External internet access to an Azure VM is performed through a virtual IP (VIP) assigned automatically by Azure. The IP is resolvable through global DNS by the VM name under the cloudapp.net domain, e.g. vmname.cloudapp.net. The VIP connects a client to endpoints configured for the VM that represent mappings of external ports to internal ports (e.g. HTTP port 80). By default, SnapCLOUD VMs automatically provide endpoints for SSH (22), HTTP (80), and HTTPS (443) for server management and configuration, as well as two ports for Snap Server Manager and Snap Finder remote server discovery (2599 and 9050). Additional endpoints for other ports can be added to the VM as needed for access over other protocols (e.g. port 21 for FTP), and ACLs can also be configured on endpoints to allow and deny access to specific IPs or IP ranges. It is not recommended that endpoints be added for other file protocols, including SMB, NFS, and AFP. Always remember that these ports are open to the VM on the live internet and are subject to attack, so always take caution when configuring endpoints.