--- cuppy_hub: azure cuppy_path: reference/networking/outbound-connectivity.md cuppy_section: docs cuppy_doc: EY9K-YMKN cuppy_doc_uuid: f29d6fb7-5ae2-4ed1-b650-c5866eb398f1 cuppy_permalink: https://cuppy.io/azure/d/EY9K-YMKN cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/reference/networking/outbound-connectivity cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: d3ec42a8ae743336d63ded1060d20d0a3dc265568ec3a713844bb6620961976b # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Outbound connectivity **Every subnet that needs the internet should have an explicit egress method.** Implicit "default outbound access" is going away: subnets in new VNets created with network API versions released after March 31, 2026 are private (`defaultOutboundAccess: false`), and even where it still works its IP is Microsoft's, can change, and doesn't support fragmented packets or ICMP. ## The methods | Method | When | Notes | |---|---|---| | **NAT gateway** on the subnet | The default choice for VMs, scale sets, and VNet-integrated apps | Takes precedence over load balancer outbound rules and instance public IPs for that subnet's outbound flows. Gives stable, allow-listable addresses | | Standard load balancer **outbound rules** | VMs already behind a public Standard load balancer | You assign SNAT ports per instance (`allocatedOutboundPorts`: a multiple of 8, at most 64,000 per rule) | | Public IP on the VM's NIC | One VM that also needs inbound | Doesn't scale; each IP is exposed | | Route `0.0.0.0/0` to Azure Firewall or an NVA | Central inspection | The firewall then needs its own egress: its public IPs, or (Microsoft's hub-spoke tutorial) a NAT gateway on `AzureFirewallSubnet` | ## NAT gateway SKUs | | Standard | StandardV2 | |---|---|---| | Zones | Zonal (one zone, or no zone) | **Zone-redundant** | | Public IPs | Standard public IPs | **StandardV2** public IPs or prefixes only | | Throughput per gateway | up to 50 Gbps | up to 100 Gbps | | IPv6, flow logs, NAT64 | No | Yes (NAT64 needs a third-party DNS64) | | Upgrade path | — | None: create a StandardV2 gateway and swap it onto the subnet | Not all regions offer StandardV2; check before templating it. Neither SKU works with **Basic** public IPs or a **Basic** load balancer, both of which **retired on September 30, 2025**. A known issue: IPv6 egress through load balancer outbound rules breaks when a StandardV2 NAT gateway is attached to the subnet. ## SNAT ports and timeouts - **Each NAT gateway public IP provides 64,512 SNAT ports**; a gateway scales past a million with more IPs. TCP and UDP have separate inventories. - **TCP idle timeout: 4 minutes by default, configurable to 120**; UDP is fixed at 4 minutes. Idle connections hold their port until the timeout, and a connection idle past it is dropped **silently**: use keepalives for long-lived connections rather than raising the timeout. - **SNAT exhaustion** shows as intermittent connection timeouts or failures to the same destination under load, often from code that opens a new connection per request. Fix in this order: reuse connections (one HTTP client or SDK client per process, connection pooling), add a NAT gateway or more public IPs, then raise ports per instance on load balancer outbound rules. Metrics: NAT gateway **SNAT Connection Count** and **Dropped Packets**; load balancer **Used SNAT Ports** against **Allocated SNAT Ports**. ## Choosing an address to allow-list elsewhere Use a NAT gateway's public IPs or prefix: they're the only addresses that stay fixed for a whole subnet. App Service and Functions have their own outbound address rules (`reference/app-service/configuration-and-networking.md`); VNet integration plus a NAT gateway gives them a stable egress address too. ## Load balancer outbound errors | Code | Cause → fix | |---|---| | `SpecifiedAllocatedOutboundPortsForOutboundRuleIsNotAMultipleOfEight` | `allocatedOutboundPorts` must be a multiple of 8 | | `SpecifiedAllocatedOutboundPortsForOutboundRuleExceedsTotalNumberOfAllowedPortsPerRule` | More than 64,000 ports requested on one rule | | `SpecifiedAllocatedOutboundPortsForOutboundRuleExceedsTotalNumberOfAvailablePorts` | Ports × backend instances exceed what the frontend IPs provide: add frontend IPs or lower the per-instance number | More load balancer errors: `reference/load-balancer/errors.md`. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.