Azure Cloud Service Endpoint for VM to only allow internal access
<p>I have a VM running SQL Server. I have port 1433 open on the Windows firewall and an Endpoint on the corresponding cloud service forwarding port 57501 to 1433. I haven't specified any ACLs on that endpoint. I want the endpoint to only be accessible from a specific subnet in the VNet where the VM exists. </p>

<p>If I set that in the ACL, it doesn't work - the ACL only seems to care about the public IP of the client. Since the public IP may change, this isn't an option. </p>

<p>What's the recommended approach here? Note that I don't want to connect directly to the VM hostname because I want to use the CNAME that the cloud service sets up for me (the actual Windows computer name is a random long string).</p>