Azure API Management service with external virtual network to Docker

I want to use the Azure API Management Service (AMS) to expose the API created with R/Plumber hosted in a Docker container and runs in an Ubuntu machine.

Scenario
With `R/Plumber` I created some APIs that I want to protect. Then, I created a virtual machine on Azure with Ubuntu and installed Docker. The APIs are in a container that I published on the virtual machine by Docker. I can access them via internet.

On Azure I created an API Management service and added the APIs from the Swagger OpenAPI documentation.

Problem
I want to secure the APIs. I want to expose to the internet only the AMS. Then, my idea was to remove the public IP from the virtual machine and via a virtual network using the internal IPs to connect the API Management Service to the API with the internal IP (http://10.0.1.5:8000).

So, I tried to set a Virtual Network. Clicked on the menu, then External and then on the row, I can select a network. In this virtual network, I have one `network interface` that is the one the virtual machine is using.

When I save the changes, I have to wait a while and then I receive an error

Failed to connect to management endpoint at azuks-chi-testapi-d1.management.azure-api.net:3443 for a service deployed in a virtual network. Make sure to follow guidance at https://aka.ms/apim-vnet-common-issues.

I read the following documentation but I can't understand how to do what I wanted

• Azure API Management - External Type: gateway unable to access resources within the virtual network?
• How to use Azure API Management with virtual networks

Also, I tried to add more Address space in the Virtual network.

One of them (10.0.0.2/24) is delegate for the API Management.

Then, in the Network security group I added the port 3443.

From the API manager I can't reach the server with the internet IP (10.0.2.5).

Is there any how-to to use? Any advice? What are I doing wrong?