{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/", "slug": "dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target", "url": "https://update.dsesecurity.com/updates/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/" }, "title": "Verify the actual frontend-port mapping for each inbound NAT target", "summary": "Match a Load Balancer endpoint to the intended VM before using it for administration.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:00+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 2, "word_count": 221, "potentially_affected": "Use this review when documenting or changing an approved inbound NAT management path. Identify the load balancer, frontend address, rule, mapped port and target VM. Treat the tutorial's port numbers and broad deployment examples as sample values rather than production requirements.", "dse_recommendation": "DSE recommends an endpoint register that pairs each approved frontend tuple with its intended backend identity and owner.", "primary_source": { "name": "Tutorial: Create Inbound NAT rule V2 - Azure portal - Azure Load Balancer | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/load-balancer/tutorial-nat-rule-multi-instance-portal", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s inbound NAT tutorial uses an Azure Load Balancer public address together with a port number to connect to a VM in the virtual network. It directs operators to the port-mapping view for backend-pool VMs. Its connection example uses the selected NAT frontend port when opening the remote session. Microsoft Learn.

\n

Applicability

\n

Use this review when documenting or changing an approved inbound NAT management path. Identify the load balancer, frontend address, rule, mapped port and target VM. Treat the tutorial’s port numbers and broad deployment examples as sample values rather than production requirements.

\n

DSE recommendation

\n

DSE recommends an endpoint register that pairs each approved frontend tuple with its intended backend identity and owner. Verify the mapping before distributing connection instructions or modifying a backend pool. Review access restrictions and credentials independently, and preserve the prior mapping in the change record. Do not infer the target solely from a remembered port number.

\n

Verification

\n

Inspect the current port mapping and connect from an authorized source using the approved credentials. Confirm the remote machine’s identity before performing administrative work. Record the frontend tuple and observed target, then repeat after any rule or pool change. Resolve a mismatched destination before updating user instructions or making changes on the reached host.

\n

Official references

\n

Microsoft Learn: Tutorial: Create Inbound NAT rule V2 – Azure portal.

", "content_text": "Source facts\nMicrosoft’s inbound NAT tutorial uses an Azure Load Balancer public address together with a port number to connect to a VM in the virtual network. It directs operators to the port-mapping view for backend-pool VMs. Its connection example uses the selected NAT frontend port when opening the remote session. Microsoft Learn.\nApplicability\nUse this review when documenting or changing an approved inbound NAT management path. Identify the load balancer, frontend address, rule, mapped port and target VM. Treat the tutorial’s port numbers and broad deployment examples as sample values rather than production requirements.\nDSE recommendation\nDSE recommends an endpoint register that pairs each approved frontend tuple with its intended backend identity and owner. Verify the mapping before distributing connection instructions or modifying a backend pool. Review access restrictions and credentials independently, and preserve the prior mapping in the change record. Do not infer the target solely from a remembered port number.\nVerification\nInspect the current port mapping and connect from an authorized source using the approved credentials. Confirm the remote machine’s identity before performing administrative work. Record the frontend tuple and observed target, then repeat after any rule or pool change. Resolve a mismatched destination before updating user instructions or making changes on the reached host.\nOfficial references\nMicrosoft Learn: Tutorial: Create Inbound NAT rule V2 – Azure portal.", "content_markdown": "## Source facts\n\nMicrosoft’s inbound NAT tutorial uses an Azure Load Balancer public address together with a port number to connect to a VM in the virtual network. It directs operators to the port-mapping view for backend-pool VMs. Its connection example uses the selected NAT frontend port when opening the remote session. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/load-balancer/tutorial-nat-rule-multi-instance-portal).\n\n## Applicability\n\nUse this review when documenting or changing an approved inbound NAT management path. Identify the load balancer, frontend address, rule, mapped port and target VM. Treat the tutorial’s port numbers and broad deployment examples as sample values rather than production requirements.\n\n## DSE recommendation\n\nDSE recommends an endpoint register that pairs each approved frontend tuple with its intended backend identity and owner. Verify the mapping before distributing connection instructions or modifying a backend pool. Review access restrictions and credentials independently, and preserve the prior mapping in the change record. Do not infer the target solely from a remembered port number.\n\n## Verification\n\nInspect the current port mapping and connect from an authorized source using the approved credentials. Confirm the remote machine’s identity before performing administrative work. Record the frontend tuple and observed target, then repeat after any rule or pool change. Resolve a mismatched destination before updating user instructions or making changes on the reached host.\n\n## Official references\n\n[Microsoft Learn: Tutorial: Create Inbound NAT rule V2 – Azure portal](https://learn.microsoft.com/en-us/azure/load-balancer/tutorial-nat-rule-multi-instance-portal)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/", "url": "https://update.dsesecurity.com/updates/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Verify the actual frontend-port mapping for each inbound NAT target", "item": "https://update.dsesecurity.com/updates/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/", "url": "https://update.dsesecurity.com/updates/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/", "headline": "Verify the actual frontend-port mapping for each inbound NAT target", "description": "Match a Load Balancer endpoint to the intended VM before using it for administration.", "abstract": "Match a Load Balancer endpoint to the intended VM before using it for administration.", "articleBody": "Source facts\nMicrosoft’s inbound NAT tutorial uses an Azure Load Balancer public address together with a port number to connect to a VM in the virtual network. It directs operators to the port-mapping view for backend-pool VMs. Its connection example uses the selected NAT frontend port when opening the remote session. Microsoft Learn.\nApplicability\nUse this review when documenting or changing an approved inbound NAT management path. Identify the load balancer, frontend address, rule, mapped port and target VM. Treat the tutorial’s port numbers and broad deployment examples as sample values rather than production requirements.\nDSE recommendation\nDSE recommends an endpoint register that pairs each approved frontend tuple with its intended backend identity and owner. Verify the mapping before distributing connection instructions or modifying a backend pool. Review access restrictions and credentials independently, and preserve the prior mapping in the change record. Do not infer the target solely from a remembered port number.\nVerification\nInspect the current port mapping and connect from an authorized source using the approved credentials. Confirm the remote machine’s identity before performing administrative work. Record the frontend tuple and observed target, then repeat after any rule or pool change. Resolve a mismatched destination before updating user instructions or making changes on the reached host.\nOfficial references\nMicrosoft Learn: Tutorial: Create Inbound NAT rule V2 – Azure portal.", "datePublished": "2026-09-17T16:32:00+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Verify the actual frontend-port mapping for each inbound NAT target" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 221, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Tutorial: Create Inbound NAT rule V2 - Azure portal - Azure Load Balancer | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/load-balancer/tutorial-nat-rule-multi-instance-portal" } } ] } }