从Azure App Service访问Azure VM中服务的连接问题求助

云原生阿岚

2026-5-22

Hey there! Let's figure out why your Azure App Service can't connect to your VM's service via private IP, even though you assumed they're on the same network. Here are the key checks and fixes to work through:

1. Confirm App Service is actually integrated with your VM's VNet

By default, regular Azure App Services run in Azure's managed network—not directly in your virtual network. So first, you need to make sure you've set up Regional VNet Integration (not Gateway Integration, which is for accessing resources outside your VNet).

How to check:
- Go to your App Service resource, navigate to Network > VNet Integration in the left menu
- Verify it's linked to the same VNet and subnet where your VM resides. If not, set up this integration first—it's the foundation for private IP access.

2. Check your VM's Network Security Group (NSG) rules

Even if they're in the same VNet, the NSG attached to your VM (or its subnet) might be blocking traffic from the App Service's subnet.

What to do:
- Open the NSG associated with your VM (or its subnet)
- Go to Inbound Security Rules and add a rule that allows traffic from the App Service's subnet IP range to your VM's service port (e.g., 80, 8080, 443—whichever your service uses)
- Make sure the rule's priority is higher than any deny rules that might override it

3. Validate the VM's internal firewall settings

Don't overlook the firewall running inside your VM itself—Windows Firewall on Windows VMs, or iptables/ufw on Linux VMs. These might be blocking incoming requests from the App Service's subnet.

Verify that the local firewall has an inbound rule allowing traffic to your service's port, with the source set to the App Service subnet's IP range.

4. Check App Service's outbound traffic rules

Your App Service might have outbound restrictions preventing it from reaching the VM's private IP.

Head to your App Service's Network > Outbound Traffic section
Ensure there are no deny rules targeting the VM's subnet. If you're using a route table with the App Service's subnet, confirm it doesn't route traffic away from the VM.

5. Test connectivity from another VM in the same VNet

To narrow down the issue, deploy a test VM in the same VNet as your target VM. Try accessing the target VM's private IP and service port from this test VM.

If the test VM can connect: The problem is isolated to your App Service's network configuration (go back to steps 1, 4)
If the test VM can't connect: The issue is with the target VM's service, NSG, or local firewall (focus on steps 2, 3)

6. If using an App Service Environment (ASE)

If your App Service is running in an ASE, it's already in your VNet—but double-check that the ASE's subnet and your VM's subnet have no NSG or route restrictions blocking traffic between them.

内容的提问来源于stack exchange，提问作者Talha Ahmed