ALB Returns 403 Forbidden for Specific Client Despite Normal Infrastructure Configuration

The 403 Forbidden errors you're experiencing with your Application Load Balancer (ALB) despite not having a WAF configured could be related to the ALB's built-in protection mechanisms against unusual traffic patterns.

When your MetaTrader 5 clients on certain Windows VPS environments connect to your ALB, they might be triggering these protective measures. This can happen if:

1. The clients are generating a high volume of requests in a short time period
2. The requests are coming from a limited number of IP addresses
3. The traffic pattern appears suspicious to the ALB's protection systems

Even without an explicit WAF configuration, the ALB has inherent security features that can block traffic it perceives as potentially abusive. This would explain why you're seeing 4XX errors in CloudWatch metrics for both the ELB and targets.

To address this issue, you could try:

1. Gradually increasing the request rate from these clients rather than sending many requests at once
2. Distributing requests across multiple source IP addresses if possible
3. Monitoring ELB metrics like RequestCount and HTTPCode_ELB_4XX_Count to gain insights
4. Ensuring your backend EC2 instances can handle the load efficiently

If the issue persists, it might be worth contacting AWS Support as they could provide more specific guidance or adjust certain limits on your account. The fact that browsers and PowerShell work fine from the same VPS suggests there might be something specific about how the MetaTrader 5 client is formatting or sending its requests that triggers the ALB's protective mechanisms.
Sources
ELB returns 4xx when I run too many automated tests | AWS re:Post

Hello.

CloudWatch Metrics: Shows both ELB and Target 4XX errors

If you can see the "Target 4XX" metric, it means that the request is being made to the ALB target.
Therefore, I think it is necessary to check the application logs of the target instance to see the difference between requests that result in a 403 error and successful requests.