Problem connect to VM from static IP

Question

Problem connect to VM from static IP

CCybersafe CCybersafe 0

Hello, I cannot connect to the VM machine, access to port 443 from the static IP of the company but I can access from public IP, external to my company, can someone help me?

Hemant Bharadwaj 90 Reputation points Microsoft Employee

2026-11-03T16:00:23.2166667+00:00
From your symptoms, this is most likely a network filtering/routing issue on the company path (not on VM service itself), because access works from external public IP but fails from your company static IP.

Check NSG effective rules on VM NIC/subnet.

Confirm inbound 443 is allowed from your company public IP/CIDR.

Verify no higher-priority deny rule is matching first.

Ref: https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works

Run IP Flow Verify (Network Watcher).

Test source = company static IP, destination = VM private/public endpoint, port = 443, protocol = TCP.

This confirms whether Azure NSG is allowing or denying the flow.

Ref: https://learn.microsoft.com/azure/network-watcher/ip-flow-verify-overview

Check route/firewall path.

If UDR/Azure Firewall/NVA is in path, confirm return route and 443 policy for that source.

Also validate on-prem firewall is allowing outbound 443 and return traffic statefully.

Validate service listener on VM.

Ensure app/web server is actually listening on 443 and certificate binding is valid.

If possible, test from another Azure VM in same VNet to separate app issue vs internet path issue.

Capture minimum diagnostics for next step.

UTC timestamp, source public IP, VM public IP/FQDN, NSG rule name hit, and IP Flow Verify result.

If there is no deny in Azure but traffic still fails only from office IP, issue is usually on corporate firewall/proxy path.

“If you find this answer helpful, please upvote it. If this resolves your issue, please mark it as the accepted answer so that it can help others in the community.”

Your answer

Hemant Bharadwaj 90 Reputation points Microsoft Employee

2026-11-03T16:00:23.2166667+00:00

From your symptoms, this is most likely a network filtering/routing issue on the company path (not on VM service itself), because access works from external public IP but fails from your company static IP.

Check NSG effective rules on VM NIC/subnet.

Confirm inbound 443 is allowed from your company public IP/CIDR.

Verify no higher-priority deny rule is matching first.

Ref: https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works

Run IP Flow Verify (Network Watcher).

Test source = company static IP, destination = VM private/public endpoint, port = 443, protocol = TCP.

This confirms whether Azure NSG is allowing or denying the flow.

Ref: https://learn.microsoft.com/azure/network-watcher/ip-flow-verify-overview

Check route/firewall path.

If UDR/Azure Firewall/NVA is in path, confirm return route and 443 policy for that source.

Also validate on-prem firewall is allowing outbound 443 and return traffic statefully.

Validate service listener on VM.

Ensure app/web server is actually listening on 443 and certificate binding is valid.

If possible, test from another Azure VM in same VNet to separate app issue vs internet path issue.

Capture minimum diagnostics for next step.

UTC timestamp, source public IP, VM public IP/FQDN, NSG rule name hit, and IP Flow Verify result.

If there is no deny in Azure but traffic still fails only from office IP, issue is usually on corporate firewall/proxy path.

“If you find this answer helpful, please upvote it. If this resolves your issue, please mark it as the accepted answer so that it can help others in the community.”