title: How configure Azure Application Gateway to allow connecting to a Container Instance
body: <p>I have a private network (<code>10.0.0.0/16</code>) which has multiple subnets. I have an Application Gateway configured in the <code>10.0.0.0/24</code> subnet and I would like to expose Container Instances from the <code>10.0.2.0/24</code> subnet to the internet via HTTP. </p>
  
  <p>The gateway has only one HTTP rule simply mapping 80:80 from the internet to the backend pool. In the "Backend Health" section the status of my container (added via IP address) is unknown and the following error is displayed:</p>
  
  <blockquote>
    <p>Unable to retrieve health status data. Check presence of NSG/UDR blocking access to ports 65503-65534 from Internet to Application Gateway. </p>
  </blockquote>
  
  <p>Initially I had no NSG set but after setting one (and even allowing any:any) is not solving the status check problem. </p>
  
  <p>When opening the url in the browser I get an 502 Bad Gateway error. </p>
  
  <p>Note: I have added a container isntance which is not part of the VNet to the Application Gateway and despite also showing unknonw status in the Backend Pool the requests actually got redirected to the container, so I am almost certain I am misconfiguring someting in the VNet. </p>
  
  <p>Note2: I have pushed a test container and the test container can reach the container I am trying to expose in the same subnet, so something goes wrong between the container and the application gateway.</p>
  
  <p>My questions is what NSG rules I have to set to </p>
  
  <ol>
  <li>make the container visible to the health check</li>
  <li>make the redirect work between the Application Gateway and the Container</li>
  </ol>