title: Azure: How to ensure a static IP for both inbound and outbound requests?
body: <p>I'm having troubles designing the infrastructure in Azure for my app. The app should communicate with customer's on-premise systems by-directionally (meaning that sometimes my app initiates the connections, other times the customer's).</p>
  <p>The customer wants a <strong>single IP address</strong> that would be used for <strong>both inbound and outbound traffic</strong>.</p>
  <p>I've managed with a single VM - that was simple because - you create a VM, it gets an IP address automatically. You can switch it to static and voilá.</p>
  <p>But the problem is that the application can run for many years and the hosting requirements may change. We might want to switch to a VMSS, AKS or something else later as the app grows.</p>
  <p>So, I'm looking for an easy solution that would allow us to start with just a single VM for now but switch to more complex hosting models later <strong>while keeping the same IP</strong>.</p>
  <p>I know that you can go all-in and design a very complicated infrastructure with a load balancer that splits the network into a public and a private part, then create an AKS cluster in the private part, let it use a specific subnet etc. etc. But it feels like an overkill for what we need now.</p>
  <p>I'm just worried that if the design if too simple, it will be limiting us later when we try to scale out from that single VM.</p>
  <h3>Steps I've tried:</h3>
  <ol>
  <li>Create a vnet and an IP address</li>
  <li>Create a load balancer inside the vnet and assign it the IP.</li>
  <li>Create a VM without it's own public IP (so that I can make it use the common IP)</li>
  <li>Configure the load balancer to point traffic to the VM.</li>
  </ol>
  <p>...but it doesn't feel right. Inbound traffic works but outbound traffic seems to be comming from random IP addresses. And at this point I'm overwhelmed by all the network services in Azure - not sure what now. Should I somehow instruct the VM to route all traffic back via the same load balancer? Or can I do it on the vnet level? So that the vnet would capture all traffic trying to escape and re-route it via the common IP?</p>
  <p>Sorry for the long comment but it's just a complex issue.</p>