I have a Debian 6.x box that I needed to move to Azure. Before moving it up, I did make sure that SSH is listening on any port, so is Apache. My NSG has all of the right ports opened (22, 443 for now). I uploaded the VHD, then used the following PowerShell commands to create the VM based off of the VHD:

$vnet = get-AzureRmVirtualNetwork -Name $VnetName -ResourceGroupName $VnetRG
$subnet = Get-AzureRmVirtualNetworkSubnetConfig -Name "$SubnetName" -VirtualNetwork $vnet
$pip = Get-AzureRmPublicIpAddress -Name "$pipName" -ResourceGroupName $resourceGroupName
$NSG = Get-AzureRmNetworkSecurityGroup -Name "$NSGName" -ResourceGroupName $resourceGroupName
$nic = New-AzureRmNetworkInterface -ResourceGroupName $resourceGroupName -Name $nicName -Subnet $subnet -Location $location -PrivateIpAddress $newVMIP -DnsServer $dnsServer1,$dnsServer2 -PublicIpAddress $pip -NetworkSecurityGroup $NSG
$newVM = New-AzureRmVMConfig -VMName $newVMName -VMSize $newVMSize | Add-AzureRmVMNetworkInterface -Id $nic.Id | Set-AzureRmVMOSDisk -VhdUri $vhdPath -Name $diskname -CreateOption attach -Linux -Caching ReadWrite
New-AzureRMVM -ResourceGroupName $resourceGroupName -Location $location -VM $newVM -DisableBginfoExtension

I can see that the machine is running as I can view the auto-logged-in desktop in boot diagnostics. However, when I try to SSH or when I try to access the web site over 22 and 443, it's not returning any response. Telnet times out and it's acting like the port isn't forwarding at all.

I understand that because it's Debian 6.x, waagent isn't supported. But I shouldn't need waagent for port forwarding, should I? From what I understand about networking and from what I see in MSDN forums, "The port forwarding should be invisible to your end machine. As the public hits the public port and your VM receives on the internal port." (https : //social.msdn.microsoft.com/Forums/en-US/bd93f5cb-a674-4b9c-aa5a-9f6e7b364f2c/port-forwarding-still-broken?forum=WAVirtualMachinesforWindows)

Did I mis-key or miss something in my PowerShell script? Any ideas?

I have tried deleting and re-creating the VM and I've tried re-uploading the VHD file. I did have to convert it from VHDX to VHD, but that shouldn't matter since it's actually booting up and I see the screen in boot diags.

The NSG I used does work for any other newly created machine via portal or PowerShell, just not this uploaded machine, which makes me think I've flubbed something in the script. Everything does show that it's open for port 22 and 443 though. Here's a screen grab of the Effective Security Rules blade: rules screenshot

The iptables on the local machine are empty as shown in this screen grab.

What's weird is that I can't SSH to it from another machine on the same virtual network either. I tried going through the steps at https : //docs.microsoft.com/en-us/azure/virtual-machines/virtual-machines-linux-debian-create-upload-vhd?toc=%2Fazure%2Fvirtual-machines%2Flinux%2Ftoc.json, but since it's Debian 6, the waagent won't install. But again, I shouldn't need an agent on the machine for port forwarding to work. No other virtualization technology requires an agent for NAT to work.

Edit - this was suggested as a duplicate of StackOverflow. I originally asked the question there, but everyone suggested I post my question here. So I did that, marking the StackOverflow answer as the answer.

  • @user7384527 You could create a new VM in azure portal and try to ssh your VM by using private IP. – Shui shengbao Jan 9 '17 at 1:30
  • @kaylum - Thanks for the heads-up. I did as you suggested based on searches I did at Serverfault. However, searching StackOverflow yeilded results for "[azure] port forwarding not working" as well. So if it yielded results here and there, and this isn't the right place, I'm not 100% sure Serverfault is either. But it sounds more (based on the name) like that's a better place for it. Thanks! – suprphrk Jan 9 '17 at 1:31
  • @Walter - Sorry, just re-read your post. No, I can't SSH or telnet to it using a different computer on the same subnet using a private IP either. What could that mean? While it's on-premise I can get to it from any computer, even NAT'ing through the internet. Just not when I upload it to Azure. – suprphrk Jan 9 '17 at 1:33
  • @user7384527 You could ask the question on ServerFault. Do you ensure there is no firewall block you on the VM? When you prepare the VHD, if possible, you could disable your firewall. – Shui shengbao Jan 9 '17 at 1:36
  • 1
    If you can't SSH to it from a VM on the same network then it's not an NSG issue, unless you added deny rules to the NSG. By default traffic from the local network is allowed. – Sam Cogan Jan 9 '17 at 9:19

Debian 6 won't work in Azure. You have to use "Legacy Network Adapter" in Hyper-V, and that doesn't work in Azure. Or, you'd have to recompile the kernel to support the Hyper-V drivers for the NIC, and that's not recommended either. Looks like I have to try to migrate the data to a new server.


According to your description, please ensure there is no firewall in VM block you to access your VM. Also, you could check whether you have NGS rules associate to Vnet’s subnet.

Notes: NSG could associate to VM and subnet.

More information about how to manage NSG please refer to this article.

Also, you could check your prepared VHD as the link.

  • Thanks for the answers, I've flagged this to be moved to Serverfault, if not I can as easily copy/paste it over. Just FYI, the IPTables on the Linux box before I move it up are: Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination edit - and of course that didn't show up correctly. – suprphrk Jan 9 '17 at 1:49
  • Re: the prepared VHD - Ya, I did that one. But it's Deb 6, so the tools under the "Manually Prepare" section won't go on it. But I would be REALLY aggravated if I had to have the waagent installed in order for port forwarding to go through. No other virtualization technologies require an agent for port forwarding to work, I don't see why Azure would. – suprphrk Jan 9 '17 at 3:28
  • Marking as the answer just for the "Post to Serverfault" suggestions. Thanks all! – suprphrk Jan 9 '17 at 3:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.