Availability Group in Azure -- can't reach listener

I've set up an Always On Availability Group in Azure. Four VMs:

1. Domain Controller DC
2. SQL Server 1
3. SQL Server 2
4. Windows 10 client machine

The servers are all running Windows Server 2012 R2 Datacenter. SQL is 2012 SP3. Everything is up to date.

I built an AG using the two SQL servers. It works and I can fail over back and forth without issues. There is also a listener (call it AGListener) which I can connect to from SQL Server 1 only. That's the first issue

The second issue is that I cannot connect to the listener from the Windows 10 client machine either (probably the same as the first issue, now I think of it).

From SQL 2 and the Win 10 VM, I can run nslookup AGListen. It works and returns the correct IP. When I try to ping that IP, I get "host unreachable" which is nonsense to me since all four vms are on the same subnet (10.0.0.5, 6, 7, 8) as is the listener (10.0.0.100) and the cluster (10.0.0.254)

Any clue what I'm missing or how to debug this?