CODEWITHSUNDEEP
amazon-web-services
ohmgroup
ohmgroup

Reputation: 29

AWS ALB Routing

I configured an internet facing ALB in AWS with two listeners (80 and 443) and the target groups are in private network (10.0.1.0/24). When http/https request are sent by ALB to the target group in 10.0.1.0 network, how the request is sent back to ALB? ALB has a public IP, and the target group do not have a route to internet. I can configure a NAT gateway and setup a route 0.0.0.0/0 to use the NAT gateway. But the web response will go all the way to internet and then comeback to ALB. Highly undesirable. I can't put these instances in public facing subnet either.

Can some one help how this can be done? I thought of VPC endpoint, and configured one with the load balancer (I used ELB, as I couldn't find ALB endpoint service). Now, the endpoint shows it has an IP in the 10.0.1.0 subnet. However, I don't know how this will work. Can someone suggest what's to be done. Thanks.

Upvotes: 0

Views: 3953

Answers (1)

Shravan
Shravan

Reputation: 141

Not sure exactly what your question here is. But giving you a simple explanation of how AWS ELB works.

In both AWS Classic Load Balancers and Application Load Balancers, two connections are involved:

  1. A connection between client (browser, etc) and ELB
  2. A connection between ELB and backend target instances (webservers)

When creating an Internet facing ELB, you are given the option of selecting two subnets. These subnets should be public subnets which have a route to an Internet Gateway. The ELB will launch at least one ELB node in each of these subnets. Clients on the Internet will be able to connect to these ELB nodes using their public IPs through the IGW.

Once the ELB receives the request from the client, it forwards the request to its backend targets. This communication uses the PRIVATE IPs of the ELB nodes and the target instances. Therefore, even if the instances are in the private subnet, the ELB will still be able to forward requests to them because the connection is over private IPs which uses the 'local' route in the route tables. The response from the target then goes to the ELB over private IP, and is then forwarded to the client over public IP.

Client <--public IP--> ELB <--private IP--> Targets

The connection between client and ELB is over public IP, the connection between ELB and webservers is over private IPs which does not need a route to an IGW or NAT.

Don't worry about NAT Gateways for your private subnets. Just make sure the subnets you choose when creating the ELB are public and have a route to an internet gateway.

Upvotes: 9

Related Questions