Manage inbound NAT rules for Azure Load Balancer

An inbound NAT rule is used to forward traffic from a load balancer frontend to one or more instances in the backend pool.

There are two types of inbound NAT rule:

  • Inbound NAT rule V1 for VMs - Targets a single machine in the backend pool of the load balancer

  • Inbound NAT rule V2 for VMs and VMSS- Targets multiple virtual machines in the backend pool of the load balancer

In this article, you learn how to add and remove an inbound NAT rule for both types. You learn how to change the frontend port allocation in a multiple instance inbound NAT rule. You can choose from the Azure portal, PowerShell, or CLI examples.

If you don't have an Azure subscription, create an Azure free account before you begin.

Prerequisites

  • A public load balancer in your subscription. For more information on creating an Azure Load Balancer, see Quickstart: Create a public load balancer to load balance VMs using the Azure portal. The load balancer name for the examples in this article is myLoadBalancer.
  • If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. Run Get-Module -ListAvailable Az to find the installed version. If you need to upgrade, see Install Azure PowerShell module. If you're running PowerShell locally, you also need to run Connect-AzAccount to create a connection with Azure.

Inbound NAT rule V1 for VMs

Choose this option to configure a rule for a single VM. Select Azure portal, PowerShell, or CLI for instructions.

In this example, you create an inbound NAT rule to forward port 500 to backend port 443.

  1. Sign in to the Azure portal.

  2. In the search box at the top of the portal, enter Load balancer. Select Load balancers in the search results.

  3. Select myLoadBalancer or your load balancer.

  4. In the load balancer page, select Inbound NAT rules in Settings.

  5. Select + Add in Inbound NAT rules to add the rule.

    Screenshot of the inbound NAT rules page for Azure Load Balancer

  6. Enter or select the following information in Add inbound NAT rule.

    Setting Value
    Name Enter myInboundNATrule.
    Type Select Azure Virtual Machine.
    Target virtual machine Select the virtual machine that you wish to forward the port to. In this example, it's myVM1.
    Network IP configuration Select the IP configuration of the virtual machine. In this example, it's ipconfig1(10.1.0.4).
    Frontend IP address Select myFrontend.
    Frontend Port Enter 500.
    Service Tag Leave the default of Custom.
    Backend port Enter 443.
    Protocol Select TCP.
  7. Leave the rest of the settings at the defaults and select Add.

    Screenshot of the create inbound NAT rule page

Inbound NAT rule V2 for VM and VMSS

Choose this option to configure a rule with a range of ports to a backend pool of virtual machines. Select Azure portal, PowerShell, or CLI for instructions.

In this example, you create an inbound NAT rule to forward a range of ports starting at port 500 to backend port 443. The maximum number of machines in the backend pool is set by the parameter Maximum number of machines in backend pool with a value of 500. This setting limits the backend pool to 500 virtual machines.

  1. Sign in to the Azure portal.

  2. In the search box at the top of the portal, enter Load balancer. Select Load balancers in the search results.

  3. Select myLoadBalancer or your load balancer.

  4. In the load balancer page, select Inbound NAT rules in Settings.

  5. Select + Add in Inbound NAT rules to add the rule.

    Screenshot of the inbound NAT rules page for Azure Load Balancer

  6. Enter or select the following information in Add inbound NAT rule.

    Setting Value
    Name Enter myInboundNATrule.
    Type Select Backend pool.
    Target backend pool Select your backend pool. In this example, it's myBackendPool.
    Frontend IP address Select your frontend IP address. In this example, it's myFrontend.
    Frontend port range start Enter 500.
    Maximum number of machines in backend pool Enter 500.
    Backend port Enter 443.
    Protocol Select TCP.
  7. Leave the rest at the defaults and select Add.

    Screenshot of the add inbound NAT rules page

Change frontend port allocation for a multiple VM rule

To accommodate more virtual machines in the backend pool in a multiple instance rule, change the frontend port allocation in the inbound NAT rule. In this example, you change the Maximum number of machines in backend pool from 500 to 1000. This setting increases the maximum number of machines in the backend pool to 1000.

  1. Sign in to the Azure portal.

  2. In the search box at the top of the portal, enter Load balancer. Select Load balancers in the search results.

  3. Select myLoadBalancer or your load balancer.

  4. In the load balancer page, select Inbound NAT rules in Settings.

  5. Select the inbound NAT rule you wish to change. In this example, it's myInboundNATrule.

    Screenshot of inbound NAT rule overview.

  6. In the properties of the inbound NAT rule, change the value in Maximum number of machines in backend pool to 1000.

  7. Select Save.

    Screenshot of inbound NAT rule properties page.

View port mappings

Port mappings for the virtual machines in the backend pool can be viewed by using the Azure portal.

  1. Sign in to the Azure portal.

  2. In the search box at the top of the portal, enter Load balancer. Select Load balancers in the search results.

  3. Select myLoadBalancer or your load balancer.

  4. In the load balancer page in, select Inbound NAT rules in Settings.

  5. Select myInboundNATrule or your inbound NAT rule.

    Screenshot of inbound NAT rule page.

  6. Scroll to the Port mapping section of the inbound NAT rule properties page.

    Screenshot of inbound NAT rule port mappings.

Remove an inbound NAT rule

In this example, you remove an inbound NAT rule.

  1. Sign in to the Azure portal.

  2. In the search box at the top of the portal, enter Load balancer. Select Load balancers in the search results.

  3. Select myLoadBalancer or your load balancer.

  4. In the load balancer page in, select Inbound NAT rules in Settings.

  5. Select the three dots next to the rule you want to remove.

  6. Select Delete.

    Screenshot of inbound NAT rule removal.

Next steps

In this article, you learned how to manage inbound NAT rules for an Azure Load Balancer using the Azure portal, PowerShell and CLI.

For more information about Azure Load Balancer, see: