Will a public load balancer with a public IPv4 address without an outbound rule have outbound connectivity once default outbound access goes away?

Question

Howdy,

Default outbound access is being retired:

https://azure.microsoft.com/en-us/updates?id=default-outbound-access-for-vms-in-azure-will-be-retired-transition-to-a-new-method-of-internet-access

Default outbound access flow is described here:

https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/default-outbound-access#when-is-default-outbound-access-provided

Where I work, we create clusters using method #4 here:

https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections

We create public load balancers with attached public IPv4 addresses. All VMs in the backend pool have private IP addresses.

The language here is not clear to me if we will lose connectivity or not.

This answer leaves me just as confused:

https://learn.microsoft.com/en-us/answers/questions/1382414/default-outbound-access-for-vms-in-azure-will-be-r

It is clear if public IP addresses are on VMs then outbound connectivity will not be affected. It is not clear if a public load balancer with public IP address is used for outbound connectivity (without outbound rules) will be affected.

Does anybody have the answer for this?

Answer 1

Hi @John Hixson , I understand you seek clarity whether your VMs behind a public load balancer will lose outbound access to internet if you don't have any outbound rule on the load balancer.

Answer is no. Your VMs behind a public load balancer without any outbound rule continue to have outbound access to internet using the public IP address assigned to the load balancer. Please note that this setup is not recommended for production workload, because:

• Outbound via load balancer is done implicitly without rules that specify which frontend would be used.
• Not using outbound rules decreases scalability of outbound, as implicit outbound connectivity has a fixed number of SNAT ports per frontend IP address, which could lead to port exhaustion in high-traffic scenarios.

If it's a production workload, I suggest you add load balancer outbound rules to prevent potential issues such as port exhaustion.

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.