Check the VM's own firewall and app

vm-client can't open the site on vm-web at 443. There's no NSG and no route table anywhere in vnet-app, so Azure isn't filtering anything. Find out what's stopping it inside the VM. SSH to vm-web is for subnet-admin only, so vm-client must not get it.

1. Test the connection from Azure's side. Look at the issue type on the last hop.

   az network watcher test-connectivity -g rg-lab --source-resource vm-client --dest-address 10.1.1.4 --dest-port 443Type it
   What's this?

   Tests a real connection from a VM to a destination and reports whether it works, each hop on the way, and the issue that stops it.

   • -g the resource group the resources live in
   • --source-resource the VM the test starts from
   • --dest-address the IP or name to reach
   • --dest-port the port to reach

2. GuestFirewall: the VM itself dropped it. Look inside with Run command.

   az vm run-command invoke -g rg-lab -n vm-web --command-id RunShellScript --scripts "ufw status numbered"Type it
   What's this?

   Runs a script inside a VM through the VM agent, without logging in to it.

   • -g the resource group the resources live in
   • -n the name of the thing to look at or change
   • --command-id RunShellScript run your own shell script
   • --scripts the script, run as root by the VM agent

3. Only SSH from the admin subnet is allowed. Allow 443 from the client subnet, nothing more.

   az vm run-command invoke -g rg-lab -n vm-web --command-id RunShellScript --scripts "ufw allow from 10.1.2.0/24 to any port 443 proto tcp"Type it
   What's this?

   Runs a script inside a VM through the VM agent, without logging in to it.

   • -g the resource group the resources live in
   • -n the name of the thing to look at or change

4. Test again. The issue changes.

   az network watcher test-connectivity -g rg-lab --source-resource vm-client --dest-address 10.1.1.4 --dest-port 443 --protocol TcpType it
   What's this?

   Tests a real connection from a VM to a destination and reports whether it works, each hop on the way, and the issue that stops it.

   • -g the resource group the resources live in
   • --source-resource the VM the test starts from
   • --dest-address the IP or name to reach
   • --dest-port the port to reach
   • --protocol TCP or UDP

5. NoListenerOnDestination: the firewall lets it in, but nothing answers. See what's listening, and the web server's state.

   az vm run-command invoke -g rg-lab -n vm-web --command-id RunShellScript --scripts "ss -tlnp && systemctl status nginx"Type it
   What's this?

   Runs a script inside a VM through the VM agent, without logging in to it.

   • -g the resource group the resources live in
   • -n the name of the thing to look at or change

6. Start the web server.

   az vm run-command invoke -g rg-lab -n vm-web --command-id RunShellScript --scripts "systemctl start nginx"Type it
   What's this?

   Runs a script inside a VM through the VM agent, without logging in to it.

   • -g the resource group the resources live in
   • -n the name of the thing to look at or change

7. Answer the question below.

   UFW is active and port 8080 isn't in its rule list. Is 8080 allowed or denied?

   UFW

   Uncomplicated Firewall: the firewall inside an Ubuntu VM.

   Check