title: azurerm terraform scaleset with internal load balancer
body: <p>I have been looking for a proper way to terraform my internal vm scale set with a INTERNAL load balancer that is not exposed to internet with a public IP. however, the nodes should have access to internet to download some packages that are located in github.</p>
  <p>I am facing this issue where the load balancer is deployed as well as the scale set but, I do not have the internet outband connectivity from the nodes of the scale set...</p>
  <p>I read this post but it does not tell   <a href="https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections" rel="nofollow noreferrer">how to proceed</a></p>
  <p>From my understandings, I should have internet access from my nodes to download package cause I use a standard load balancer, but it does not work.</p>
  <p>I am missing something ? I would prefer avoid using a <a href="https://docs.microsoft.com/en-us/azure/virtual-network/nat-gateway-resource" rel="nofollow noreferrer">NAT Gateway</a>..</p>
  <p>Below is my full terraform script that create RG, Vnet SUbnets, LB rules and finally VMSS and a jumbpox.</p>
  <pre><code>        provider &quot;azurerm&quot; {       
                  
          features {}        
          subscription_id = var.azure-subscription-id       
              client_id       = var.azure-client-app-id       
              client_secret   = var.azure-client-secret-password       
              tenant_id       = var.azure-tenant-id   
              }
  
          resource &quot;azurerm_resource_group&quot; &quot;existing_terraform_rg&quot; {
          name                     = &quot;rg-ict-spoke1-001&quot;
          location                 = &quot;westeurope&quot;
          #depends_on = [var.rg_depends_on]
          }
          # Create storage account for boot diagnostics
          resource &quot;azurerm_storage_account&quot; &quot;mystorageaccount&quot; {
              name                        = &quot;diag${random_id.randomId.hex}&quot;
              resource_group_name         = azurerm_resource_group.existing_terraform_rg.name
              location                    = &quot;westeurope&quot;
              account_tier                = &quot;Standard&quot;
              account_replication_type    = &quot;LRS&quot;
          }
          resource &quot;azurerm_virtual_network&quot; &quot;existing_terraform_vnet&quot; {
              name                = &quot;vnet-spoke1-001&quot;
              location            = &quot;westeurope&quot;
              resource_group_name = azurerm_resource_group.existing_terraform_rg.name
              address_space       = [&quot;10.0.0.0/16&quot;]
              #depends_on = [azurerm_resource_group.existing_terraform_rg]
          }
          // Subnets
          # Create subnet
          resource &quot;azurerm_subnet&quot; &quot;spk1-jbx-subnet&quot; {
              name                 = &quot;spk1-jbx-subnet&quot;
              resource_group_name  = azurerm_resource_group.existing_terraform_rg.name
              virtual_network_name = azurerm_virtual_network.existing_terraform_vnet.name
              address_prefixes       = [&quot;10.0.0.0/24&quot;]
          }
  
          resource &quot;azurerm_subnet&quot; &quot;new_terraform_subnet_web&quot; {
          name                 = &quot;snet-webtier-${var.environment}-vdc-001&quot;
          resource_group_name  =  azurerm_resource_group.existing_terraform_rg.name
          virtual_network_name =  azurerm_virtual_network.existing_terraform_vnet.name
          address_prefix       = var.webtier_address_prefix
          depends_on = [azurerm_virtual_network.existing_terraform_vnet]
          }
  
          # Create Network Security Group and rule
          resource &quot;azurerm_network_security_group&quot; &quot;generic-nsg&quot; {
              name                = &quot;generic-nsg&quot;
              location            = &quot;westeurope&quot;
              resource_group_name = azurerm_resource_group.existing_terraform_rg.name
              
              security_rule {
                  name                       = &quot;GENERIC-RULE&quot;
                  priority                   = 1001
                  direction                  = &quot;Inbound&quot;
                  access                     = &quot;Allow&quot;
                  protocol                   = &quot;Tcp&quot;
                  source_port_range          = &quot;*&quot;
                  #destination_port_range     = &quot;3389&quot;
                  #destination_port_ranges     = &quot;[&quot;22&quot;,&quot;3389&quot;,&quot;80&quot;,&quot;8080&quot;]&quot; 
                  destination_port_ranges     = [&quot;22&quot;,&quot;3389&quot;,&quot;80&quot;,&quot;8080&quot;,&quot;443&quot;]
                  source_address_prefix      = &quot;*&quot;
                  destination_address_prefix = &quot;*&quot;
              }
          }
  
