I have a Kubernetes AKS cluster running in a Site-2-Site connected subnet. Kubernetes is able to automatically create an external LB for a service. This ends up with a config that looks like this:

  • Frontend IP config: 52.123.123.12
  • Backend pools: kubernetes (2 virtual machines)
  • Health probes:
    • Protocol: TCP, Port: 30231, Interval: 5, Unhealthy threshold: 2 (Note: 30231 is the port where HTTPS is reachable on each node)
    • Protocol: TCP, Port: 32525, Interval: 5, Unhealthy threshold: 2 (Note: 32525 is the port where HTTP is reachable on each node)
  • Load balancing rules:
    • IPv4, Frontend IP: 52.123.123.12, Port: 443, Backend port: 443, Backend pool: kubernetes (2 virtual machines), Health probe: the one for 30231
    • IPv4, Frontend IP: 52.123.123.12, Port: 80, Backend port: 80, Backend pool: kubernetes (2 virtual machines), Health probe: the one for 32525
  • Inboud NAT rules: none

The external LB routes everything just fine

Now what I'm trying to do is to manually create an identical LB like this, except internal. I've created an ILB, and added the backend pool, health probes and LB rules with the exact same config as the external LB above (with the exception of the IP).

The internal LB is on IP 10.240.140.5, which is the same subnet as the nodes themselves 10.240.140.0/24. I am able to reach both ports 30231,32525 on both nodes 10.240.140.1,10.240.140.2 directly, but if I try to reach the ILB (10.240.140.5:80 or 10.240.140.5:443), the connection just times out. Even though the same exact configuration of pool + probes + rules worked just fine on an external LB.

Any ideas?

The external LB uses the public virtual IP addresss with the cloud service that hosts the virtual machines. The internal LB is on IP 10.240.140.5 which is a private IP address that we can not use to directly connect to a LB or VM publicly.

If you want to access the internal VM from local network, you can use a P2S VPN gateway on Azure portal to route traffic to the Vnet from local network.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.