We have created a new Windows server 2022 VM. PORT 80 is not accessable from public network

Question

We have created a new Windows server 2022 VM. PORT 80 is not accessable from public network

Answer 1

Dear @ENHANCE Oman

For Azure Windows Server 2022 virtual machine, TCP port 80 is not accessible from the public network by default. Please verify the following configuration:

• Ensure that the virtual machine has a Public IP address assigned and that it is correctly associated with the VM's network interface.
• Verify the Network Security Group (NSG) configuration. An inbound rule allowing TCP port 80 from the required source (or Any for testing purposes) must be present.
• If NSGs are associated with both the subnet and the network interface (NIC), confirm that inbound TCP port 80 is permitted in both, as Azure evaluates both rule sets.
• Use Azure Network Watcher / Connection Troubleshoot to identify whether traffic is being blocked by an NSG, user-defined route, or another networking component.
• Verify that the Windows Defender Firewall allows inbound connections on TCP port 80.

Answer 2

For a new Azure Windows Server 2022 VM, port 80 is not open by default. Only RDP is opened by default when the VM is created.

Use this troubleshooting path:

1. Check the VM network security group (NSG)
   • In Azure, create an inbound allow rule for TCP port 80.
   • The documented rule values are:
     • Source: Any
     • Source port ranges: Any
     • Destination: the VM private IP, a range of IPs, or all addresses in the subnet
     • Destination port ranges: 80
     • Protocol: TCP
     • Action: Allow
     • Priority: 100
     • Name: Allow-HTTP-All
2. Check both subnet and NIC NSGs
   • If an NSG is associated with both the subnet and the network interface, port 80 must be allowed in both NSGs.
   • Azure processes the subnet NSG first, then the NIC NSG.
3. Use VM Network Troubleshooter
   • In the Azure portal, open the VM and go to the Monitor tab on the VM Overview blade.
   • Start VM network troubleshooter to test whether port 80 is blocked.
   • It checks ports 80, 443, and 3389 and shows which security rule allows or denies the traffic.
4. If the VM was created with Azure CLI
   • Port 80 can be opened with:

az vm open-port --port 80 --resource-group <resource-group> --name <vm-name>

5. Verify the web service is actually listening on port 80
   • If no web server is running on the VM, opening the NSG alone will not make port 80 respond.
   • In the Windows VM quickstart, IIS is installed before opening port 80.

After the allow rule is created with a higher priority than the default DenyAllInBound rule, inbound HTTP traffic on port 80 is allowed from the internet.

---

References:

• Quickstart: Create a Windows virtual machine with the Azure CLI
• Diagnose a virtual machine network traffic filter problem
• VM network troubleshooter (Preview) overview