An outbound port is the destination port used by a client or Azure resource to initiate a connection to another service. In Azure Network Security Groups (NSGs), outbound rules control traffic leaving a resource or subnet.
|
Port |
Protocol |
Service |
Purpose / Definition |
|---|---|---|---|
|
20 |
TCP |
FTP Data |
Transfers FTP data in active mode. |
|
21 |
TCP |
FTP |
Controls FTP sessions. |
|
22 |
TCP |
SSH |
Secure remote administration of Linux VMs. |
|
25 |
TCP |
SMTP |
Sends email using SMTP; outbound access may be restricted by Azure. |
|
53 |
TCP/UDP |
DNS |
Resolves domain names to IP addresses. |
|
80 |
TCP |
HTTP |
Connects to websites without TLS encryption. |
|
110 |
TCP |
POP3 |
Retrieves email from a mail server. |
|
123 |
UDP |
NTP |
Synchronizes system clocks. |
|
143 |
TCP |
IMAP |
Retrieves and manages email on a mail server. |
|
389 |
TCP/UDP |
LDAP |
Communicates with directory services. |
|
443 |
TCP |
HTTPS |
Secure web traffic, including many Azure service connections. |
|
445 |
TCP |
SMB |
File sharing; used by Azure Files over SMB. |
|
465 |
TCP |
SMTP over TLS |
Email submission using implicit TLS. |
|
587 |
TCP |
SMTP Submission |
Submits outgoing email, typically with STARTTLS. |
|
636 |
TCP |
LDAPS |
Secure LDAP communication. |
|
1433 |
TCP |
SQL Server |
Connects to SQL Server and Azure SQL Database. |
|
3306 |
TCP |
MySQL |
Connects to MySQL databases. |
|
5432 |
TCP |
PostgreSQL |
Connects to PostgreSQL databases. |
|
5671 |
TCP |
Azure Service Bus AMQP over TLS |
Secure AMQP messaging. |
|
5672 |
TCP |
AMQP |
Messaging protocol; TLS requirements depend on the service. |
|
6379 |
TCP |
Redis |
Connects to Redis services using the default port. |
|
8080 |
TCP |
HTTP Alternate |
Common alternate HTTP application port. |
|
8443 |
TCP |
HTTPS Alternate |
Common alternate HTTPS application port. |
|
3389 |
TCP/UDP |
RDP |
Remote administration of Windows VMs; generally inbound to the VM. |
Important Azure outbound rules to remember
|
Destination |
Port |
Protocol |
Purpose |
|---|---|---|---|
|
Internet websites |
80 |
TCP |
Allow outbound HTTP traffic. |
|
Secure websites / Azure APIs |
443 |
TCP |
Allow outbound HTTPS traffic. |
|
DNS server |
53 |
UDP/TCP |
Allow DNS queries and responses. |
|
NTP server |
123 |
UDP |
Allow time synchronization. |
|
Azure SQL Database |
1433 |
TCP |
Allow SQL connections when the configuration uses this port. |
|
Azure Files |
445 |
TCP |
Allow SMB access to Azure file shares. |
|
Linux server |
22 |
TCP |
Allow SSH connections to a remote Linux server. |
|
Windows server |
3389 |
TCP/UDP |
Allow RDP connections to a remote Windows server. |
|
SMTP server |
25 |
TCP |
Allow SMTP traffic where permitted by Azure and the email provider. |
AZ-104 rules:
-
Outbound means traffic leaving the source resource; the destination port identifies the service being contacted.
-
NSG outbound rule evaluates traffic leaving a network interface or subnet.
-
AllowVNetOutbound is a default NSG rule that allows outbound traffic to the VirtualNetwork service tag.
-
AllowInternetOutbound is a default NSG rule that allows outbound traffic to the Internet service tag.
-
DenyAllOutbound is the final default outbound rule and denies traffic not allowed by preceding rules.
-
Priority: Lower numerical values have higher priority; the first matching NSG rule determines the result.
-
Stateful NSG: Return traffic for an allowed connection is automatically permitted; a separate reverse-direction rule is generally unnecessary.
Note: These are common service ports, not a mandatory list of ports that every Azure VM must open. Configure only the outbound ports required by your workload.