Tutorial: Configure dual stack outbound connectivity with a NAT gateway and a public load balancer

• An Azure account with an active subscription. Create an account for trial.

• If you prefer to run CLI reference commands locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.

  • If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Sign in with the Azure CLI.

  • When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use extensions with the Azure CLI.

  • Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.

• An Azure account with an active subscription. Create an account for trial.

• This tutorial requires version 2.0.28 or later of the Azure CLI.

Sign in to the Azure portal with your Azure account.

Use az login to sign in to Azure.

az login

The following procedure creates a virtual network with a resource subnet, an Azure Bastion subnet, and an Azure Bastion host.

1. In the portal, search for and select Virtual networks.

2. On the Virtual networks page, select + Create.

3. On the Basics tab of Create virtual network, enter or select the following information:

   Setting	Value
   Project details
   Subscription	Select your subscription.
   Resource group	Select Create new. Enter test-rg in Name. Select OK.
   Instance details
   Name	Enter vnet-1.
   Region	Select (Asia Pacific) China East 2.

   

4. Select Next: IP Addresses to proceed to the IP　Address tab.

5. In the IP Addresses tab, under IPv4 address space, select the garbage deletion icon to remove any address space that already appears, and then enter 10.0.0.0/16.

6. Select + Add subnet.

7. Enter or select the following information in Add subnet:

   Setting	Value
   Subnet name	Enter subnet-1.
   Subnet address range	Enter 10.0.0.0/24.

   

8. Select Add.

9. Select Next: Security to proceed to the Security tab.

10. On the Security tab, next to BastionHost, select Enable.

    Azure Bastion uses your browser to connect to VMs in your virtual network over secure shell (SSH) or remote desktop protocol (RDP) by using their private IP addresses. The VMs don't need public IP addresses, client software, or special configuration. For more information about Azure Bastion, see Azure Bastion

    Note

    Hourly pricing starts from the moment that Bastion is deployed, regardless of outbound data usage. For more information, see Pricing and SKUs. If you're deploying Bastion as part of a tutorial or test, we recommend that you delete this resource after you finish using it.

11. Enter or select the following information:

    Setting	Value
    Bastion name	Enter bastion.
    AzureBastionSubnet address space	Enter 10.0.1.0/26.
    Public IP address	Select Create new. Enter public-ip in Name. Select OK.

    

12. Select Review + create at the bottom of the screen, and when validation passes, select Create.

Create a resource group

An Azure resource group is a logical container where Azure resources are deployed and managed.

Create a resource group with az group create.

az group create \
    --name test-rg \
    --location chinanorth3

Create network and subnets

Use az network vnet create to create the virtual network.

az network vnet create \
    --resource-group test-rg \
    --location chinanorth3 \
    --name vnet-1 \
    --address-prefixes '10.0.0.0/16'

Use az network vnet subnet create to create the IPv4 subnet for the virtual network and the Azure Bastion subnet.

az network vnet subnet create \
    --name subnet-1 \
    --resource-group test-rg \
    --vnet-name vnet-1 \
    --address-prefixes '10.0.0.0/24'

az network vnet subnet create \
    --name AzureBastionSubnet \
    --resource-group test-rg \
    --vnet-name vnet-1 \
    --address-prefixes '10.0.1.0/26'

Create bastion host

Use az network public-ip create to create a public IP address for the bastion host.

az network public-ip create \
    --resource-group test-rg \
    --name public-ip \
    --sku standard \
    --zone 1 2 3

Use az network bastion create to create the bastion host.

az network bastion create \
    --resource-group test-rg \
    --name bastion \
    --public-ip-address public-ip \
    --vnet-name vnet-1 \
    --location chinanorth3
    --sku basic

1. In the search box at the top of the portal, enter NAT gateway. Select NAT gateways in the search results.

2. Select + Create.

3. In the Basics tab of Create network address translation (NAT) gateway, enter or select the following information:

   Setting	Value
   Project details
   Subscription	Select your subscription.
   Resource group	Select test-rg.
   Instance details
   NAT gateway name	Enter nat-gateway.
   Region	Select China North 3.
   Availability zone	Select a zone or No Zone.
   TCP idle timeout (minutes)	Leave the default of 4.

