Tutorial: Create a single virtual machine inbound NAT rule using the Azure portal
Article
10/24/2023
Inbound NAT rules allow you to connect to virtual machines (VMs) in an Azure virtual network by using an Azure Load Balancer public IP address and port number.
A virtual network and subnet is required for the resources in the tutorial. In this section, you create a virtual network and virtual machines for the later steps.
In the search box at the top of the portal, enter Virtual machine. Select Virtual machines in the search results.
In Virtual machines, select + Create > + Virtual machine.
In Create a virtual machine, enter or select the following values in the Basics tab:
Setting
Value
Project details
Subscription
Select your subscription.
Resource group
Select Create new. Enter load-balancer-rg. Select OK.
Instance details
Virtual machine name
Enter lb-vm1.
Region
Select ((US) East US).
Availability options
Select Availability zone.
Availability zone
Select Zone 1.
Security type
Select Standard.
Image
Select Ubuntu Server 20.04 LTS - Gen2.
Azure Spot instance
Leave the default of unchecked.
Size
Select a VM size.
Administrator account
Authentication type
Select SSH public key.
Username
Enter azureuser.
SSH public key source
Select Generate new key pair.
Key pair name
Enter lb-key-pair.
Inbound port rules
Public inbound ports
Select None.
Select the Networking tab, or select Next: Disks, then Next: Networking.
In the Networking tab, enter or select the following information.
Setting
Value
Network interface
Virtual network
Select Create new. Enter lb-vnet in Name. In Address space, under Address range, enter 10.0.0.0/16. In Subnets, under Subnet name, enter backend-subnet. In Address range, enter 10.0.1.0/24. Select OK.
Subnet
Select backend-subnet.
Public IP
Select None.
NIC network security group
Select Advanced.
Configure network security group
Select Create new. Enter lb-NSG in Name. Select + Add an inbound rule under Inbound rules. In Service, select HTTP. Enter 100 in Priority. Enter lb-NSG-Rule for Name. Select Add. Select OK.
Select the Review + create tab, or select the Review + create button at the bottom of the page.
Select Create.
At the Generate new key pair prompt, select Download private key and create resource. Your key file is downloaded as lb-key-pair.pem. Ensure you know where the .pem file was downloaded, you'll need the path to the key file in later steps.
Follow the steps 1 through 7 to create another VM with the following values and all the other settings the same as lb-vm1:
Setting
Value
Basics
Instance details
Virtual machine name
Enter lb-vm2
Availability zone
Select Zone 2
Administrator account
Authentication type
Select SSH public key
SSH public key source
Select Use existing key stored in Azure.
Stored Keys
Select lb-key-pair.
Inbound port rules
Public inbound ports
Select None.
Networking
Network interface
Public IP
Select None.
NIC network security group
Select Advanced.
Configure network security group
Select the existing lb-NSG
Create a load balancer
You create a load balancer in this section. The frontend IP, backend pool, load-balancing, and inbound NAT rules are configured as part of the creation.
In the search box at the top of the portal, enter Load balancer. Select Load balancers in the search results.
In the Load balancer page, select Create.
In the Basics tab of the Create load balancer page, enter, or select the following information:
Setting
Value
Project details
Subscription
Select your subscription.
Resource group
Select load-balancer-rg.
Instance details
Name
Enter load-balancer
Region
Select East US.
SKU
Leave the default Standard.
Type
Select Public.
Tier
Leave the default Regional.
Select Next: Frontend IP configuration at the bottom of the page.
In Frontend IP configuration, select + Add a frontend IP configuration.
Enter lb-frontend in Name.
Select IPv4 or IPv6 for the IP version.
Note
IPv6 isn't currently supported with Routing Preference or Cross-region load-balancing (Global Tier).
In Add a public IP address, enter lb-frontend-ip for Name.
Select Zone-redundant in Availability zone.
Note
In regions with Availability Zones, you have the option to select no-zone (default option), a specific zone, or zone-redundant. The choice will depend on your specific domain failure requirements. In regions without Availability Zones, this field won't appear. For more information on availability zones, see Availability zones overview.
Leave the default of Microsoft Network for Routing preference.
Select OK.
Select Add.
Select Next: Backend pools at the bottom of the page.
In the Backend pools tab, select + Add a backend pool.
Enter or select the following information in Add backend pool.
Setting
Value
Name
Enter lb-backend-pool.
Virtual network
Select lb-vnet (load-balancer-rg).
Backend Pool Configuration
Select NIC.
Select + Add in Virtual machines.
Select the checkboxes next to lb-vm1 and lb-vm2 in Add virtual machines to backend pool.
Select Add and then select Save.
Select the Next: Inbound rules button at the bottom of the page.
In Load balancing rule in the Inbound rules tab, select + Add a load balancing rule.
In Add load balancing rule, enter or select the following information.
Setting
Value
Name
Enter lb-HTTP-rule
IP Version
Select IPv4 or IPv6 depending on your requirements.
Frontend IP address
Select lb-frontend (To be created).
Backend pool
Select lb-backend-pool.
Protocol
Select TCP.
Port
Enter 80.
Backend port
Enter 80.
Health probe
Select Create new. In Name, enter lb-health-probe. Select TCP in Protocol. Leave the rest of the defaults, and select Save.
In the search box at the top of the portal, enter NAT gateway. Select NAT gateways in the search results.
In NAT gateways, select + Create.
In Create network address translation (NAT) gateway, enter or select the following information:
Setting
Value
Project details
Subscription
Select your subscription.
Resource group
Select load-balancer-rg.
Instance details
NAT gateway name
Enter lb-nat-gateway.
Region
Select East US.
Availability zone
Select None.
Idle timeout (minutes)
Enter 15.
Select the Outbound IP tab or select the Next: Outbound IP button at the bottom of the page.
In Outbound IP, select Create a new public IP address next to Public IP addresses.
Enter nat-gw-public-ip in Name in Add a public IP address.
Select OK.
Select the Subnet tab or select the Next: Subnet button at the bottom of the page.
In Virtual network in the Subnet tab, select lb-vnet.
Select backend-subnet under Subnet name.
Select the blue Review + create button at the bottom of the page, or select the Review + create tab.
Select Create.
Install web server
In this section, you'll SSH to the virtual machines through the inbound NAT rules and install a web server.
In the search box at the top of the portal, enter Load balancer. Select Load balancers in the search results.
Select load-balancer.
Select Fronted IP configuration in Settings.
In the Frontend IP configuration, make note of the IP address for lb-frontend. In this example, it's 20.99.165.176.
If you're using a Mac or Linux computer, open a Bash prompt. If you're using a Windows computer, open a PowerShell prompt.
At your prompt, open an SSH connection to lb-vm1. Replace the IP address with the address you retrieved in the previous step and port 221 you used for the lb-vm1 inbound NAT rule. Replace the path to the .pem with the path to where the key file was downloaded.
The SSH key you created can be used the next time your create a VM in Azure. Just select the Use a key stored in Azure for SSH public key source the next time you create a VM. You already have the private key on your computer, so you won't need to download anything.
From your SSH session, update your package sources and then install the latest NGINX package.
At your prompt, open an SSH connection to lb-vm2. Replace the IP address with the address you retrieved in the previous step and port 222 you used for the lb-vm2 inbound NAT rule. Replace the path to the .pem with the path to where the key file was downloaded.
In this tutorial, learn how to configure port forwarding using Azure Load Balancer to create a connection to multiple virtual machines in an Azure virtual network.