          # Connect the security group to the network interface
          resource &quot;azurerm_subnet_network_security_group_association&quot; &quot;new_terraform_subnet_web-asso-nsg&quot; {
          subnet_id                 = azurerm_subnet.new_terraform_subnet_web.id
          network_security_group_id = azurerm_network_security_group.generic-nsg.id
          }
  
  
          resource &quot;azurerm_subnet_network_security_group_association&quot; &quot;spk1-jbx-subnet-asso-nsg&quot; {
          subnet_id                 = azurerm_subnet.spk1-jbx-subnet.id
          network_security_group_id = azurerm_network_security_group.generic-nsg.id
          }
  
          # Generate random text for a unique storage account name
          resource &quot;random_id&quot; &quot;randomId&quot; {
              keepers = {
                  # Generate a new ID only when a new resource group is defined
                  resource_group = azurerm_resource_group.existing_terraform_rg.name
              }
              byte_length = 8
          }
  
  
  
  
  
  
  
  
  
          resource &quot;azurerm_lb&quot; &quot;new_terraform_lb_web&quot; {
          name                = &quot;lb-${var.web_lb_name}-${var.environment}-vdc-001&quot;
          location            =  azurerm_resource_group.existing_terraform_rg.location
          resource_group_name =  azurerm_resource_group.existing_terraform_rg.name
          sku = var.lb_Sku
          frontend_ip_configuration {
              name                 = &quot;PrivateIPAddress-${var.web_lb_name}&quot;
              subnet_id            = azurerm_subnet.new_terraform_subnet_web.id
              private_ip_address   = var.web_lb_private_IP
              private_ip_address_allocation = &quot;Static&quot;
          }
          }
          resource &quot;azurerm_lb_backend_address_pool&quot; &quot;new_terraform_bpepool_web&quot; {
          resource_group_name =  azurerm_resource_group.existing_terraform_rg.name
          loadbalancer_id     = azurerm_lb.new_terraform_lb_web.id
          name                = &quot;${var.web_lb_name}-BackEndAddressPool&quot;
          }
          resource &quot;azurerm_lb_probe&quot; &quot;new_terraform_lb_probe_web&quot; {
          resource_group_name =  azurerm_resource_group.existing_terraform_rg.name
          loadbalancer_id     = azurerm_lb.new_terraform_lb_web.id
          name                = &quot;${var.web_lb_name}-probe-${var.web_lb_probe_protocol}&quot;
          protocol            = var.web_lb_probe_protocol
          request_path        = var.web_lb_probe_request_path
          port                = var.web_lb_probe_port
          }
  
          resource &quot;azurerm_lb_rule&quot; &quot;new_terraform_bpepool_web_rule_http&quot; {
          resource_group_name            = azurerm_resource_group.existing_terraform_rg.name
          loadbalancer_id                = azurerm_lb.new_terraform_lb_web.id
          backend_address_pool_id        = azurerm_lb_backend_address_pool.new_terraform_bpepool_web.id
          probe_id                       = azurerm_lb_probe.new_terraform_lb_probe_web.id
          disable_outbound_snat          = true 
          name                           = &quot;new_terraform_bpepool_web_rule_http&quot;
          protocol                       = &quot;Tcp&quot;
          frontend_port                  = 80
          backend_port                   = 80
          frontend_ip_configuration_name = &quot;PrivateIPAddress-${var.web_lb_name}&quot;
          }
  
          resource &quot;azurerm_lb_rule&quot; &quot;new_terraform_bpepool_web_rule_https&quot; {
          resource_group_name            = azurerm_resource_group.existing_terraform_rg.name
          loadbalancer_id                = azurerm_lb.new_terraform_lb_web.id
          backend_address_pool_id        = azurerm_lb_backend_address_pool.new_terraform_bpepool_web.id
          probe_id                       = azurerm_lb_probe.new_terraform_lb_probe_web.id
          disable_outbound_snat          = true 
          name                           = &quot;new_terraform_bpepool_web_rule_https&quot;
          protocol                       = &quot;Tcp&quot;
          frontend_port                  = 443
          backend_port                   = 443
          frontend_ip_configuration_name = &quot;PrivateIPAddress-${var.web_lb_name}&quot;
          }
  
          resource &quot;azurerm_windows_virtual_machine_scale_set&quot; &quot;new_terraform_vmss_web&quot; {
          depends_on = [azurerm_lb_rule.new_terraform_bpepool_web_rule_http,azurerm_lb_rule.new_terraform_bpepool_web_rule_https]
          name                = &quot;vmss-001&quot;
          resource_group_name =  azurerm_resource_group.existing_terraform_rg.name
          location            =  azurerm_resource_group.existing_terraform_rg.location
          sku                 = var.webtier_vmss_sku
          instances           = var.webtier_vmss_instance_count
          admin_password      = var.webtier_vmss_admin_password
          admin_username      = var.webtier_vmss_admin_uname
          zone_balance = true
          zones = [1,2,3]
          upgrade_mode = &quot;Manual&quot;
              #automatic_os_upgrade_policy {
              #    disable_automatic_rollback  = false
              #    enable_automatic_os_upgrade = true
              #}
              #rolling_upgrade_policy {
              #  max_batch_instance_percent              = 20
              #  max_unhealthy_instance_percent          = 20
              #  max_unhealthy_upgraded_instance_percent = 5
              #  pause_time_between_batches              = &quot;PT0S&quot;
              #}    
          #health_probe_id = azurerm_lb_probe.new_terraform_lb_probe_web.id
  