4. Select Next: Outbound IP.

5. In Public IP addresses, select Create a new public IP address.

6. Enter public-ip-nat in Name. Select OK.

7. Select Next: Subnet.

8. In Virtual network, select vnet-1.

9. In the list of subnets, select the box for subnet-1.

10. Select Review + create.

11. Select Create.

Use az network public-ip create to create a public IPv4 address for the NAT gateway.

az network public-ip create \
    --resource-group test-rg \
    --name public-ip-nat \
    --sku standard \
    --zone 1 2 3

Use az network nat gateway create to create the NAT gateway.

az network nat gateway create \
    --resource-group test-rg \
    --name nat-gateway \
    --public-ip-addresses public-ip-nat \
    --idle-timeout 4

Use az network vnet subnet update to associate the NAT gateway with subnet-1.

az network vnet subnet update \
    --resource-group test-rg \
    --vnet-name vnet-1 \
    --name subnet-1 \
    --nat-gateway nat-gateway

1. In the search box at the top of the portal, enter Virtual network. Select Virtual networks in the search results.

2. Select vnet-1.

3. In Settings, select Address space.

4. In the box that displays Add additional address range, enter 2404:f800:8000:122::/63.

5. Select Save.

6. Select Subnets in Settings.

7. Select subnet-1 in the list of subnets.

8. Select the box next to Add IPv6 address space.

9. Enter 2404:f800:8000:122::/64 in IPv6 address space.

10. Select Save.

Use az network vnet update to add the IPv6 address space to the virtual network.

az network vnet update \
    --address-prefixes 10.0.0.0/16 2404:f800:8000:122::/63 \
    --name vnet-1 \
    --resource-group test-rg

Use az network vnet subnet update to add the IPv6 subnet to the virtual network.

az network vnet subnet update \
    --address-prefixes 10.0.0.0/24 2404:f800:8000:122::/64 \
    --name subnet-1 \
    --vnet-name vnet-1 \
    --resource-group test-rg

The following procedure creates a test virtual machine (VM) named vm-1 in the virtual network.

1. In the portal, search for and select Virtual machines.

2. In Virtual machines, select + Create, then Azure virtual machine.

3. On the Basics tab of Create a virtual machine, enter or select the following information:

   Setting	Value
   Project details
   Subscription	Select your subscription.
   Resource group	Select test-rg.
   Instance details
   Virtual machine name	Enter vm-1.
   Region	Select China North 3.
   Availability options	Select No infrastructure redundancy required.
   Security type	Select Standard.
   Image	Select Ubuntu Server 22.04 LTS - Gen2.
   Size	Select a size.
   Administrator account
   Authentication type	Select Password.
   Username	Enter azureuser.
   Password	Enter a password.
   Confirm password	Reenter the password.
   Inbound port rules
   Public inbound ports	Select None.

4. Select the Networking tab at the top of the page.

5. Enter or select the following information in the Networking tab:

   Setting	Value
   Network interface
   Virtual network	Select vnet-1.
   Subnet	Select subnet-1 (10.0.0.0/24).
   Public IP	Select None.
   NIC network security group	Select Advanced.
   Configure network security group	Select Create new. Enter nsg-1 for the name. Leave the rest at the defaults and select OK.

6. Leave the rest of the settings at the defaults and select Review + create.

7. Review the settings and select Create.

Wait for the virtual machine to finish deploying before continuing on to the next steps.

Add IPv6 to virtual machine

The support IPv6, the virtual machine must have a IPv6 network configuration added to the network interface. Use the following example to add a IPv6 network configuration to the virtual machine.

1. In the search box at the top of the portal, enter Virtual machine. Select Virtual machines in the search results.

2. Select vm-1.

3. In Settings select Networking.

4. Select the name of the network interface in the Network Interface: field. The name of the network interface is the virtual machine name plus a random number. In this example, it's vm-1202.

5. In the network interface properties, select IP configurations in Settings.

6. Select + Add.

7. Enter or select the following information in Add IP configuration:

   Setting	Value
   Name	Enter ipconfig-ipv6.
   IP version	Select IPv6.

