CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2amazon-elb
Nikhil
Nikhil

Reputation: 1018

Amazon Network Load Balancer required port 80 to be publicly open on nodes from target group?

I have a website running on apache httpd. The two web nods are added under Network Load Balancer. If I open the port 80 of the two web nodes only for the default security group or VPC CIDR range, the website does not work. However, If I open the port 80 fully 0.0.0.0/0 then it works.

This was not the case in Classic ELB. Am I doing something wrong here or its the default behaviour of Network Load Balancer?

Upvotes: 0

Views: 546

Answers (1)

Mark B
Mark B

Reputation: 200562

Due to the nature of the Network Load Balancer, traffic is passed directly to the target instances, retaining its source IP address. Thus to the target instances (and their Security Groups) the traffic looks like it is coming straight from the Internet. So you would need to configure the Security Group of the target instances to allow public access.

I've seen lots of people complain about this, and I wouldn't be surprised if Amazon updated NLBs in the future to work like the other load balancers, but it may not be possible due to the way NLBs are designed.

If you are using port 80 then I assume this is for HTTP? Why not use an Application Load Balancer instead and get the Security Group feature you are looking for as well as things like SSL termination?

Upvotes: 1

Related Questions