Troubleshoot no outbound connectivity from Standard internal load balancers

Summary

This article helps you troubleshoot scenarios where virtual machines (VMs) behind a Standard internal load balancer (ILB) can't reach the internet. Unlike Basic ILBs, Standard ILBs don't provide default outbound access, so VMs in the backend pool need an explicit outbound connectivity method, such as Azure NAT Gateway, a public IP address on the network interface, or outbound rules on a Standard public load balancer, to reach external endpoints.

Cause

Standard ILBs have default security features. Basic ILBs allow connecting to the internet through a hidden public IP address called the default outbound access IP. Don't use the default outbound access IP for production workloads, because the IP address isn't static or locked down through network security groups that you own. For more information, including which methods count as explicit outbound connectivity, see Default outbound access in Azure.

Solution

If you recently moved from a Basic ILB to a Standard ILB and need outbound connectivity to the internet from your VMs, configure an explicit outbound connectivity method on the subnet or VMs. Azure NAT Gateway is the Azure-recommended option for most production scenarios, because it avoids the SNAT port exhaustion limits of load balancer outbound rules. For step-by-step configuration, see Tutorial: Integrate a NAT gateway with an internal load balancer.

Alternatively, you can assign a public IP address directly to each VM's network interface, or place the VMs in the backend pool of a separate Standard public load balancer that has outbound rules configured. For the load balancer approach, see Outbound-only load balancer configuration.

To compare outbound options in more depth and diagnose SNAT port exhaustion, see Troubleshoot Azure Load Balancer outbound connectivity issues.