Client IP preservation for dual-stack NLB

Based on the current capabilities of AWS Network Load Balancer (NLB), the scenario you're describing with full dual-stack support and client IP preservation for both IPv4 and IPv6 clients is not currently possible in a single configuration.

Here's a breakdown of the current limitations:

1. While you can create a dual-stack public NLB, the target groups can only be either IPv4 OR IPv6, not both simultaneously.

2. Client IP preservation can be enabled for a target group, but it will only work for the IP version that matches the target group's IP type.

3. When you enable client IP preservation for a TCP listener on an NLB, it will only preserve the client IP for the IP version that matches the target group's IP type.

4. For traffic that is converted from IPv6 to IPv4 (or vice versa), the source IP will always be the private IP address of the Network Load Balancer, not the original client IP.

Given these limitations, you cannot achieve full client IP preservation for both IPv4 and IPv6 clients with a single dual-stack configuration as you've described.

To get close to your desired setup, you might need to consider using separate NLBs or target groups for IPv4 and IPv6 traffic, each with its own client IP preservation settings. However, this would not be a single, unified dual-stack solution as you've envisioned.

It's worth noting that AWS regularly updates and improves its services, so it's possible that full dual-stack support with client IP preservation for both IPv4 and IPv6 may be introduced in the future. For now, you'll need to work within the current limitations of the NLB service.
Sources
Edit target group attributes for your Network Load Balancer - Elastic Load Balancing
Requirements for endpoints with client IP address preservation - AWS Global Accelerator