Azure VPN Gateway cost: the SKU sets the hourly fee

Quick answer

Azure VPN Gateway bills a fixed hourly fee by SKU, from about $0.19/hour for VpnGw1 (roughly $140/month) up to several dollars per hour for higher SKUs, plus outbound data transfer. The SKU, chosen for throughput and the number of tunnels, sets most of the bill, so size it to real bandwidth need rather than over-provisioning.

Azure VPN Gateway connects your virtual network to on-premises or other networks over IPsec. It is an always-on service billed by SKU, and the SKU you pick, based on throughput and tunnel count, determines the hourly fee that dominates the cost.

SKU sets the hourly fee

The gateway runs continuously and bills per hour by SKU. VpnGw1 is around $0.19 per hour (roughly $140 a month); higher SKUs (VpnGw2 through VpnGw5) cost progressively more for higher aggregate throughput and more supported tunnels, reaching several dollars per hour. The Basic SKU is cheaper but limited and not recommended for production.

Throughput and tunnels drive the SKU choice

Factor	Pushes SKU up
Aggregate throughput needed	Higher SKUs support more Mbps/Gbps
Number of S2S tunnels	Higher SKUs allow more connections
Zone redundancy / AZ SKUs	Availability-zone variants cost more

Pick the lowest SKU that meets your real throughput and tunnel requirements. Over- provisioning to a high SKU for headroom you do not use is the common overspend, since the hourly fee applies around the clock.

Controlling VPN Gateway cost

Right-size the SKU to actual bandwidth and tunnel needs, use ExpressRoute instead where a dedicated high-throughput connection is justified (different pricing, better for large steady traffic), and remember outbound data transfer is billed on top. For dev and test connectivity, a lower SKU or a temporary gateway avoids paying production rates for occasional use. It is the same size-to-need discipline as any always-on gateway like Azure Firewall.

FAQ

How is Azure VPN Gateway priced?

A fixed hourly fee by SKU, from about $0.19 per hour for VpnGw1 (roughly $140 a month) up to several dollars per hour for higher SKUs, plus outbound data transfer. The SKU, chosen for throughput and tunnel count, dominates the bill.

Which VPN Gateway SKU should I choose?

The lowest SKU that meets your real aggregate throughput and number of site-to-site tunnels. VpnGw1 suits modest connectivity; higher SKUs support more Mbps and tunnels at higher hourly cost. Avoid over-provisioning to a high SKU for unused headroom.

How do I reduce Azure VPN Gateway cost?

Right-size the SKU to actual bandwidth and tunnel needs, consider ExpressRoute for large steady traffic where a dedicated connection is justified, use a lower SKU or temporary gateway for dev and test, and account for outbound data transfer billed on top.

Does Azure VPN Gateway charge when idle?

Yes. The gateway is always on and bills its SKU's hourly fee continuously, whether or not traffic flows. This is why sizing the SKU to real need, rather than over-provisioning, is the main cost control.

VPN Gateway or ExpressRoute for cost?

VPN Gateway is cheaper for modest, intermittent connectivity over the internet. ExpressRoute provides a dedicated, high-throughput, low-latency connection at higher and different pricing, worth it for large, steady, performance-sensitive traffic between on-premises and Azure.

Does C3X estimate VPN Gateway cost?

C3X prices the azurerm_virtual_network_gateway resource and its SKU from your Terraform, so the hourly fee appears before deploy. Outbound data transfer depends on traffic, which you provide as a usage assumption.

What to do next

Size your gateway before you deploy. C3X reads your Terraform and prices VPN Gateway and the rest of your stack against a live catalog. Start with the quickstart.