible. For multi-region, consider whether fully meshed peering or a transit hub is cost-effective compared to running replicas closer to traffic sources.

Both components can distribute inbound traffic, but they're priced and intended for different layers:

• Load Balancer (Layer 4): ~£0.21/hour. Low per-connection overhead. Good for non-HTTP, high-throughput scenarios (databases, caching, raw TCP/UDP).
• Application Gateway (Layer 7): ~£0.25/hour + capacity units. Inspects HTTP headers, routes based on paths/hostnames, terminates TLS. Higher per-request cost but richer routing.

The choice isn't arbitrary: choosing the "wrong" tool for the scenario can inflate costs. A simple TCP load-balancer workload using Application Gateway pays Layer 7 pricing for Layer 4 behavior. Conversely, HTTP routing with a Layer 4 load balancer requires hacks and wastes throughput.

Best practice: Match the component to the layer. Also be aware of Azure Front Door (global load balancing) and Traffic Manager (DNS-based routing) for multi-region scenarios; both have different price models and may be more suitable than Application Gateway in some cases.

A company runs a hybrid architecture:

• Primary workload: UK South (VMs, App Service)
• On-premises database: connected via Express Route
• Disaster recovery: replicated to North Europe VNets
• NAT Gateway: for outbound SaaS integrations
• Load Balancer: distributes inbound traffic to VMs
• 3 Public IPs: for remote access and API endpoints

Monthly networking cost breakdown (estimate):

• NAT Gateway: £33.00
• Load Balancer: ~£155 (£0.21/hour × 730 hours)
• Public IPs (3 idle): ~£28 (£0.0128/hour × 730 hours × 3)
• Express Route: £150–300 (typical peering cost)
• VNet peering (cross-region replication traffic): ~£200–500 (depending on DR sync volume)
• Total: ~£566–1,026/month just for networking infrastructure

Most teams don't budget per-component before deployment. They budget by service (e.g., "VMs cost £X"), then discover that networking is 30% of the total bill due to load balancer + peering + NAT Gateway overhead.

Can I deallocate a NAT Gateway to stop charges? No. NAT Gateway has no deallocate state. The only way to stop charges is to delete it entirely. This is a key source of orphaned resources and unnecessary costs.

Are inbound charges included in the bandwidth calculation? No. Inbound data transfer to Azure is free. Only outbound (egress) is charged, which is handled separately in the Bandwidth calculator.

Do I pay for VNet peering if no traffic crosses it? No. Peering is only charged per GB transferred. If two VNets are peered but no traffic crosses, there's no charge. This is different from resources like NAT Gateway, which have standing charges.

Is VNet-to-VNet traffic within the same subscription cheaper? No. Peering charges are the same regardless of subscription or tenant. Region (same vs cross) is what matters.