Manage inbound NAT rules for Azure Load Balancer

In this example, you create an inbound NAT rule to forward port 500 to backend port 443.

1. Sign in to the Azure portal.

2. In the search box at the top of the portal, enter Load balancer. Select Load balancers in the search results.

3. Select myLoadBalancer or your load balancer.

4. In the load balancer page, select Inbound NAT rules in Settings.

5. Select + Add in Inbound NAT rules to add the rule.

   

6. Enter or select the following information in Add inbound NAT rule.

   Setting	Value
   Name	Enter myInboundNATrule.
   Type	Select Azure Virtual Machine.
   Target virtual machine	Select the virtual machine that you wish to forward the port to. In this example, it's myVM1.
   Network IP configuration	Select the IP configuration of the virtual machine. In this example, it's ipconfig1(10.1.0.4).
   Frontend IP address	Select myFrontend.
   Frontend Port	Enter 500.
   Service Tag	Leave the default of Custom.
   Backend port	Enter 443.
   Protocol	Select TCP.

7. Leave the rest of the settings at the defaults and select Add.

   

Use Get-AzLoadBalancer to place the load balancer information into a variable.

Use Add-AzLoadBalancerInboundNatRuleConfig to create the inbound NAT rule.

To save the configuration to the load balancer, use Set-AzLoadBalancer.

Use Get-AzLoadBalancerInboundNatRuleConfig to place the newly created inbound NAT rule information into a variable.

Use Get-AzNetworkInterface to place the network interface information into a variable.

Use Set-AzNetworkInterfaceIpConfig to add the newly created inbound NAT rule to the IP configuration of the network interface.

To save the configuration to the network interface, use Set-AzNetworkInterface.

## Place the load balancer information into a variable for later use. ##
$slb = @{
    ResourceGroupName = 'myResourceGroup'
    Name = 'myLoadBalancer'
}
$lb = Get-AzLoadBalancer @slb

## Create the single virtual machine inbound NAT rule. ##
$rule = @{
    Name = 'myInboundNATrule'
    Protocol = 'Tcp'
    FrontendIpConfiguration = $lb.FrontendIpConfigurations[0]
    FrontendPort = '500'
    BackendPort = '443'
}
$lb | Add-AzLoadBalancerInboundNatRuleConfig @rule

$lb | Set-AzLoadBalancer

## Add the inbound NAT rule to a virtual machine 

$NatRule = @{                                                                                       
    Name = 'MyInboundNATrule'
    LoadBalancer = $lb
}

$NatRuleConfig = Get-AzLoadBalancerInboundNatRuleConfig @NatRule 

$NetworkInterface = @{                                                                                           
     ResourceGroupName = 'myResourceGroup'
     Name = 'MyNIC'
 }

 $NIC = Get-AzNetworkInterface @NetworkInterface

 $IPconfig = @{                                                                                       
    Name = 'Ipconfig'
    LoadBalancerInboundNatRule = $NatRuleConfig
}

$NIC | Set-AzNetworkInterfaceIpConfig @IPconfig

$NIC | Set-AzNetworkInterface  

• If you prefer to run CLI reference commands locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.

  • If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Sign in with the Azure CLI.

  • When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use extensions with the Azure CLI.

  • Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.

In this example, you will create an inbound NAT rule to forward port 500 to backend port 443. You will then attach the inbound NAT rule to a VM's NIC

Use az network lb inbound-nat-rule create to create the NAT rule.

Use az network nic ip-config inbound-nat-rule add to add the inbound NAT rule to a VM's NIC

    az network lb inbound-nat-rule create \
        --backend-port 443 \
        --lb-name myLoadBalancer \
        --name myInboundNATrule \
        --protocol Tcp \
        --resource-group myResourceGroup \
        --frontend-ip-name myFrontend \
        --frontend-port 500

    az network nic ip-config inbound-nat-rule add \
        --resource-group myResourceGroup \
        --nic-name MyNic \
        --ip-config-name MyIpConfig \
        --inbound-nat-rule MyNatRule \
        --lb-name myLoadBalancer

In this example, you create an inbound NAT rule to forward a range of ports starting at port 500 to backend port 443. The maximum number of machines in the backend pool is set by the parameter Maximum number of machines in backend pool with a value of 500. This setting limits the backend pool to 500 virtual machines.

1. Sign in to the Azure portal.

2. In the search box at the top of the portal, enter Load balancer. Select Load balancers in the search results.

3. Select myLoadBalancer or your load balancer.

4. In the load balancer page, select Inbound NAT rules in Settings.

5. Select + Add in Inbound NAT rules to add the rule.

   

6. Enter or select the following information in Add inbound NAT rule.

   Setting	Value
   Name	Enter myInboundNATrule.
   Type	Select Backend pool.
   Target backend pool	Select your backend pool. In this example, it's myBackendPool.
   Frontend IP address	Select your frontend IP address. In this example, it's myFrontend.
   Frontend port range start	Enter 500.
   Maximum number of machines in backend pool	Enter 500.
   Backend port	Enter 443.
   Protocol	Select TCP.

7. Leave the rest at the defaults and select Add.

   

In this example, you create an inbound NAT rule to forward a range of ports starting at port 500 to backend port 443. The maximum number of machines in the backend pool is set by the parameter -FrontendPortRangeEnd with a value of 1000. This setting limits the backend pool to 500 virtual machines.