          source_image_reference {
              publisher = &quot;MicrosoftWindowsServer&quot;
              offer     = &quot;WindowsServer&quot;
              sku       = var.webtier_vmss_image_sku
              version   = &quot;latest&quot;
          }
  
          os_disk {
              storage_account_type = &quot;Standard_LRS&quot;
              caching              = &quot;ReadWrite&quot;
          }
  
          network_interface {
              name    = &quot;vmss-001-nic-1&quot;
              primary = true
              ip_configuration {
              name      = &quot;vmss-001-nic-1-Configuration&quot;
              primary   = true
              subnet_id = azurerm_subnet.new_terraform_subnet_web.id
              load_balancer_backend_address_pool_ids = [azurerm_lb_backend_address_pool.new_terraform_bpepool_web.id]
              #load_balancer_inbound_nat_rules_ids    = [azurerm_lb_nat_pool.lbnatpool-1.id]
              }
          }
          }
  
          resource &quot;azurerm_virtual_machine_scale_set_extension&quot; &quot;new_terraform_vmss_web_ext_1&quot; {
          name                         = &quot;new_terraform_vmss_web_ext_1&quot;
          virtual_machine_scale_set_id = azurerm_windows_virtual_machine_scale_set.new_terraform_vmss_web.id
              publisher = &quot;Microsoft.Compute&quot;
              type = &quot;CustomScriptExtension&quot;
              type_handler_version = &quot;1.9&quot;
              settings = &lt;&lt;SETTINGS
                  {
                      &quot;fileUris&quot;: [&quot;https://raw.githubusercontent.com/Azure-Samples/compute-automation-configurations/master/automate-iis-v2.ps1&quot;]
                  }
                      SETTINGS
              protected_settings = &lt;&lt;PROTECTED_SETTINGS
                  { 
                      &quot;commandToExecute&quot;: &quot;powershell -ExecutionPolicy Unrestricted -File automate-iis-v2.ps1&quot;
                  }
                      PROTECTED_SETTINGS
          }
  
  
  
  
      # Create public IPs
      resource &quot;azurerm_public_ip&quot; &quot;spk1-jbx-puip&quot; {
          name                         = &quot;spk1-jbx-puip&quot;
          location                     = &quot;westeurope&quot;
          resource_group_name          = azurerm_resource_group.existing_terraform_rg.name
          allocation_method            = &quot;Dynamic&quot;
      }
  
  
  
      # Create network interface
      resource &quot;azurerm_network_interface&quot; &quot;spk1-jbx-nic&quot; {
          name                      = &quot;spk1-jbx-nic&quot;
          location                  = &quot;westeurope&quot;
          resource_group_name       = azurerm_resource_group.existing_terraform_rg.name
          ip_configuration {
              name                          = &quot;spk1-jbx-nic-conf&quot;
              subnet_id                     = azurerm_subnet.spk1-jbx-subnet.id
              private_ip_address_allocation = &quot;Dynamic&quot;
              public_ip_address_id          = azurerm_public_ip.spk1-jbx-puip.id
          }
      }
  
      resource &quot;azurerm_virtual_machine&quot; &quot;spk1-jbx-vm&quot; {
      name                  = &quot;spk1-jbx-vm&quot;
      location              = &quot;westeurope&quot; 
      resource_group_name   = azurerm_resource_group.existing_terraform_rg.name
      network_interface_ids = [&quot;${azurerm_network_interface.spk1-jbx-nic.id}&quot;]
      vm_size               = &quot;Standard_D2s_v3&quot;
      storage_image_reference {
          publisher = &quot;MicrosoftWindowsServer&quot;
          offer     = &quot;WindowsServer&quot;
          sku       =  &quot;2016-Datacenter&quot;
          version   = &quot;latest&quot;
      }
  
      storage_os_disk {
          name              = &quot;spk1-jbx-vm-mtwin-disk-os&quot;
          caching           = &quot;ReadWrite&quot;
          create_option     = &quot;FromImage&quot;
          managed_disk_type = &quot;Standard_LRS&quot;
      }
      os_profile {
          computer_name  = &quot;spk1-jbx-vm&quot;
          admin_username = &quot;demouser&quot;
          admin_password = &quot;M0nP@ssw0rd!&quot; 
      }
      os_profile_windows_config {
          provision_vm_agent = true
      }
  
      }
  </code></pre>