title: Configuring Azure load balancer and NAT rules
body: <p>I'm trying to build a simple two-tier wordpress environment on CentOS 7.2 in Azure.</p>
  
  <p>I've defined a virtual network, have connected it to my home-lab via IPsec VPN, and I've defined several subnets in Azure (for Web tier, SQL tier, and utility tier role segregation using Network Security Groups).</p>
  
  <p>I have two web-tier VMs, both members of the same Availability Set, and are both on the web-tier subnet. They have internet access (outbound), I can SSH to them from my home-lab, and the seem fine operationally to me - httpd is listening on 80/tcp, and I can hit the web pages from my home-lab network by visiting each web server directly on its 192.168.x address. </p>
  
  <p>I should mention my web servers DO NOT have public IPs assigned, but I can't see this being an issue.. they're intended to be behind the load balancer.</p>
  
  <p>So, I've created a Load Balancer, and:</p>
  
  <ul>
  <li>assigned a public IP to the LB</li>
  <li>added a backend pool (selected my availability set, and chose my two web servers)</li>
  <li>added a probe (http probing the two web servers)</li>
  <li>added a load balancer rule</li>
  </ul>
  
  <p>Notice I did NOT add an inbound NAT rule. I can't figure out what that's for, or if I need it.</p>
  
  <p>On my web tier, I tcpdump port 80 and see the probes. In httpd logs, I see 200 success messages for the probes.  I go to a web browser, hit the external VIP I assigned to the LB, and nothing. It just times out.  I cannot connect to the LB VIP.</p>
  
  <p>What am I missing? What are the NAT rules about? </p>
  
  <p>Any help would be appreciated. All I can find online are examples doing this in powershell etc.. and I'm using the Azure web interface.</p>
  
  <p>Thanks!</p>
  
  <p>Edit: Found the issue - Needed the NSG to allow not just the AzureLoadBalancer, but "Internet" to hit port 80/tcp.  Should have thought of that sooner.. </p>