Most likely because the NAT gateway only serves Azure devices instanciated in the VNET where the NAT gateway is then.   At this point, if it has to be in azure you must deploy an NVA. Azure firewall basic is not that bad price wise. ... View more