Skip to content

tutorial-nat-gateway-load-balancer-internal-portal.md

Latest commit

 

History

History
227 lines (147 loc) · 8.46 KB

tutorial-nat-gateway-load-balancer-internal-portal.md

File metadata and controls

227 lines (147 loc) · 8.46 KB
title Tutorial: Integrate NAT gateway with an internal load balancer - Azure portal
titleSuffix Azure NAT Gateway
description In this tutorial, learn how to integrate a NAT gateway with an internal load Balancer using the Azure portal.
author asudbring
ms.author allensu
ms.service azure-nat-gateway
ms.topic tutorial
ms.date 09/11/2025
ms.custom template-tutorial, linux-related-content

Tutorial: Integrate a NAT gateway with an internal load balancer using the Azure portal

In this tutorial, you learn how to integrate a NAT gateway with an internal load balancer.

By default, an Azure Standard Load Balancer is secure. Outbound connectivity is explicitly defined by enabling outbound SNAT (Source Network Address Translation).

SNAT is enabled for an internal backend pool via another public load balancer, network routing, or a public IP defined on a virtual machine.

The NAT gateway integration replaces the need for the deployment of a public load balancer, network routing, or a public IP defined on a virtual machine in the backend pool.

:::image type="content" source="./media/tutorial-nat-gateway-load-balancer-internal-portal/resources-diagram.png" alt-text="Diagram of Azure resources created in tutorial." lightbox="./media/tutorial-nat-gateway-load-balancer-internal-portal/resources-diagram.png":::

In this tutorial, you learn how to:

[!div class="checklist"]

  • Create an Azure Load Balancer
  • Create two virtual machines for the backend pool of the Azure Load Balancer
  • Create a NAT gateway
  • Validate outbound connectivity of the virtual machines in the load balancer backend pool

Prerequisites

An Azure account with an active subscription. Create an account for free.

Create a resource group

Create a resource group to contain all resources for this quickstart.

  1. Sign in to the Azure portal.

  2. In the search box at the top of the portal enter Resource group. Select Resource groups in the search results.

  3. Select + Create.

  4. In the Basics tab of Create a resource group, enter, or select the following information.

    Setting Value
    Subscription Select your subscription
    Resource group test-rg
    Region East US 2

  5. Select Review + create.

  6. Select Create.

Create the virtual network

  1. In the search box at the top of the Azure portal, enter Virtual network. Select Virtual networks in the search results.

  2. Select Create.

  3. Enter or select the following information in the Basics tab of Create virtual network.

    Setting Value
    Project details
    Subscription Select your subscription.
    Resource group Select test-rg or your resource group.
    Instance details
    Name Enter vnet-1.
    Region Select your region. This example uses East US 2.

  4. Select the IP Addresses tab, or select Next: Security, then Next: IP Addresses.

  5. In Subnets select the default subnet.

  6. Enter or select the following information in Edit subnet.

    Setting Value
    Subnet purpose Leave the default.
    Name Enter subnet-1.

  7. Leave the rest of the settings as default, then select Save.

  8. Select + Add a subnet.

  9. In Add a subnet enter or select the following information.

    Setting Value
    Subnet purpose Select Azure Bastion.

  10. Leave the rest of the settings as default, then select Add.

  11. Select Review + create, then select Create.

Create Azure Bastion host

Create an Azure Bastion host to securely connect to the virtual machine.

  1. In the search box at the top of the Azure portal, enter Bastion. Select Bastions in the search results.

  2. Select Create.

  3. Enter or select the following information in the Basics tab of Create a Bastion.

    Setting Value
    Project details
    Subscription Select your subscription.
    Resource group Select test-rg or your resource group.
    Instance details
    Name Enter bastion.
    Region Select your region. This example uses East US 2.
    Tier Select Developer.
    Virtual network Select vnet-1.
    Subnet Select AzureBastionSubnet.

  4. Select Review + create, then select Create.

Create a NAT gateway

  1. In the search box at the top of the Azure portal, enter Public IP address. Select Public IP addresses in the search results.

  2. Select Create.

  3. Enter the following information in Create public IP address.

    Setting Value
    Subscription Select your subscription.
    Resource group Select your resource group. The example uses test-rg.
    Region Select a region. This example uses East US 2.
    Name Enter public-ip-nat.
    IP version Select IPv4.
    SKU Select Standard.
    Availability zone Select Zone-redundant.
    Tier Select Regional.

  4. Select Review + create and then select Create.

  5. In the search box at the top of the Azure portal, enter NAT gateway. Select NAT gateways in the search results.

  6. Select Create.

  7. Enter or select the following information in the Basics tab of Create network address translation (NAT) gateway.

    Setting Value
    Project details
    Subscription Select your subscription.
    Resource group Select test-rg or your resource group.
    Instance details
    NAT gateway name Enter nat-gateway.
    Region Select your region. This example uses East US 2.
    SKU Select Standard.
    TCP idle timeout (minutes) Leave the default of 4.

  8. Select Next.

  9. In the Outbound IP tab, select + Add public IP addresses or prefixes.

  10. In Add public IP addresses or prefixes, select Public IP addresses. Select the public IP address you created earlier, public-ip-nat.

  11. Select Next.

  12. In the Networking tab, in Virtual network, select vnet-1.

  13. Leave the checkbox for Default to all subnets unchecked.

  14. In Select specific subnets, select subnet-1.

  15. Select Review + create, then select Create.

[!INCLUDE load-balancer-internal-create-http.md]

[!INCLUDE create-two-virtual-machines-linux-load-balancer.md]

Test NAT gateway

In this section, you test the NAT gateway. You first discover the public IP of the NAT gateway. You then connect to the test virtual machine and verify the outbound connection through the NAT gateway.

  1. In the search box at the top of the portal, enter Public IP. Select Public IP addresses in the search results.

  2. Select public-ip-nat.

  3. Make note of the public IP address.

    :::image type="content" source="./media/quickstart-create-nat-gateway-portal/find-public-ip.png" alt-text="Screenshot of public IP address of NAT gateway." border="true":::

  4. In the search box at the top of the portal, enter Virtual machine. Select Virtual machines in the search results.

  5. Select vm-1.

  6. On the Overview page, select Connect, then select the Bastion tab.

  7. Select Use Bastion.

  8. Enter the username and password entered during virtual machine creation. Select Connect.

  9. In the bash prompt, enter the following command.

    curl ifconfig.me

  10. Verify the IP address returned by the command matches the public IP address of the NAT gateway.

    azureuser@vm-1:~$ curl ifconfig.me
203.0.113.0.25

  11. Close the bastion connection to vm-1.

[!INCLUDE portal-clean-up.md]

Next steps

For more information on Azure NAT Gateway, see:

[!div class="nextstepaction"] Azure NAT Gateway overview