azurerm_virtual_network_gateway cost estimation
A VPN (or ExpressRoute) gateway billed per hour by SKU. A VpnGw1 runs ~$139/month just to exist, before any data processing.
An azurerm_virtual_network_gateway is the gateway for site-to-site VPN, point-to-site VPN, or ExpressRoute connectivity into a VNet. The dominant cost is a flat hourly fee set by the SKU, charged continuously whether or not traffic flows.
The SKU ladder runs Basic → VpnGw1 → VpnGw2 → … with each tier adding throughput, tunnels, and price. A VpnGw1 is about $0.19/hour (~$139/month) before data; higher tiers scale up from there. Many deployments pick a higher SKU than their throughput needs, paying for aggregate bandwidth and tunnel counts they never use.
On top of the gateway hours, VPN data transfer out is billed per GB, and ExpressRoute has its own circuit and port charges (a separate resource). The gateway fee is the standing cost; data is the variable one.
c3x prices the gateway from its sku, so the standing monthly cost is visible before deployment — and an over-specced SKU shows up in review.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "azurerm_virtual_network_gateway" "vpn" {
name = "vpn-gateway"
location = azurerm_resource_group.main.location
resource_group_name = azurerm_resource_group.main.name
type = "Vpn"
vpn_type = "RouteBased"
sku = "VpnGw1"
ip_configuration {
public_ip_address_id = azurerm_public_ip.vpn.id
subnet_id = azurerm_subnet.gateway.id
}
}Pricing dimensions
What you actually pay for when you provision azurerm_virtual_network_gateway.
| Dimension | Unit | What's being charged |
|---|---|---|
| Gateway hours | per hour | Flat hourly fee set by the SKU (Basic, VpnGw1-5, ErGw for ExpressRoute), charged continuously regardless of traffic. $0.19/hour ≈ $138.70/month for VpnGw1 |
| VPN data transfer | per GB | Outbound data over site-to-site/point-to-site VPN is billed per GB. Usage-based. |
| Public IP | per hour | The gateway needs a Standard public IP (azurerm_public_ip), billed separately. |
Sample C3X output
A VpnGw1 gateway running 24/7 (gateway fee only; add data + public IP):
azurerm_virtual_network_gateway.vpn
└─ VPN Gateway (VpnGw1) 730 hours $138.70
Monthly $138.70Optimization tips
Common ways to reduce azurerm_virtual_network_gateway cost without changing the workload.
Right-size the gateway SKU
Difference between SKU tiersThe SKU sets throughput, tunnel count, and price. Many gateways are provisioned at VpnGw2+ for capacity they never use. Match the SKU to actual aggregate throughput and tunnel needs — VpnGw1 covers most small/medium deployments.
Use Basic SKU for dev/test
Most of the gateway fee on non-prodThe Basic SKU is far cheaper than VpnGw1 and fine for non-production connectivity where its lower throughput and lack of some features are acceptable.
Don't run a gateway you don't need
$138.70/month per avoided gatewayA VPN gateway bills ~$139/month standing. For occasional connectivity, evaluate whether the workload truly needs an always-on gateway or whether a different connectivity pattern fits.
Consolidate connections onto one gateway
Per avoided gatewayA single gateway supports multiple site-to-site connections up to its tunnel limit. Don't provision separate gateways per connection when one SKU covers the aggregate.
FAQ
How much does an Azure VPN Gateway cost?
A flat hourly fee by SKU — a VpnGw1 is ~$0.19/hour (~$139/month) — charged continuously whether or not traffic flows, plus per-GB VPN data transfer out and a Standard public IP. Higher SKUs (VpnGw2-5) cost more for more throughput and tunnels.
Why am I paying for a gateway with no VPN traffic?
The gateway hourly fee is for the gateway existing, not for traffic. It bills around the clock from creation until deletion regardless of how much data crosses it.
Which SKU should I choose?
The lowest that meets your throughput and tunnel-count needs. Basic for dev/test, VpnGw1 for most small/medium production, higher tiers only when aggregate bandwidth or tunnel limits require it. c3x prices each SKU so you can compare.
How does c3x estimate the cost?
From the sku attribute, pricing the standing gateway-hour fee. VPN data transfer is usage-based and modelled separately, and the public IP is its own resource.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including azurerm_virtual_network_gateway.