8. Leave the rest of the settings at the defaults and select Add.

Create NSG

Use az network nsg create to create a network security group for the virtual machine.

az network nsg create \
    --name nsg-1 \
    --resource-group test-rg

Use az network nsg rule create to create a rule for RDP connectivity to the virtual machine.

az network nsg rule create \
    --resource-group test-rg \
    --nsg-name nsg-1 \
    --name ssh-rule \
    --protocol '*' \
    --direction inbound \
    --source-address-prefix '*' \
    --source-port-range '*' \
    --destination-address-prefix '*' \
    --destination-port-range 22 \
    --access allow \
    --priority 200

Create network interface

Use az network nic create to create the network interface for the virtual machine.

az network nic create \
    --name nic-1 \
    --resource-group test-rg \
    --vnet-name vnet-1 \
    --subnet subnet-1 \
    --private-ip-address-version IPv4 

Add IPv6 to network interface

The support IPv6, the virtual machine must have a IPv6 network configuration added to the network interface. IPv6 can't be the primary IP configuration for a virtual machine network interface. For more information, see Overview of IPv6.

Use az network nic ip-config create to add the IPv6 configuration to the network interface.

az network nic ip-config create \
    --name ipconfig-ipv6 \
    --nic-name nic-1 \
    --resource-group test-rg \
    --vnet-name vnet-1 \
    --subnet subnet-1 \
    --private-ip-address-version IPv6

Create the virtual machine

Use az vm create to create the virtual machine.

az vm create \
    --resource-group test-rg \
    --name vm-1 \
    --image Ubuntu2204 \
    --admin-username azureuser \
    --authentication-type password \
    --nics nic-1    

1. In the search box at the top of the portal, enter Load balancer. Select Load balancers in the search results.

2. Select + Create.

3. In the Basics tab of Create load balancer, enter or select the following information:

   Setting	Value
   Project details
   Subscription	Select your subscription.
   Resource group	Select test-rg.
   Instance details
   Name	Enter load-balancer.
   Region	Select China North 3.
   SKU	Leave the default of Standard.
   Type	Select Public.

4. Select Next: Frontend IP configuration.

5. Select + Add a frontend IP configuration.

6. Enter or select the following information in Add frontend IP configuration:

   Setting	Value
   Name	Enter frontend-ipv6.
   IP version	Select IPv6.
   IP type	Select IP address.
   Public IP address	Select Create new. In Name enter public-ip-ipv6. Select OK.

7. Select Add.

8. Select Next: Backend pools.

9. Select + Add a backend pool.

10. Enter or select the following information in Add backend pool:

    Setting	Value
    Name	Enter backend-pool.
    Virtual network	Select vnet-1 (test-rg).
    Backend Pool Configuration	Leave the default of NIC.

11. Select Save.

12. Select Next: Inbound rules then Next: Outbound rules.

13. Select Add an outbound rule.

14. Enter or select the following information in Add outbound rule:

    Setting	Value
    Name	Enter outbound-rule.
    IP Version	Select IPv6.
    Frontend IP address	Select frontend-ipv6.
    Protocol	Leave the default of All.
    Idle timeout (minutes)	Leave the default of 4.
    TCP Reset	Leave the default of Enabled.
    Backend pool	Select backend-pool.
    Port allocation
    Port allocation	Select Manually choose number of outbound ports.
    Outbound ports
    Choose by	Select Ports per instance.
    Ports per instance	Enter 20000.

15. Select Add.

16. Select Review + create.

17. Select Create.

Wait for the load balancer to finish deploying before proceeding to the next steps.

