NLB preserving client IP addresses in combination with NACL having source CIDR constraint

0

I have a VPC with two subnets, each subnet containing an EC2 instance accessible via port 80. There is a NACL associated with both subnets restricting inbound traffic to a certain source CIDR outside of AWS. An internet-facing NLB is configured to route traffic to the instances via instance id.

If "preserve client ip addresses" is disabled, everything works fine, requests originating from the correct CIDR are reaching port 80. But if it is enabled, my requests are timing out.

A solution is to add a rule to the NACL allowing inbound traffic from the VPC itself. This is in line with what the documentation says. But I don't understand why this is required only when preserving client ip addresses. It is preserving the source ip address, it should be covered by the original NACL.

I guess the answer is something like "... because Hyperplane", but I would like to have a deeper understanding.

randy
已提問 2 年前檢視次數 395 次
2 個答案
0

Does a security group associated with the EC2 instances permit traffic from the external source CIDR?

If the instance security group rules permit access from the VPC CIDR but not the external source CIDR, requests will succeed when client IP preservation is disabled (because the instances see requests coming from the NLB) and fail when client IP preservation is enabled (because the instances see requests coming from the external source CIDR).

AWS
MikeJ
已回答 2 年前
0

The security group associated with the instances is allowing port 80 from 0.0.0.0/0. I am even able to bypass the LB and talk to the instances directly from the external source CIDR.

randy
已回答 2 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南