I have a question related to this topic: https://learn.microsoft.com/en-us/answers/questions/1361035/how-to-allow-and-restrict-resources-in-site-to-sithttps://learn.microsoft.com/en-us/answers/questions/1361035/how-to-allow-and-restrict-resources-in-site-to-sit.

Description:

I have a VNet with a VPN Gateway set up, which acts as a hub and has peerings with three other VNets that host my production, testing, and development resources. Within each of these VNets, there are specific endpoints that the on-premises device should have access to (addresses are just examples):

Production: 10.100.1.2
Testing: 10.100.2.2
Development: 10.100.3.2

According to the first topic, I should modify the NSG rules in all three VNets. However, I found another topic: https://learn.microsoft.com/en-us/answers/questions/767869/site-to-site-vpn-subjects-to-nsg, which suggests that once traffic enters the Azure network via the VPN gateway in the hub VNet, it is treated as originating from within the Azure network itself. Consequently, my NSG rules would not work as intended, and the on-premises device would have access to all my resources.

What is the proper way to address this issue?