Add virtual machine to load balancer

1. In the search box at the top of the portal, enter Load balancer. Select Load balancers in the search results.

2. Select load-balancer.

3. In Settings select Backend pools.

4. Select backend-pool.

5. In Virtual network select vnet-1 (test-rg).

6. In IP configurations select + Add.

7. Select the checkbox for vm-1 that corresponds with the IP configuration of ipconfig-ipv6. Don't select ipconfig1.

8. Select Add.

9. Select Save.

Use az network public-ip create to create a public IPv6 address for the frontend IP address of the load balancer.

az network public-ip create \
    --resource-group test-rg \
    --name public-ip-ipv6 \
    --sku standard \
    --version IPv6 \
    --zone 1 2 3

Use az network lb create to create the load balancer.

az network lb create \
    --name load-balancer \
    --resource-group test-rg \
    --backend-pool-name backend-pool \
    --frontend-ip-name frontend-ipv6 \
    --location chinanorth3 \
    --public-ip-address public-ip-ipv6 \
    --sku standard

Use az network lb outbound-rule create to create the outbound rule for the backend pool of the load balancer. The outbound rule enables outbound connectivity for virtual machines in the backend pool of the load balancer.

az network lb outbound-rule create \
    --address-pool backend-pool \
    --frontend-ip-configs frontend-ipv6 \
    --lb-name load-balancer \
    --name outbound-rule \
    --protocol All \
    --resource-group test-rg \
    --outbound-ports 20000 \
    --enable-tcp-reset true

Add virtual machine to load balancer

Use az network nic ip-config address-pool add to add the network interface of the virtual machine to the backend pool of the load balancer.

az network nic ip-config address-pool add \
    --address-pool backend-pool \
    --ip-config-name ipconfig-ipv6 \
    --nic-name nic-1 \
    --resource-group test-rg \
    --lb-name load-balancer

1. In the search box at the top of the portal, enter Public IP address. Select Public IP addresses in the search results.

2. Select public-ip-nat.

3. Make note of the address in IP address. In this example, it's 203.0.113.5.

4. Return to Public IP addresses.

5. Select public-ip-ipv6.

6. Make note of the address in IP address. In this example, it's 2001:DB8::14.

Use az network public-ip show to obtain the IPv4 and IPv6 public IP addresses.

IPv4

az network public-ip show \
    --resource-group test-rg \
    --name public-ip-nat \
    --query ipAddress \
    --output tsv

azureuser@Azure:~$ az network public-ip show \
    --resource-group test-rg \
    --name public-ip-nat \
    --query ipAddress \
    --output tsv
203.0.113.5

IPv6

az network public-ip show \
    --resource-group test-rg \
    --name public-ip-ipv6 \
    --query ipAddress \
    --output tsv

azureuser@Azure:~$ az network public-ip show \
    --resource-group test-rg \
    --name public-ip-ipv6 \
    --query ipAddress \
    --output tsv
2001:DB8::14

1. Sign-in to the Azure portal.

2. In the search box at the top of the portal, enter Virtual machine. Select Virtual machines in the search results.

3. Select vm-1.

4. In the Overview of vm-1, select Connect then Bastion. Select Use Bastion

5. Enter the username and password you created when you created the virtual machine.

6. Select Connect.

7. At the command line, enter the following command to verify the IPv4 address.

   curl -4 icanhazip.com
   

   azureuser@vm-1:~$ curl -4 icanhazip.com
   203.0.113.5
   

8. At the command line, enter the following command to verify the IPv4 address.

   curl -6 icanhazip.com
   

   azureuser@vm-1:~$ curl -6 icanhazip.com
   2001:DB8::14
   

9. Close the bastion connection to vm-1.

1. Sign-in to the Azure portal.

2. In the search box at the top of the portal, enter Virtual machine. Select Virtual machines in the search results.

3. Select vm-1.

4. In the Overview of vm-1, select Connect then Bastion. Select Use Bastion

5. Enter the username and password you created when you created the virtual machine.

6. Select Connect.

7. At the command line, enter the following command to verify the IPv4 address.

   curl -4 icanhazip.com
   

   azureuser@vm-1:~$ curl -4 icanhazip.com
   203.0.113.5
   

8. At the command line, enter the following command to verify the IPv4 address.

   curl -6 icanhazip.com
   

   azureuser@vm-1:~$ curl -6 icanhazip.com
   2001:DB8::14
   

9. Close the bastion connection to vm-1.

1. In the Azure portal, search for and select Resource groups.

2. On the Resource groups page, select the test-rg resource group.

3. On the test-rg page, select Delete resource group.

4. Enter test-rg in Enter resource group name to confirm deletion and select Delete.

Use az group delete to delete the resource group and the resources it contains.

az group delete \
    --name test-rg