Controller-VM network rules question

[costaluisc]

Hello,
Currently planing a deployment of moodle using the template.
If I understood the controller-vm shoud not be accessed externally.
If this is the case, why does it have the following network inbound rules?

Name	Port	Source	Destination	Action
Allow_http	80	Any	Any	Allow
AllowAzureLoadBalancerInBound	Any	AzureLoadBalancer	Any	Allow

I already tried to access the vm from its public ip and gets redirected to the vm-scaleset by the load balancer, but i cant figure out where the redirect is done and why is this even needed.

Thanks for the help and greate job with the template.
Will share any problems if I encounter them.

Thanks for the help.