azurerm_vpn_gateway cost estimation

An azurerm_vpn_gateway is the site-to-site VPN gateway that lives inside an Azure Virtual WAN hub, distinct from the classic azurerm_virtual_network_gateway, which attaches to a single VNet and bills by SKU. The Virtual WAN gateway bills by scale unit: ~$0.361/scale-unit-hour, so one scale unit is ~$264/month, and each scale unit provides a defined throughput and tunnel capacity.

You provision scale units to your aggregate VPN throughput need, and the gateway bills them continuously. On top of the gateway scale units, Virtual WAN charges for data processed through the hub and the hub itself, so the gateway is one component of a broader Virtual WAN bill.

The cost lever is scale-unit count: each adds ~$264/month of capacity. Provision to your real aggregate site-to-site throughput, not peak headroom. For a single-VNet point-to-point VPN, the classic Virtual Network Gateway may be simpler and cheaper than standing up Virtual WAN.

c3x prices the gateway from its scale_unit count, so the standing cost is visible before deployment.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "azurerm_vpn_gateway" "hub" {
  name                = "hub-vpn-gw"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  virtual_hub_id      = azurerm_virtual_hub.main.id

  scale_unit = 1
}

Pricing dimensions

What you actually pay for when you provision azurerm_vpn_gateway.

Dimension	Unit	What's being charged
VPN scale units	per scale-unit-hour	Each scale unit provides throughput/tunnel capacity, billed continuously. Provision to aggregate VPN throughput. $0.361/scale-unit-hour → 1 unit ≈ $263.53/month
Hub data processing	per GB	Virtual WAN charges for data processed through the hub, on top of gateway scale units. Usage-based.

Sample C3X output

A single VPN scale unit in a Virtual WAN hub, 24/7:

azurerm_vpn_gateway.hub
└─ VPN scale units (1)   730 unit-hours   $263.53
                         Monthly          $263.53

Optimization tips

Common ways to reduce azurerm_vpn_gateway cost without changing the workload.

Right-size scale units to aggregate throughput

~$264/month per scale unit avoided

Each scale unit is ~$264/month of capacity. Provision to your real combined site-to-site throughput, not peak headroom, scale units can be increased later as connections grow.

Use a classic Virtual Network Gateway for simple single-VNet VPN

Avoids Virtual WAN hub overhead

Virtual WAN is for hub-and-spoke at scale. If you just need a VPN into one VNet, the classic azurerm_virtual_network_gateway may be simpler and cheaper than standing up a Virtual WAN hub plus gateway.

Keep hub data processing in mind

Per-GB processing on misrouted traffic

Beyond gateway scale units, Virtual WAN bills data processed through the hub. Route only the traffic that needs the hub through it to control the per-GB processing charge.

FAQ

How is an Azure Virtual WAN VPN gateway billed?

By scale unit, ~$0.361/scale-unit-hour, so one scale unit is ~$264/month, each providing defined throughput and tunnel capacity, billed continuously. Virtual WAN also charges for data processed through the hub on top.

How is this different from azurerm_virtual_network_gateway?

azurerm_vpn_gateway lives in a Virtual WAN hub and bills by scale unit; azurerm_virtual_network_gateway attaches to a single VNet and bills by SKU (Basic/VpnGw1-5). Use Virtual WAN for hub-and-spoke at scale, the classic gateway for a single-VNet VPN.

How does c3x estimate the cost?

From the scale_unit count, pricing the standing scale-unit-hour fee. Hub data processing is usage-driven and modelled separately.

Related resources

Azure

azurerm_virtual_network_gateway

The classic single-VNet VPN gateway (SKU-based) alternative

`azurerm_vpn_gateway` cost estimation