Provisioning an Azure Bastion

1. Start Locally

Firstly, we need to launch Locally which we can do from a terminal by running:

Once Locally has started, the Locally Dashboard will open automatically:

2. Create a Resource Group

Next we can create the Resource Group:

There's two things to note here:

1. The Azure CLI supports Automatic Configuration, meaning that it can automatically be configured to work against Locally just by prefixing commands with locally run.
2. Locally intentionally uses a different set of locations to Azure as a safety precaution, so that you can be confident you're deploying against Locally rather than regular Azure. You can also configure Locally to use the Azure locations too, but you'll want to be extra sure that you're prefixing commands with locally run when you do.

3. Create the Virtual Network

As in Azure, a Bastion lives in its own subnet, which has to be called AzureBastionSubnet. We'll create a Virtual Network with that subnet:

And a second subnet for the Virtual Machine:

Which leaves us with both subnets:

Name                Prefix
------------------  -----------
AzureBastionSubnet  10.0.0.0/26
workloads           10.0.1.0/24

4. Create the Bastion

A Bastion needs a Standard Public IP Address, so we'll create one of those first:

Then the Bastion itself. The Azure CLI finds the AzureBastionSubnet in the Virtual Network for us:

{
  "name": "sample-bastion-host",
  "sku": "Standard",
  "state": "Succeeded",
  "subnet": "/subscriptions/307d8f52-9719-460e-9f85-aa408e28ee55/resourceGroups/sample-bastion/providers/Microsoft.Network/virtualNetworks/sample-vnet/subnets/AzureBastionSubnet"
}

If the Virtual Network doesn't have an AzureBastionSubnet, the create fails instead.

We can see the Bastion in the Locally Dashboard too:

5. Create a Virtual Machine

Now we can create an Ubuntu Virtual Machine in the workloads subnet. Passing an empty --public-ip-address stops the Azure CLI creating a Public IP for it, so the only way in is through the Bastion:

{
  "fqdns": "",
  "id": "/subscriptions/307d8f52-9719-460e-9f85-aa408e28ee55/resourceGroups/sample-bastion/providers/Microsoft.Compute/virtualMachines/bastionvm1",
  "location": "berlin",
  "macAddress": "00-0D-3A-DB-CC-9C",
  "powerState": "VM running",
  "privateIpAddress": "10.0.1.4",
  "publicIpAddress": "",
  "resourceGroup": "sample-bastion"
}

It only has a private address. Behind it is a container running Ubuntu 24.04 - see Provisioning a Virtual Machine for more on how Virtual Machines work in Locally.

6. Connect through the Bastion

Without a Public IP, connecting to the Virtual Machine directly doesn't work:

virtual machine "bastionvm1" has no public IP and no load balancer NAT rule to connect to; give it a public IP, add an inbound NAT rule reaching its network interface, or reach it through a bastion with '--bastion'

So we go through the Bastion instead. On its own, --bastion lists the Virtual Machines we can reach through it:

VMs reachable through bastion "sample-bastion-host" (vnet: sample-vnet):

NAME        PRIVATE IP  SUBNET
bastionvm1  10.0.1.4    workloads

Connect with:  locally connect --bastion sample-bastion-host --virtual-machine <NAME>

Adding --virtual-machine connects to it:

This opens an SSH session in your terminal, with the admin password filled in for you. Rather than a shell, what answers is a view of the Virtual Machine itself, along with which Bastion the session came through:

There are a few differences from Azure here - az network bastion ssh, rdp and tunnel aren't supported, there's no in-browser session, and only Virtual Machines in the Bastion's own Virtual Network can be reached. The Bastion Emulator covers these in full.

7. Tidy up

To delete just the Bastion:

Or to remove the Resource Group and everything within it, including the Virtual Machine's container:

Doing this with other tooling

Whilst this guide used the Azure CLI, Bastions work the same way through any of the tooling that Locally supports - a Microsoft.Network/bastionHosts resource in HashiCorp Terraform or OpenTofu, Pulumi, Bicep or an ARM Template all provision against Locally in the same way, and locally connect works however the Bastion was created.

Next steps

The Virtual Machines Emulator explains what's behind the Virtual Machine you connect to. To control traffic within the Virtual Network, see Network Security Group.

Should you encounter any issues, please take a look at the troubleshooting section.