Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I configured Windows Azure VM last night I had to Edit Mappings in Azure Management portal. This is a process of opening a public port and mapping that to a private port. Its very simple but I noticed Azure by default maps private RDP 3389 to some random high port number say 51460.

I need to open http so mapped private 80 >> public 80. Could I have benefited in some way from mapping random public port number to private port 80?? Seems to me this would would simply block all traffic as http is going to be REQUESTED on 80 anyway.

So why do they do it?

Is it simply a matter of RDP being a high value target that should legitimately be called only from private admin requests?

share|improve this question
up vote 1 down vote accepted

So... for something like a web server, you'd typically have more than one VM (for scale), and you'd typically want the load balancer to do its job and spread the traffic across all of your VMs. In that case, you'd use a load-balanced endpoint and map port 80 (external) to port 80 (internal) - it makes no sense to pick some random input port. Of course, if you have a non-standard web site (e.g. management site), maybe you'd place that on something else (like maybe port 8000). At that point, you can decide to map it to port 80 or leave it at port 8000.

Where the fun begins: something like RDP. If you just used port 3389, and you had more than one VM, all mapping external 3389 to internal 3389, how would you choose which VM to RDP to? The answer: You wouldn't - you'd have a load-balanced endpoint and you'd have luck-of-the-draw and only be able to guess which VM you attached to.

Therefore, you use port-forwarded endpoints, one endpoint per VM, each with its own dedicated port. From the outside world, you'd now have a bank of ports: maybe 55000, 56000, etc. Each of these would then map to internal port 3389 on their respective VM. And... voila - you have direct RDP access to every single VM.

This port-mapping also applies to ssh (when using Linux) or any other scenario where you have a service running independently on multiple VMs, where you need direct access to a specific VM for some reason.

share|improve this answer
Ah-hah. One to many mapping concerns, this is a different scale of thinking than im used too. thx – rism Jun 13 '13 at 12:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.