- Newest
- Most votes
- Most comments
No.
The actual layer3 source IP of the traffic reaching the target will be the NLB ENI not the client, so you will not be able to block the traffic on your target using security group.
With proxy protocol the original client IP is sent at the beginning of the TCP payload.
But why not filter the traffic on the inbound rules of the security group attached to the NLB itself? the NLB does see the original client IP and it will be better to block the traffic earlier in the flow.
When using AWS Network Load Balancer (NLB), it's important to note a key limitation: Once you create an NLB without associating a security group, you cannot associate one later. For more details, check the AWS documentation here.
To allow Client IP traffic to the NLB SG association, you need to enable Client IP Preservation. This feature is required for associating security groups with the NLB. Instructions on how to enable this can be found here.
Alternatively, you can achieve similar results by configuring Network Access Control Lists (NACLs). This involves adding NACL rules to allow the client IP addresses into the subnets of your NLB. This method gives you an alternative to manage traffic control.
answered 2 years ago
Relevant content
asked 8 months ago
Thanks. As i mention, NLB was deployed with no SG and now, we don't see option to attach it. Might be some limitation. i am not 100% sure.
But back to my original question. Is it possible for you to share some ref doc of what you stated about The actual layer3 source IP of the traffic reaching the target will be the NLB ENI not the client, so you will not be able to block the traffic on your target using security group. With proxy protocol the original client IP is sent at the beginning of the TCP payload.******
1 - If We can not use SG to block the client IP on target SG, what's the use case of proxy protocol v2 ? Is it just to see client IP in application log ?
2 - Do we have other option to achieve this ?
As mentioned in the other answer - you cannot associate a SG after the NLB was created.
Are your NLB VPC and target VPC peered with VPC peering and are in the same region? if that is the case client IP can be preserved if you enable it and you do not need to use proxy protocol. so you will be able to use SG on your targets.
If this is not the case then client IP cannot be preserved and you need to use proxy protocol instead. SG on the targets cannot be used since source IP will be the NLB. You need your application to be aware of proxy protocol to be able to parse it (see nginx documentation for example) and you will need to block/allow traffic on your server application.
above is valid for Instance and IP target both, right ?
Valid for IP target type only.
Instance target type cannot be used when the NLB and the target are not within the same VPC. from the docs:
Thanks. I really appreciate your support