NLB
4 posts tagged NLB.
PrivateLink traffic always arrives from the load balancer, whatever you configure
Client IP preservation has no effect on inbound PrivateLink traffic. If you turn it on and write client-IP security group rules, direct clients work and every PrivateLink consumer breaks — which is a difficult failure to see from the provider side.
Networking7 minProxy protocol is sent on health checks, where it carries nothing useful
Enable it on an NLB target group and the header is prepended to health check connections too. On those connections it contains no client information at all, so the feature adds nothing there and still marks every target unhealthy.
Networking5 min"The ephemeral port range" means four different things
Network ACLs get written with 32768-65535 because that is the number everyone knows. It is nobody's actual range — it is AWS's example. A NAT Gateway uses 1024-65535, and the gap between the two is an intermittent failure that retries hide for weeks.
Networking6 minWhen the AWS docs contradict themselves: NLB client IP preservation
Two pages in the same Network Load Balancer user guide state opposite defaults for client IP preservation. The disagreement decides which security group rules are correct, and getting it wrong produces a target that passes health checks and refuses every client.
Networking6 min