Outbound connectivity — default outbound access, NAT gateway Standard and StandardV2, load balancer outbound rules, SNAT exhaustion
How traffic leaves a VNet for the internet and which method wins — the retiring implicit default outbound access, NAT gateway (Standard and the zone-redundant StandardV2 with its own public IP SKU), Standard load balancer outbound rules and their SNAT port settings, instance public IPs, and routing through a firewall — plus SNAT exhaustion symptoms and fixes, idle timeouts, and the Basic public IP and Basic load balancer retirements of September 30, 2025.
markdownreferencev1EY9K-YMKNstage: designtrust: officialservice: networkinginterface: iacinterface: clidefault outbound accessprivate subnet egressNAT gatewayStandardV2 NAT gatewayStandardV2 public IPNAT gateway zone redundant64512 SNAT ports per public IPNAT gateway idle timeout 4 to 120 minutesUDP idle timeout 4 minutesSNAT port exhaustionload balancer outbound rulesallocatedOutboundPorts multiple of 8Basic public IP retired September 30 2025Basic load balancer retiredNAT gateway Basic load balancer incompatibleforced tunneling firewall egressWindows activation private subnetoutbound IP for allow-list
Outbound connectivity
Every subnet that needs the internet should have an explicit egress method. Implicit "default outbound access" is going away: subnets in new VNets created with network API versions released after March 31, 2026 are private (defaultOutboundAccess: false), and even where it still works its IP is Microsoft's, can change, and doesn't support fragmented packets or ICMP.
The methods
| Method | When | Notes |
|---|---|---|
| NAT gateway on the subnet | The default choice for VMs, scale sets, and VNet-integrated apps | Takes precedence over load balancer outbound rules and instance public IPs for that subnet's outbound flows. Gives stable, allow-listable addresses |
| Standard load balancer outbound rules | VMs already behind a public Standard load balancer | You assign SNAT ports per instance (allocatedOutboundPorts: a multiple of 8, at most 64,000 per rule) |
| Public IP on the VM's NIC | One VM that also needs inbound | Doesn't scale; each IP is exposed |
Route 0.0.0.0/0 to Azure Firewall or an NVA | Central inspection | The firewall then needs its own egress: its public IPs, or (Microsoft's hub-spoke tutorial) a NAT gateway on AzureFirewallSubnet |
NAT gateway SKUs
| Standard | StandardV2 | |
|---|---|---|
| Zones | Zonal (one zone, or no zone) | Zone-redundant |
| Public IPs | Standard public IPs | StandardV2 public IPs or prefixes only |
| Throughput per gateway | up to 50 Gbps | up to 100 Gbps |
| IPv6, flow logs, NAT64 | No | Yes (NAT64 needs a third-party DNS64) |
| Upgrade path | — | None: create a StandardV2 gateway and swap it onto the subnet |
Not all regions offer StandardV2; check before templating it. Neither SKU works with Basic public IPs or a Basic load balancer, both of which retired on September 30, 2025. A known issue: IPv6 egress through load balancer outbound rules breaks when a StandardV2 NAT gateway is attached to the subnet.
SNAT ports and timeouts
- Each NAT gateway public IP provides 64,512 SNAT ports; a gateway scales past a million with more IPs. TCP and UDP have separate inventories.
- TCP idle timeout: 4 minutes by default, configurable to 120; UDP is fixed at 4 minutes. Idle connections hold their port until the timeout, and a connection idle past it is dropped silently: use keepalives for long-lived connections rather than raising the timeout.
- SNAT exhaustion shows as intermittent connection timeouts or failures to the same destination under load, often from code that opens a new connection per request. Fix in this order: reuse connections (one HTTP client or SDK client per process, connection pooling), add a NAT gateway or more public IPs, then raise ports per instance on load balancer outbound rules. Metrics: NAT gateway SNAT Connection Count and Dropped Packets; load balancer Used SNAT Ports against Allocated SNAT Ports.
Choosing an address to allow-list elsewhere
Use a NAT gateway's public IPs or prefix: they're the only addresses that stay fixed for a whole subnet. App Service and Functions have their own outbound address rules (reference/app-service/configuration-and-networking.md); VNet integration plus a NAT gateway gives them a stable egress address too.
Load balancer outbound errors
| Code | Cause → fix |
|---|---|
SpecifiedAllocatedOutboundPortsForOutboundRuleIsNotAMultipleOfEight | allocatedOutboundPorts must be a multiple of 8 |
SpecifiedAllocatedOutboundPortsForOutboundRuleExceedsTotalNumberOfAllowedPortsPerRule | More than 64,000 ports requested on one rule |
SpecifiedAllocatedOutboundPortsForOutboundRuleExceedsTotalNumberOfAvailablePorts | Ports × backend instances exceed what the frontend IPs provide: add frontend IPs or lower the per-instance number |
More load balancer errors: reference/load-balancer/errors.md.