NSG for subnet/NIC not working properly

Question

I got a VM sitting in a subnet associated with a NSG that allows traffic on port 22 to that machine from any source, but can't connect to it, something is stopping the traffic. Diagnostic tool says that it's the DenyAllInbound default rule, but this make no sense since my NSG has an explicit rule to allow 22. No firewall deployed in that vnet. Can you advise what can be wrong? Tried with both manually adding the rule as well as the automatically added one druing VM creation. Also tried associating the NSG directly with VM's NIC instead of subnet.
I can ssh to that machine using private IP from another one in the subnet so the ssh on vm works fine, also it's a generic ubuntu deployed from azure image, nothing changed in config, it has to be some azure networking shenanigans.

//edit added screenshot from troubleshooting tool

Answer 1

Hi, The destination IP needs to be the private IP of the VM not the public IP. When you apply NSG rule to the Inbound rules , the destination always needs to be the Private IP not the public IP.