Public IPs, Default Outbound Access and NAT Gateway

You build one small Ubuntu VM in snet-mgmt with no public IP, test it with Run Command (which needs no SSH and no internet), then add a NAT Gateway. Load the network IDs first:

$v = Get-Content C:\azure-lab\vnet-saat.json | ConvertFrom-Json
az group create --name rg-saat-l13 --tags course=saatvedha-azure lesson=13 -o none

1Create a test VM in the private subnet

Run this (it takes about two minutes):

az vm create --resource-group rg-saat-l13 --name vm-saat-l13 --image Canonical:ubuntu-24_04-lts:server:latest --size Standard_B2ats_v2 --subnet $v.'snet-mgmt' --public-ip-address '""' --nsg '""' --admin-username azureuser --generate-ssh-keys --os-disk-size-gb 64 --tags course=saatvedha-azure lesson=13 --query "{name:name, privateIp:privateIpAddress, publicIp:publicIpAddress}" -o table

You should see something like this:

Name         PrivateIp    PublicIp
-----------  -----------  ----------
vm-saat-l13  10.30.10.4

'""' passes an empty value through Windows PowerShell to the CLI, which means “no public IP” and “no NSG on the network card”. Without the quotes, PowerShell drops the empty value and the CLI would create both. Standard_B2ats_v2 with a 64 GB disk stays inside the free account’s 12-month amounts.

You’ll learn VMs properly in Lesson 15.

2Prove the VM has no internet

Run this:

az vm run-command invoke --resource-group rg-saat-l13 --name vm-saat-l13 --command-id RunShellScript --scripts "curl -s -m 10 https://ifconfig.me || echo NO-OUTBOUND" --query "value[0].message" -o tsv

You should see something like this:

Enable succeeded:
[stdout]
NO-OUTBOUND

[stderr]

The VM can’t reach the internet. Run Command still worked because it talks to the VM agent through the Azure platform, not the internet. Check why:

az network vnet subnet show --ids $v.'snet-mgmt' --query "{defaultOutbound:defaultOutboundAccess, natGateway:natGateway.id}" -o table

You should see something like this:

DefaultOutbound
-----------------
False

3Create a public IP and a NAT Gateway

Run this:

az network public-ip create --resource-group rg-saat-l13 --name pip-saat-nat --sku Standard --allocation-method Static --tags course=saatvedha-azure lesson=13 -o none
az network nat gateway create --resource-group rg-saat-l13 --name nat-saat-l13 --public-ip-addresses pip-saat-nat --idle-timeout 4 --tags course=saatvedha-azure lesson=13 -o none
$natId = az network nat gateway show --resource-group rg-saat-l13 --name nat-saat-l13 --query id -o tsv
az network vnet subnet update --ids $v.'snet-mgmt' --nat-gateway $natId -o none
az network public-ip show --resource-group rg-saat-l13 --name pip-saat-nat --query ipAddress -o tsv

You should see something like this:

20.204.118.57

The NAT Gateway is in your lab resource group, but it’s attached to snet-mgmt in rg-saat-core. That cross-group link matters at cleanup time.

4Test again

Wait about a minute, then run the same test:

az vm run-command invoke --resource-group rg-saat-l13 --name vm-saat-l13 --command-id RunShellScript --scripts "curl -s -m 10 https://ifconfig.me || echo NO-OUTBOUND" --query "value[0].message" -o tsv

You should see something like this:

Enable succeeded:
[stdout]
20.204.118.57
[stderr]

The website now sees the NAT Gateway’s public IP, the same one you printed in step 3. Every VM in snet-mgmt will use it. Try sudo apt-get update through Run Command if you like: it works now.

✅ Checkpoint: The VM printed NO-OUTBOUND before the NAT Gateway, and the NAT Gateway’s public IP after.