Should we delete the public IPs from VM in the backend pool of an internal LB

David Kim 66 Reputation points
2023-04-01T20:00:26.6533333+00:00

Should we delete the public IPs from VMs in the backend pool of an internal LB?

Azure Load Balancer
Azure Load Balancer
An Azure service that delivers high availability and network performance to applications.
404 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. GitaraniSharma-MSFT 47,696 Reputation points Microsoft Employee
    2023-04-02T07:55:19.43+00:00

    Hello @David Kim ,

    Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

    I understand that you would like to know if you should delete the public IPs from VMs in the backend pool of an internal LB.

    Let us first understand what an Internal load balancer is.

    A load balancer with a Private IP address selection creates an internal load balancer. An internal load balancer distributes traffic to resources that are inside a virtual network. Azure restricts access to the frontend IP addresses of a virtual network that are load balanced. Front-end IP addresses and virtual networks are never directly exposed to an internet endpoint, meaning an internal load balancer cannot accept incoming traffic from the internet. Internal line-of-business applications run in Azure and are accessed from within Azure or from on-premises resources.

    Refer: https://learn.microsoft.com/en-us/azure/load-balancer/components#frontend-ip-configuration-

    Since an internal load balancer is used to make sure that the backend virtual networks/VMs are never directly exposed to an internet endpoint, the Public IPs on the VMs defeats this purpose. As the Public IPs on the VMs exposes the VMs to the Internet.

    Now, let us consider why you would need to keep Public IPs on the VMs. Public IPs on the VMs are generally used for both inbound and outbound connectivity. But if you are using an internal load balancer in front of them, then I assume, you do not want direct inbound connectivity to the VMs from the Internet. But you may still have a requirement where the VMs require outbound Internet connectivity.

    Outbound connectivity for a VM without a Public IP is provided by the default outbound access IP. This IP is a dynamic IP assigned by Azure that you can't control. It also allocates a minimal number of ports for outbound connections. But this only works for Basic load balancers. Standard ILBs are secure by default and do not allow default outbound connectivity.

    Refer: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections#4-default-outbound-access

    https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-troubleshoot#no-outbound-connectivity-from-standard-internal-load-balancers-ilb

    In such a case, you may want to add Public IPs to the VMs for a dedicated Public IP which you can control for outbound connections.

    However, using a NAT gateway is the best method for outbound connectivity.

    NOTE: Basic load balancers and basic public IP addresses aren't compatible with NAT. Use standard SKU load balancers and public IPs instead.

    Depending upon your requirement, you may delete or keep the Public IPs associated to the VMs in the backend pool of your Internal load balancer.

    So, you have 2 options here:

    1. If your backend VMs do not require dedicated outbound connectivity, then you can disassociate and delete the Public IPs from the VMs.
    2. If your backend VMs requires dedicated outbound connectivity, then you can either keep the Public IPs on the VMs and restrict inbound connectivity from Internet via NSGs (OR) remove the Public IPs from the VM and create a NAT gateway and assign it to the subnet of your virtual network for outbound connectivity.

    Virtual Network NAT simplifies outbound Internet connectivity for virtual networks. When configured on a subnet, all outbound connectivity uses the Virtual Network NAT's static public IP addresses.

    NAT gateway allows flows to be created from the virtual network to the services outside your virtual network. Return traffic from the internet is only allowed in response to an active flow. Services outside your virtual network can’t initiate an inbound connection through NAT gateway.

    Refer: https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-overview

    You can integrate your internal load balancer with a NAT gateway if you are using a Standard SKU Azure Load Balancer.

    Refer: https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/tutorial-nat-gateway-load-balancer-internal-portal

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    0 comments
  2. msrini-MSFT 9,261 Reputation points Microsoft Employee
    2023-04-03T06:31:57.8166667+00:00

    Sure, you can certainly delete the public IP from the backend pool VMs. Since it's internal load balancer, in case if you want to ssh or RDP to the backend pool VMs over public internet, you can create a Standard public Load balancer and then create nat rule to connect to the backend pool VMs. Or you can use Bastion to ssh or RDP.

    0 comments