Trying to add a listener rule based upon an set of IPs and a path, and then block the path otherwise.

Question

The ALB has :
* Drop invalid header fields: Off
* X-Forwarded-For header: Append
* Preserve host header: On
* Client port preservation: Off

The default rule forwards to the appropriate target group.

At this stage, everything is fine.

We are adding a new feature that is needing to be blocked (for a while).

We create the rule (copy'n'pasted and redacted full IP addresses) ...

* Priority: `100`
* Path = `/tf_112/*` AND HTTP header `X-Forwarded-For` = `18.nnn.nnn.nnn` or `34.nnn.nnn.nnn` or `52.nnn.nnn.nnn`
* Forward to the same target group as the default rule.

and

* Priority: `110`
* Path = `/tf_112/*`
* Return fixed response 404.

For some reason, this is blocking the requests.

As a test, without the blocking rule in play, we have dumped ALL the headers that are getting through to the application (hopefully in a manner that AWS, NGinx and PHP will NOT interfere with - using `getallheaders()` in PHP).

We see the `X-Forwarded-For` header. The IP addresses displayed match one of the ones in the `100` rule.

The IP addresses are for public NATs of a different AWS account. All the routing is in play to allow the traffic to arrive at the ALB. The application reports the right IPs that we want to filter.

We are using Cloudflare, and have tried `CF-Connecting-IP`, and that made no difference.

I'm sure this is a REALLY stupid mistake and I've been stuck at it too long to see it!

re:Post Agent · Answer

It sounds like you're experiencing an issue with your Application Load Balancer (ALB) listener rules not working as expected. Based on your description, there are a few potential issues to investigate:

1. **X-Forwarded-For Header Format**: The X-Forwarded-For header typically contains a comma-separated list of IP addresses, not just a single IP. When you're using Cloudflare, this header will contain the client's IP followed by Cloudflare's IP. Your rule might be looking for an exact match of the entire header value, while you need to match just one IP in the list.

2. **Header Matching Precision**: Make sure the IP addresses in your rule exactly match what's coming in the X-Forwarded-For header. Even a single digit difference will cause the rule to fail.

3. **Rule Evaluation Order**: ALB evaluates rules in order of priority (lowest number first). Your rule with priority 100 should be evaluated before the rule with priority 110, which seems correct in your setup.

4. **Cloudflare Interference**: Since you're using Cloudflare, it might be modifying the headers. Try testing without Cloudflare to isolate the issue.

5. **IP Set vs. Individual IPs**: Instead of listing individual IPs in the rule condition, consider creating an IP set and referencing that in your rule. This can be more manageable and less error-prone.

6. **Rule Condition Logic**: Verify that your AND condition between the path and the header is set up correctly. The rule should only match when both conditions are true.

7. **Testing Methodology**: When testing, make sure you're using the exact path format `/tf_112/*` that matches your rule.

If you've confirmed all these points and are still experiencing issues, you might want to temporarily simplify your rules to isolate the problem. For example, try creating a rule with just the path condition or just the IP condition to see which part might be causing the issue.  
**Sources**  
[New Load Balancer Target Group Rule not working | AWS re:Post](https://repost.aws/questions/QUUHSIZj5pSWWRZJT_IC_paQ/new-load-balancer-target-group-rule-not-working)  
[No longer have http access to EC2 instance after elastic IP associated | AWS re:Post](https://repost.aws/questions/QUlp_BxMNDQTSZINsSl8jh_A/no-longer-have-http-access-to-ec2-instance-after-elastic-ip-associated)

Trying to add a listener rule based upon an set of IPs and a path, and then block the path otherwise.

Add your answer

Relevant content