Load Balancer Rules

Azure Load Balancer rules define how network traffic is routed to and from your resources. This article explains the core rule types used by Azure Load Balancer—how they work, when to use them, and how they interact with frontend IPs, backend pools, and health probes to provide predictable, secure traffic flow.

Overview

An Azure Load Balancer typically includes:

One or more frontend IP configurations (public or private addresses clients connect to).
A backend pool of virtual machines or instances that receive traffic.
Health probes that verify backend instance health.
Rules that map frontend traffic to backend pool instances and control inbound/outbound behavior.

The three main rule types:

Load-balancing rules — distribute incoming client traffic to backends.
Inbound NAT rules — forward specific frontend ports to a particular VM/port.
Outbound rules — control SNAT/egress behavior for backend instances.

Each rule type serves a distinct purpose; used together they provide a complete traffic management model.

Quick comparison

Rule type	Purpose	Key properties	Typical use case
Load-balancing rule	Distribute incoming traffic across backend instances	Frontend IP/port, backend port, protocol, health probe, session persistence, idle timeout	Web servers, application tiers
Inbound NAT rule	Forward a specific frontend port to a single VM/port	Frontend port, target VM NIC and port	RDP/SSH access to specific VMs behind an LB
Outbound rule	Define SNAT behavior for outbound connections from backend VMs	Frontend IP association, SNAT port allocation, idle timeout	Providing predictable outbound IPs and preventing port exhaustion

Load-balancing rules

Load-balancing rules (LB rules) are the primary mechanism for distributing incoming traffic across the backend pool. Key behavior:

An LB rule maps a frontend IP and frontend port to a backend port and backend pool.
The rule references a health probe so only healthy instances receive traffic.
It controls protocol (TCP/UDP), session persistence (affinity), and idle timeout settings.
When clients connect to the frontend IP and port, the load balancer distributes those connections across healthy backend instances according to the configured distribution algorithm.

Example flow:

Clients connect to the frontend IP on port 80.
The LB rule forwards requests to backend pool instances on port 80.
Health probes (HTTP/TCP) verify backend health; only healthy servers receive traffic.

Example Azure CLI to create a basic LB rule:

az network lb rule create \
  --resource-group `myResourceGroup` \
  --lb-name `myLoadBalancer` \
  --name `httpRule` \
  --protocol `Tcp` \
  --frontend-port 80 \
  --backend-port 80 \
  --frontend-ip-name `LoadBalancerFrontEnd` \
  --backend-pool-name `BackEndPool` \
  --probe-name `httpProbe`

Inbound NAT rules

Inbound NAT (Network Address Translation) rules forward traffic arriving at the load balancer to a specific port on a specific VM in the backend pool. These are commonly used to provide administrative access to individual VMs behind the load balancer. Mapping example:

FrontendPort 30008  -> VM1:3389
FrontendPort 30009  -> VM2:3389
FrontendPort 30010  -> VM3:3389

Notes:

Connecting to the load balancer’s frontend IP at 30008 forwards the connection to port 3389 on VM1.
Common administrative uses: RDP (3389) or SSH (22) multiplexed across a single public IP with different frontend ports.
Inbound NAT rules target a specific VM NIC and port and do not load-balance across multiple VMs.
To forward ports to many VMs, create multiple NAT rules, each mapping a different frontend port to a different backend VM/port.

Example Azure CLI to create an inbound NAT rule:

az network lb inbound-nat-rule create \
  --resource-group `myResourceGroup` \
  --lb-name `myLoadBalancer` \
  --name `rdpVM1` \
  --protocol `Tcp` \
  --frontend-port 30008 \
  --backend-port 3389 \
  --frontend-ip-name `LoadBalancerFrontEnd`

Outbound rules

Outbound rules control how traffic initiated from backend pool instances reaches external destinations (for example, the internet). They define SNAT behavior and can provide consistent outbound IP addresses. Key points:

Use outbound rules when VMs/instances need to initiate connections to external endpoints.
Outbound rules allocate ephemeral (SNAT) ports and can be associated with a specific frontend IP configuration (public IP or public IP prefix) to provide predictable outbound IPs.
Behavior differs by SKU: the Basic Load Balancer provides platform-managed outbound connectivity for VMs without public IPs by default; the Standard Load Balancer does not. For predictable outbound behavior on Standard, configure an outbound rule, attach a public IP to the VM, or use a managed NAT gateway.

Common scenarios:

Ensuring a known public IP for outbound calls to external services.
Controlling the number of ephemeral ports to avoid port exhaustion under high concurrency.

Example Azure CLI to create an outbound rule:

az network lb outbound-rule create \
  --resource-group `myResourceGroup` \
  --lb-name `myLoadBalancer` \
  --name `outboundRule` \
  --frontend-ip-configs `LoadBalancerFrontEnd` \
  --protocol `Tcp` \
  --idle-timeout 15 \
  --enable-tcp-reset true \
  --backend-pool-name `BackEndPool`

Important: With the Standard SKU, Azure does not provide default outbound connectivity for backend VMs that lack a public IP. Configure an outbound rule, assign a public IP to the VM, or use a NAT gateway for predictable outbound behavior and to avoid connectivity surprises.

Session persistence (session affinity) is configured on load-balancing rules. Options include None, Client IP, and Client IP and protocol. Choosing a persistence type determines whether successive requests from the same client are sent to the same backend instance—important for stateful applications or sticky sessions.

Putting it all together

Load-balancing rules distribute client traffic across backend instances and use health probes to ensure only healthy instances receive traffic.
Inbound NAT rules provide direct, port-mapped access to individual VMs for administration or special endpoints.
Outbound rules govern how backend instances initiate traffic to external networks and provide predictable SNAT behavior.

When designing your load-balancer configuration, consider:

Which services need balanced frontend access vs. direct VM access.
Session persistence requirements for application state.
Outbound IP predictability and ephemeral port capacity to prevent port exhaustion.
The Load Balancer SKU you choose (Basic vs. Standard) and its implications for default outbound connectivity.

Introduction

Administer Identity

Administer Governance and Compliance

Administer Azure Resources

Administer Virtual Networking

Administer Intersite Connectivity

Administer Network Traffic

Administer Azure Storage

Administer Azure Virtual Machines

Administer PaaS Compute Options

Administer Data Protection

Administer Monitoring

Load Balancer Rules

Overview

Quick comparison

Load-balancing rules

Inbound NAT rules

Outbound rules

Putting it all together

Links and references

Watch Video

​Overview

​Quick comparison

​Load-balancing rules

​Inbound NAT rules

​Outbound rules

​Putting it all together

​Links and references

Watch Video

Overview

Quick comparison

Load-balancing rules

Inbound NAT rules

Outbound rules

Putting it all together

Links and references