Azure Internal Load balancer reply traffic

Question

Azure Internal Load balancer reply traffic

EL YACOUBI Mounir 0

Hello,

I need to understand the traffic flow for an Azure load balancer. my concern it's about the return traffic(reply from the backend), witch IP the client will see from the reply of the server? it's the backend server IP or the frontend IP address?

thx,

Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator

2026-05-11T10:53:16.39+00:00

Hi EL YACOUBI Mounir,

Thank you for contacting us about the azure internal load balancer issue. We have begun looking into it and will share our suggestions with you as soon as possible. If you have any additional details or concerns in the meantime, please let us know. We appreciate your patience while we work on this.
Amira Bedhiafi 43,046 Reputation points MVP Volunteer Moderator

2026-05-11T13:34:58.8966667+00:00
Hello Mounir !

Thank you for posting on MS Learn Q&A.

For traffic that enters through the Azure Internal Load Balancer frontend IP, the client should see the reply coming from the Load Balancer frontend private IP not from the backend VM IP.

The typical flow:

Client → Internal LB frontend IP → selected backend VM

Client ← Internal LB frontend IP ← selected backend VM response

Don't forget that Azure Load Balancer is layer 4 and works per flow using the connection tuple.

The backend VM receives and answers the connection but the load balancer maps the response traffic back to the frontend IP for that same flow.

If you check the doc below, you will find that the frontend IP as the client contact point and for a public LB explicitly says it maps traffic to the VM and maps traffic the other way for response traffic and the same principle applies to the internal LB except the frontend is a private IP.

https://learn.microsoft.com/en-us/azure/load-balancer/components

The backend VM still sees the original client source IP for inbound load balanced traffic and when the flow arrives on the VM, the original source IP is preserved.

https://learn.microsoft.com/en-us/azure/load-balancer/concepts

If the client connects directly to the backend VM IP, bypassing the load balancer, then the client will see the backend VM IP.

If Floating IP / Direct Server Return is enabled, behavior is different at the packet handling level and the backend must be configured to handle the frontend IP but from the client perspective the service IP is still the frontend IP.

https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-floating-ip

So, for your case with an Azure Internal Load Balancer the client should see the ILB frontend private IP in the server reply.
Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator

2026-05-12T02:50:57.7366667+00:00

Hi EL YACOUBI Mounir,

We haven’t heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please “up-vote” if the information helped you. This will help us and others in the community as well.
EL YACOUBI Mounir 0 Reputation points

2026-05-13T12:09:44.6466667+00:00

Thx a lot for your quick answers. the responses that you provide me helped me to understand the LB flow.

2 answers

Your answer

Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator

2026-05-11T10:53:16.39+00:00

Hi EL YACOUBI Mounir,

Thank you for contacting us about the azure internal load balancer issue. We have begun looking into it and will share our suggestions with you as soon as possible. If you have any additional details or concerns in the meantime, please let us know. We appreciate your patience while we work on this.
Amira Bedhiafi 43,046 Reputation points MVP Volunteer Moderator

2026-05-11T13:34:58.8966667+00:00

Hello Mounir !

Thank you for posting on MS Learn Q&A.

For traffic that enters through the Azure Internal Load Balancer frontend IP, the client should see the reply coming from the Load Balancer frontend private IP not from the backend VM IP.

The typical flow:

Client → Internal LB frontend IP → selected backend VM

Client ← Internal LB frontend IP ← selected backend VM response

Don't forget that Azure Load Balancer is layer 4 and works per flow using the connection tuple.

The backend VM receives and answers the connection but the load balancer maps the response traffic back to the frontend IP for that same flow.

If you check the doc below, you will find that the frontend IP as the client contact point and for a public LB explicitly says it maps traffic to the VM and maps traffic the other way for response traffic and the same principle applies to the internal LB except the frontend is a private IP.

https://learn.microsoft.com/en-us/azure/load-balancer/components

The backend VM still sees the original client source IP for inbound load balanced traffic and when the flow arrives on the VM, the original source IP is preserved.

https://learn.microsoft.com/en-us/azure/load-balancer/concepts

If the client connects directly to the backend VM IP, bypassing the load balancer, then the client will see the backend VM IP.

If Floating IP / Direct Server Return is enabled, behavior is different at the packet handling level and the backend must be configured to handle the frontend IP but from the client perspective the service IP is still the frontend IP.

https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-floating-ip

So, for your case with an Azure Internal Load Balancer the client should see the ILB frontend private IP in the server reply.
Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator

2026-05-12T02:50:57.7366667+00:00

Hi EL YACOUBI Mounir,

We haven’t heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please “up-vote” if the information helped you. This will help us and others in the community as well.
EL YACOUBI Mounir 0 Reputation points

2026-05-13T12:09:44.6466667+00:00

Thx a lot for your quick answers. the responses that you provide me helped me to understand the LB flow.

Answer 1

For Azure Load Balancer, the client always sees the load balancer frontend IP as the source of the reply, not the backend VM’s IP.

Azure Load Balancer operates at OSI layer 4 and performs SNAT/DNAT on the TCP/UDP headers. Inbound flows are directed from the frontend IP to a selected backend instance, and the response to that flow is returned to the client with the frontend IP as the source. The original client source IP is preserved when the packet reaches the backend VM, but it is not exposed as the backend VM’s IP to the client.

So, from the client’s perspective, all traffic (request and reply) is with the load balancer frontend IP.

References:

Answer 2

Hi EL YACOUBI Mounir,

Thanks for reaching out in Microsoft Q&A forum,

I need to understand the traffic flow for an Azure load balancer. my concern it's about the return traffic(reply from the backend), witch IP the client will see from the reply of the server? it's the backend server IP or the frontend IP address?

For an Azure Load Balancer (both Public and Internal), the client sees the frontend IP address (VIP) as the source of the server’s reply, not the backend VM’s private IP. This is true for normal configurations as well as for Internal Load Balancer‑only scenarios.

How traffic flows

Inbound: The client sends traffic to the Load Balancer frontend IP. The load balancer performs DNAT, changing the destination IP to the backend VM’s IP.
Backend processing: The VM receives the packet with the frontend IP as the original destination, but the target at the OS level is its own IP.
Return path: On the way back, Azure’s SDN stack rewrites the source IP back to the frontend IP (VIP). From the client’s perspective, the reply always appears to come from that frontend IP, not from the backend VM’s IP.

Effect of Floating IP (DSR)

When Floating IP is disabled, the return traffic is SNAT’d so the client clearly sees the frontend IP as source and the backend IP stays hidden.
When Floating IP is enabled, the backend VM can respond directly using the frontend IP (Direct Server Return), but the client still sees the frontend IP as the source of the reply; only the path may bypass the load balancer.

Official documentation references

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator

2026-05-14T00:55:42.4733333+00:00

Hi EL YACOUBI Mounir,

Just checking in to see if you had a chance to see the previous response posted by me.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.