Use Get-AzLoadBalancer to place the load balancer information into a variable.

Use Add-AzLoadBalancerInboundNatRuleConfig to create the inbound NAT rule.

To save the configuration to the load balancer, use Set-AzLoadBalancer

## Place the load balancer information into a variable for later use. ##
$slb = @{
    ResourceGroupName = 'myResourceGroup'
    Name = 'myLoadBalancer'
}
$lb = Get-AzLoadBalancer @slb

## Create the multiple virtual machines inbound NAT rule. ##
$rule = @{
    Name = 'myInboundNATrule'
    Protocol = 'Tcp'
    BackendPort = '443'
    FrontendIpConfiguration = $lb.FrontendIpConfigurations[0]
    FrontendPortRangeStart = '500'
    FrontendPortRangeEnd = '1000'
    BackendAddressPool = $lb.BackendAddressPools[0]
}
$lb | Add-AzLoadBalancerInboundNatRuleConfig @rule

$lb | Set-AzLoadBalancer

In this example, you create an inbound NAT rule to forward a range of ports starting at port 500 to backend port 443. The maximum number of machines in the backend pool is set by the parameter --frontend-port-range-end with a value of 1000. This setting limits the backend pool to 500 virtual machines.

Use az network lb inbound-nat-rule create to create the NAT rule.

    az network lb inbound-nat-rule create \
        --backend-port 443 \
        --lb-name myLoadBalancer \
        --name myInboundNATrule \
        --protocol Tcp \
        --resource-group myResourceGroup \
        --backend-pool-name myBackendPool \
        --frontend-ip-name myFrontend \
        --frontend-port-range-end 1000 \
        --frontend-port-range-start 500

To accommodate more virtual machines in the backend pool in a multiple instance rule, change the frontend port allocation in the inbound NAT rule. In this example, you change the Maximum number of machines in backend pool from 500 to 1000. This setting increases the maximum number of machines in the backend pool to 1000.

1. Sign in to the Azure portal.

2. In the search box at the top of the portal, enter Load balancer. Select Load balancers in the search results.

3. Select myLoadBalancer or your load balancer.

4. In the load balancer page, select Inbound NAT rules in Settings.

5. Select the inbound NAT rule you wish to change. In this example, it's myInboundNATrule.

   

6. In the properties of the inbound NAT rule, change the value in Maximum number of machines in backend pool to 1000.

7. Select Save.

   

To accommodate more virtual machines in the backend pool in a multiple instance rule, change the frontend port allocation in the inbound NAT rule. In this example, you change the parameter -FrontendPortRangeEnd to 1500. This setting increases the maximum number of machines in the backend pool to 1000.

Use Get-AzLoadBalancer to place the load balancer information into a variable.

To change the port allocation, use Set-AzLoadBalancerInboundNatRuleConfig.

## Place the load balancer information into a variable for later use. ##
$slb = @{
    ResourceGroupName = 'myResourceGroup'
    Name = 'myLoadBalancer'
}
$lb = Get-AzLoadBalancer @slb

## Set the new port allocation
$rule = @{
    Name = 'myInboundNATrule'
    Protocol = 'Tcp'
    BackendPort = '443'
    FrontendIpConfiguration = $lb.FrontendIpConfigurations[0]
    FrontendPortRangeStart = '500'
    FrontendPortRangeEnd = '1500'
    BackendAddressPool = $lb.BackendAddressPools[0]
}
$lb | Set-AzLoadBalancerInboundNatRuleConfig @rule

To accommodate more virtual machines in the backend pool, change the frontend port allocation in the inbound NAT rule. In this example, you change the parameter --frontend-port-range-end to 1500. This setting increases the maximum number of machines in the backend pool to 1000

Use az network lb inbound-nat-rule update to change the frontend port allocation.

    az network lb inbound-nat-rule update \
        --frontend-port-range-end 1500 \
        --lb-name myLoadBalancer \
        --name myInboundNATrule \
        --resource-group myResourceGroup

In this example, you remove an inbound NAT rule.

1. Sign in to the Azure portal.

2. In the search box at the top of the portal, enter Load balancer. Select Load balancers in the search results.

3. Select myLoadBalancer or your load balancer.

4. In the load balancer page in, select Inbound NAT rules in Settings.

5. Select the three dots next to the rule you want to remove.

6. Select Delete.

   

In this example, you remove an inbound NAT rule.

Use Get-AzLoadBalancer to place the load balancer information into a variable.

To remove the inbound NAT rule, use Remove-AzLoadBalancerInboundNatRuleConfig.

To save the configuration to the load balancer, use Set-AzLoadBalancer.

## Place the load balancer information into a variable for later use. ##
$slb = @{
    ResourceGroupName = 'myResourceGroup'
    Name = 'myLoadBalancer'
}
$lb = Get-AzLoadBalancer @slb

## Remove the inbound NAT rule
$lb | Remove-AzLoadBalancerInboundNatRuleConfig -Name 'myInboundNATrule'

$lb | Set-AzLoadBalancer

In this example, you remove an inbound NAT rule.

Use az network lb inbound-nat-rule delete to remove the rule.

    az network lb inbound-nat-rule delete \
        --lb-name myLoadBalancer \
        --name myInboundNATrule \
        --resource-group myResourceGroup