CanReachPort

A security group with an inbound allow rule allowing 0.0.0.0/0 (any source) on a specific port grants network reachability to that port from the internet. This is derived from explicit SG record collection and represents the network-layer capability to reach a listening port on a protected compute node.

An NSG effective inbound rule allows source=Internet (or 0.0.0.0/0) with action=Allow on a specific port - the firewall is open to the public internet for that port. CONDITIONAL(network_reachability): a public IP must also be present on an attached resource for the port to be externally reachable.

An NSG effective inbound rule allowing a source of Internet or 0.0.0.0/0 on a specific port/range means that port is reachable from the internet at the network layer. Source is the NSG/Subnet (a Network node), target is the compute resource behind it.

Ingress ALLOW from 0.0.0.0/0 on a port means any internet source can reach that port on matched VMs - a per-firewall-rule network FACT.

An ingress firewall rule allowing 0.0.0.0/0 (or ::/0) on a specific port permits any internet host to initiate a connection to matching VMs on that port.