How can I use an Application Load Balancer to route requests based on the source IP address?

Resolution

To perform specific actions based on the source IP address of a request, configure listener rules. A listener rule that's based on a source IP address checks the source IP address in the IP header (layer-3). If there's a proxy or firewall that changes the source IP address, then specify the proxy or firewall's IP address in the listener rule.

Complete the following steps to configure a listener rule:

1. Create an Application Load Balancer. Or, use an Application Load Balancer that you've already created.
2. Add a listener rule for your Application Load Balancer.
3. In the listener rule, under Conditions, add a source IP address in CIDR format.

You can specify either a single IP address or network CIDRs with prefixes. For example, specify 1.1.1.1/32 or 10.8.0.0/21.

Each listener rule can have up to 5 conditions, with one CIDR block in each condition. To include more than 5 CIDR blocks, create multiple rules with up to 5 CIDR blocks in each rule. Configure all rules to forward traffic to the same target group. By default, you can have up to 100 rules for each Application Load Balancer. This quota excludes default rules.

Note: Don't use listener rules to block requests from clients. It's a best practice to use security groups or network access control lists instead. To block a large number of clients, you can use AWS WAF.

Related information

Listeners for your Application Load Balancers