2

Currently we are passing our requests through an AWS Network Load Balancer and then onto an AWS Application Load Balancer. However, we are trying to preserve the original IP address of the request, but this is being stripped out. We are attempting to enable Proxy Protocol v2, but this causes error. Does the AWS ALB speak proxy protocol v2?

2 Answers 2

2

Does the AWS ALB speak proxy protocol v2?

No it does not. The proxy protocol is for NLB and CLB only as they operate (CLB has TCP listeners) in layer 4. ALB is layer 7 and it uses X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Port to preserve IP source information.

8
  • Thanks for the answer! So if I forward traffic from my NLB then my ALB and into my application, how can I preserve the IP source information?
    – devops54
    Oct 21, 2020 at 15:20
  • @devops54 If you don't want to use the headers I listed in my answer, then I don't think there is any other way with ALB.
    – Marcin
    Oct 21, 2020 at 21:27
  • Sorry, I didn't mean to say that the headers are bad. Rather, how to I get the headers to propagate from Client-> NLB -> ALB ? How can I get the NLB to pass on the IP which will then be in the X-Forwarded-For header?
    – devops54
    Oct 21, 2020 at 22:22
  • @devops54 You shouldn't be doing anything. ALB adds them. Have you tried?
    – Marcin
    Oct 21, 2020 at 22:25
  • Yes, an internal 10.x is coming through from the NLB instead of the actual IP address
    – devops54
    Oct 21, 2020 at 23:34
2

From this document it looks like you do it on the Target Groups: https://docs.amazonaws.cn/en_us/elasticloadbalancing/latest/network/elb-ng.pdf

Specifically: To enable proxy protocol v2 using the new console

  1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.
  2. On the navigation pane, under LOAD BALANCING, choose Target Groups.
  3. Choose the name the target group to open its details page.
  4. On the Group details page, in the Attributes section, choose Edit.
  5. On the Edit attributes page, select Proxy protocol v2.
  6. Choose Save changes.

Or even by script (taken from https://docs.cloudbees.com/docs/cloudbees-ci/latest/eks-install-guide/eks-prerequisites-helm-install) , e.g.:

#!/bin/bash -eu
export AWS_PAGER=""
hostname=$(kubectl get -n ingress-nginx services ingress-nginx-controller --output jsonpath='{.status.loadBalancer.ingress[0].hostname}')
loadBalancerArn=$(aws elbv2 describe-load-balancers  --query "LoadBalancers[?DNSName==\`$hostname\`].LoadBalancerArn"  --output text)
targetGroupsArn=$(aws elbv2 describe-target-groups --load-balancer-arn $loadBalancerArn --query TargetGroups[\*].TargetGroupArn --output text)
for targetGroupArn in $targetGroupsArn; do
  aws elbv2 modify-target-group-attributes --target-group-arn $targetGroupArn --attributes Key=proxy_protocol_v2.enabled,Value=true --output text
done
1
  • the question is not how to enable, the question is why the ALB is breaking the traffic flow when the NLB is configured for proxy protocol v2. namely, the NLB is not set to preserve client IP address (because they are targeting the ALB by IP, because most likely in a different VPC)
    – Craig B
    Sep 28, 2021 at 2:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.