Restrict user to only access cross regional load balancer IP and not child regional load balancer IPs

Question

I have a cross regional LB in West US region and 2 regional LBs having virtual networks in East US and North Europe Regions. But I want to let internet user to use only cross regional LB's IP and not regional LB's IPs i.e. he should not be able to access regional LB VM's IP address and should only access cross-regional LB's VM's IP. How to do that?

Answer 1

@19015919-007

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to know if we can block access to the Regional Load Balancer's IP.

Please let me know if my understanding is incorrect, as I see you have mentioned you want to restrict access to regional LB VM's IP

Currently, it is not possible to apply NSGs to a public IP associated to a Load Balancer.

Hence, I am afraid your requirement will not be feasible.

However, you can consider the below environment to achieve this.

• Use Azure Front Door + Internal Load Balancer.
• Refer : Connect Azure Front Door Premium to an internal load balancer origin with Private Link

Kindly let us know if the above helps or you need further assistance on this issue.

Thanks,

Kapil

---

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Answer 2

Hi,

Azure Load balancer is a layer 4 load balancer and currently it just does the load balancing by forwarding packets to the destination. I get your ask, but this is not supported as of today. This cannot be restricted using NSG as well. You can restrict this from source, but this is something which cannot be controlled as there might be multiple clients from different geographical location accessing the LB's IP.

I would suggest you to raise a feature ask for Azure Load Balancer .

As a work around, if you can use Traffic Manager and set Priority rules configured to load balancer between 2 LBs. But again, users can still bypass by directly accessing the LB's IP.

If your application is a Web server, we have other products which can help you to achieve this.

Regards,

Karthik Srinivas