[Azure] Server Load balancer sets outbound rules

Recently, when using Microsoft cloud, we found that azure launched the standard version of Server Load balancer, which should be good news for many users with high security requirements, you can configure SNAT.

With azure Server Load balancer, you can:

• Load Balancing the Internet traffic passed into the VM. This configuration is called a public Load balancer.
• Load Balancing traffic between VMS in a virtual network. You can also access the server Load balancer frontend from the local network in the hybrid solution. Both solutions use configurations called Internal Server Load balancer.
• Use the inbound network address translation (NAT) rule to forward traffic to a specific port on a specific VM through port forwarding.
• Use a public Load balancer to provide an outbound connection to the VM in the virtual network.

Currently, Microsoft SLB provides two editions: Basic edition and Standard Edition. For more information about the functions, see the following.

Https://docs.microsoft.com/zh-cn/azure/load-balancer/load-balancer-overview

This section focuses on the following two topics:

	Standard Edition	Basic Edition
Outbound rules	Declarative outbound Nat configurations, including public IP addresses or public IP prefixes, outbound idle timeout, and custom SNAT port allocation	Unavailable

The IP address to be configured for azure Server Load balancer is VIP, and azure preallocates 160 source ports for Virtual Machine connections in VIP.

The figure above shows that if you do not want to provide an accessible IP address for the backend Virtual Machine for security reasons (if you add an IP address, all outbound traffic will be routed through this IP address. By default, we can only have 160 ports at the same time for connecting to the outbound traffic.

In the new Standard Server Load balancer, you can set outbound rules. Currently, you can only use CLI or powershell.

Run the following command

Create a Server Load balancer outbound rule.

AZ network LB outbound-Rule create-G sslbgroup -- LB-name sslb-N outboundrule -- frontend-IP-configs loadbalancerfrontend -- protocol all -- idle-time 4 -- outbound-ports 1000 -- Address -Pool sslbbackup

In this way, you can set the number of outbound ports to provide sufficient outbound connection ports for the virtual machines behind SLB.

[Azure] Server Load balancer sets outbound rules