How to make a role only accessible via AzureConnect

Is it possible to configure a role endpoint that only allows communication over Azure Connect? ie, I have a web application that I do not want to expose to the outside world, but would like local endpoints (Azure Connect machines) to have access to without additional security.

In a full-vpn scenario开发者_高级运维 this would just happen, but I'm struggling to define/setup in the constraints of Azure Connect and the csdef. I have role(s) communicating with on-campus resources via connect, but I can't seem to limit access to these resources without declaring a standard http Endpoint. Tried just creating an internal Endpoint, but it appears this is only allowing access w/i the actual datacenter (b/t hosted roles)

---

I think that an internal endpoint would do the trick. That would get IIS (assuming you're using a web role) to listen on the right (be sure to specify one so you know what it is), and it won't open up to traffic from the internet.

What happens when you use an internal endpoint and try to connect to it? And do other sorts of connections work? (Are you sure Connect itself is working?)