Adding Firewall rules to a Lightsail instance behind a Load Balancer

0

I'm wondering if anyone can help with how to setup Firewall rules on a Load Balancer in Lightsail. It is easy enough to restrict specific traffic by port to certain IP's which achieves my goal of only allowing certain IP's to get to the Wordpress site. We added a load balancer to simplify the SSL management for this site however now the Network restrictions on the Lightsail instance are no longer in effect. I don't see a way to add them to the Load Balancer. I'm assuming the restrictions are gone as the instance is seeing all traffic as internal from the Load Balancer?

Len
feita há um mês117 visualizações
1 Resposta
0

Hello.

Since it is not possible to set up a firewall with a Lightsail load balancer, why not try setting up an ALB using VPC peering instead?
With ALB, you can restrict IPs using security groups, and you can also set up AWS WAF.
https://repost.aws/knowledge-center/lightsail-add-application-load-balancer

I'm assuming the restrictions are gone as the instance is seeing all traffic as internal from the Load Balancer?

I think this explanation is probably relevant.
If you check the access log of the web server and find that the source IP address is a private IP address, it is possible that the load balancer is accessing using the private IP address.
https://docs.aws.amazon.com/lightsail/latest/userguide/amazon-lightsail-editing-firewall-rules.html

Firewall rules affect only traffic that flows in through the public IP address of an instance. It does not affect traffic that flows in through the private IP address of an instance, which can originate from Lightsail resources in your account, in the same AWS Region, or resources in a peered virtual private cloud (VPC), in the same AWS Region. For example, if you delete the SSH rule (TCP port 22) from the instance firewall, other instances in the same Lightsail account, and in the same AWS Region, can continue to connect to it using SSH by specifying the private IP address of the instance.

profile picture
ESPECIALISTA
respondido há um mês
profile picture
ESPECIALISTA
A_J
avaliado há um mês

Você não está conectado. Fazer login para postar uma resposta.

Uma boa resposta responde claramente à pergunta, dá feedback construtivo e incentiva o crescimento profissional de quem perguntou.

Diretrizes para responder a perguntas