I'm trying to understand Azure networking and keep comparing it with the public/private subnet model from other cloud platforms. Azure documentation mentions that subnets can have a default route toward the Internet, which made me wonder: if a VM has a public IP, can it access the Internet from any subnet? If a subnet has a NAT Gateway, does that allow private VMs to make outbound Internet connections? I'm also unclear whether a NAT Gateway is only used for source NAT and outbound traffic. Finally, how do I build an Internet-facing load balancer if Azure does not have an explicit public-subnet/private-subnet classification?
3 Answers
Think of Azure private subnets as an architecture rather than a special subnet type. You typically omit public IPs from private VMs, provide outbound access through NAT Gateway or a firewall, and use NSGs and route tables to control traffic. For an Internet-facing service, place a public IP on the frontend of a Public Load Balancer or Application Gateway. The backend VMs can remain private and use internal addresses only.
Be careful with older documentation. Newer Azure deployments may have no default outbound access, so a VM without a public IP generally needs an explicit egress method such as NAT Gateway, Azure Firewall, or another proxy. NAT Gateway is associated with a subnet and supplies outbound SNAT for resources in that subnet. It does not make those resources reachable from the Internet.
Azure doesn’t have a built-in public-versus-private subnet type like some other cloud platforms. A subnet is just a range of addresses with routes and security controls. Internet access depends on the resource and the network configuration: a public IP can provide a path for Internet connectivity, while inbound traffic still has to pass the relevant security rules. An Azure Load Balancer or Application Gateway becomes Internet-facing when its frontend is configured with a public IP. NAT Gateway is for outbound source NAT; it does not provide inbound connectivity or turn a subnet into a public one.
The exact behavior also depends on when the subnet and VM were created. Azure has been moving toward no default outbound Internet access for new deployments, so relying on the old implicit outbound path is not recommended.
That clears up the distinction. So a NAT Gateway is mainly the explicit outbound path for private resources, not an alternative way to expose them inbound.
Existing environments may still behave differently because the newer default-outbound changes do not automatically alter every older network. It’s worth checking the deployment’s current networking configuration instead of assuming the documentation applies identically everywhere.