azurerm_vpn_gateway cost estimation
A scalable VPN gateway in a Virtual WAN hub, billed per scale unit-hour. One scale unit is ~$264/month, plus data processed through the hub.
An azurerm_vpn_gateway is the site-to-site VPN gateway that lives inside an Azure Virtual WAN hub — distinct from the classic azurerm_virtual_network_gateway, which attaches to a single VNet and bills by SKU. The Virtual WAN gateway bills by scale unit: ~$0.361/scale-unit-hour, so one scale unit is ~$264/month, and each scale unit provides a defined throughput and tunnel capacity.
You provision scale units to your aggregate VPN throughput need, and the gateway bills them continuously. On top of the gateway scale units, Virtual WAN charges for data processed through the hub and the hub itself — so the gateway is one component of a broader Virtual WAN bill.
The cost lever is scale-unit count: each adds ~$264/month of capacity. Provision to your real aggregate site-to-site throughput, not peak headroom. For a single-VNet point-to-point VPN, the classic Virtual Network Gateway may be simpler and cheaper than standing up Virtual WAN.
c3x prices the gateway from its scale_unit count, so the standing cost is visible before deployment.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "azurerm_vpn_gateway" "hub" {
name = "hub-vpn-gw"
location = azurerm_resource_group.main.location
resource_group_name = azurerm_resource_group.main.name
virtual_hub_id = azurerm_virtual_hub.main.id
scale_unit = 1
}Pricing dimensions
What you actually pay for when you provision azurerm_vpn_gateway.
| Dimension | Unit | What's being charged |
|---|---|---|
| VPN scale units | per scale-unit-hour | Each scale unit provides throughput/tunnel capacity, billed continuously. Provision to aggregate VPN throughput. $0.361/scale-unit-hour → 1 unit ≈ $263.53/month |
| Hub data processing | per GB | Virtual WAN charges for data processed through the hub, on top of gateway scale units. Usage-based. |
Sample C3X output
A single VPN scale unit in a Virtual WAN hub, 24/7:
azurerm_vpn_gateway.hub
└─ VPN scale units (1) 730 unit-hours $263.53
Monthly $263.53Optimization tips
Common ways to reduce azurerm_vpn_gateway cost without changing the workload.
Right-size scale units to aggregate throughput
~$264/month per scale unit avoidedEach scale unit is ~$264/month of capacity. Provision to your real combined site-to-site throughput, not peak headroom — scale units can be increased later as connections grow.
Use a classic Virtual Network Gateway for simple single-VNet VPN
Avoids Virtual WAN hub overheadVirtual WAN is for hub-and-spoke at scale. If you just need a VPN into one VNet, the classic azurerm_virtual_network_gateway may be simpler and cheaper than standing up a Virtual WAN hub plus gateway.
Keep hub data processing in mind
Per-GB processing on misrouted trafficBeyond gateway scale units, Virtual WAN bills data processed through the hub. Route only the traffic that needs the hub through it to control the per-GB processing charge.
FAQ
How is an Azure Virtual WAN VPN gateway billed?
By scale unit — ~$0.361/scale-unit-hour, so one scale unit is ~$264/month — each providing defined throughput and tunnel capacity, billed continuously. Virtual WAN also charges for data processed through the hub on top.
How is this different from azurerm_virtual_network_gateway?
azurerm_vpn_gateway lives in a Virtual WAN hub and bills by scale unit; azurerm_virtual_network_gateway attaches to a single VNet and bills by SKU (Basic/VpnGw1-5). Use Virtual WAN for hub-and-spoke at scale, the classic gateway for a single-VNet VPN.
How does c3x estimate the cost?
From the scale_unit count, pricing the standing scale-unit-hour fee. Hub data processing is usage-driven and modelled separately.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including azurerm_vpn_gateway.