Join Log in
Score:0
explogx avatar Server

AWS client IP preservation with NLB

cn flag
explogx

On AWS, when you create a NLB, you have the possibility to specify the instance ID instead of the instance IP address. This causes the NLB to preserve the client IP.

However, if I configure the NLB to target instances in a private subnet where the route table includes a default route to a NAT gateway, how can the response be routed back via the NLB interface and not the NAT gateway?

Consider the following:

  • A VPC with a CIDR block of 10.0.0.0/16;
  • A public subnet with a CIDR block of 10.0.3.0/24;
  • A private subnet with a CIDR block of 10.0.6.0/24.

The public subnet has a default route to the internet gateway and the private subnet has a default route to the NAT gateway. The NAT gateway has an interface with private IP 10.0.3.12 and the NLB has an interface with private IP 10.0.3.18.

An EC2 instance with IP 10.0.6.4 is deployed in the private subnet and is part of the NLB target group. The instance has a default route to the VPC router at 10.0.6.1 inside the OS routing table.

Let's say that a packet with client IP 22.128.22.136 is forwarded to the EC2 instance, how the EC2 instance will manage to send the packet back to 10.0.3.18 and not to the NAT gateway. The private subnet routing table has a default route to 10.0.3.12.

I presume that AWS immediately "injects" a route to the NLB for any client IP when a packet arrives on the NLB interface. I would like to know more about the internals.

diagram

With tcpdump on the EC2 instance, I can see the client IP being preserved:

$ sudo tcpdump -n -i eth0 host 22.128.22.136 port 80
404
0 + 0
Tim avatar
gp flag
Tim
You only see the VPC level traffic, this is likely done at the AWS hyperplane level which encapsulates that traffic. I think this is the video that covers AWS Hyperplane, but if not search around a bit https://www.youtube.com/watch?v=8gc2DgBqo9U
1
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.