Does NSG apply to load balancer frontend IP?

Question

I have a vnet with two subnets named sn1 and sn2. I have two vms named vm1 and vm2. vm1 is in sn1, vm2 is in sn2. I have a load balancer whose backends are vm1 and vm2. There is only one frontend IP in the load balancer in sn1.

When I associate a network security group with sn1 that has rules to block all network traffic, vm1 will be unavailable, which is expected. However, the frontend IP of the load balancer still works, despite it is in sn1.

I would like to know the reason of above behavior. Is the reason that network security group does not apply to load balancer frontend IP?

Answer 1

Hello Qiu, Horus,Thanks for your question.

This is expected. NSGs in Azure do not apply to the load balancer frontend IP address.NSG can be associated with either subnets or individual VM instances within that subnet, so we can’t use NSG to block inbound IP address from the internet.See:

How network security groups filter network traffic

Please let me know if you have further questions.

You can mark it 'Accept Answer' if this helped you