# Verify the actual frontend-port mapping for each inbound NAT target

> Match a Load Balancer endpoint to the intended VM before using it for administration.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:00+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Match a Load Balancer endpoint to the intended VM before using it for administration.

## Potentially affected

Use this review when documenting or changing an approved inbound NAT management path. Identify the load balancer, frontend address, rule, mapped port and target VM. Treat the tutorial's port numbers and broad deployment examples as sample values rather than production requirements.

## DSE recommendation

DSE recommends an endpoint register that pairs each approved frontend tuple with its intended backend identity and owner.

## Article

## Source facts

Microsoft’s inbound NAT tutorial uses an Azure Load Balancer public address together with a port number to connect to a VM in the virtual network. It directs operators to the port-mapping view for backend-pool VMs. Its connection example uses the selected NAT frontend port when opening the remote session. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/load-balancer/tutorial-nat-rule-multi-instance-portal).

## Applicability

Use this review when documenting or changing an approved inbound NAT management path. Identify the load balancer, frontend address, rule, mapped port and target VM. Treat the tutorial’s port numbers and broad deployment examples as sample values rather than production requirements.

## DSE recommendation

DSE recommends an endpoint register that pairs each approved frontend tuple with its intended backend identity and owner. Verify the mapping before distributing connection instructions or modifying a backend pool. Review access restrictions and credentials independently, and preserve the prior mapping in the change record. Do not infer the target solely from a remembered port number.

## Verification

Inspect the current port mapping and connect from an authorized source using the approved credentials. Confirm the remote machine’s identity before performing administrative work. Record the frontend tuple and observed target, then repeat after any rule or pool change. Resolve a mismatched destination before updating user instructions or making changes on the reached host.

## Official references

[Microsoft Learn: Tutorial: Create Inbound NAT rule V2 – Azure portal](https://learn.microsoft.com/en-us/azure/load-balancer/tutorial-nat-rule-multi-instance-portal).

## Primary reference

- Name: Tutorial: Create Inbound NAT rule V2 - Azure portal - Azure Load Balancer | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/load-balancer/tutorial-nat-rule-multi-instance-portal
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Verify the actual frontend-port mapping for each inbound NAT target,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-180-verify-the-actual-frontend-port-mapping-for-each-inbound-nat-target/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.