This setup is basically a secure way to run a private server in the cloud without exposing it directly to the internet.

Here’s the simple idea:
Users on the internet try to access your system.
Their request first goes through a firewall, which acts like a security guard—only safe traffic is allowed in.
Inside the cloud network (VNet), there are strict rules (NSG) that only allow specific actions, like web traffic (port 80), and block everything else.
The main server (VM) is completely private—it has no public IP, so outsiders can’t reach it directly.
If an admin needs access, they use a secure entry point (Bastion) instead of connecting directly.
When the server needs to access the internet (for updates, etc.), it goes out through a NAT gateway, which hides its identity.

In short:
Everything is locked down. The public only sees the firewall, admins use a secure door, and the actual server stays hidden and protected.