NLB
5 posts tagged NLB.
Dual-stack on a Network Load Balancer is a listener rule, not a checkbox
Flip an NLB to dualstack and IPv6 clients connect, but every one of them reaches an IPv4 target as the load balancer's own address, because translated traffic is never source-preserved. The fix is a listener rule that routes by address family to an IPv6 target group, and it brings four requirements the checkbox never mentioned, one of which makes a UDP service fail to build at all.
Networking7 minPrivateLink traffic always arrives from the load balancer, whatever you configure
Client IP preservation has no effect on inbound PrivateLink traffic. If you turn it on and write client-IP security group rules, direct clients work and every PrivateLink consumer breaks — which is a difficult failure to see from the provider side.
Networking7 minProxy protocol is sent on health checks, where it carries nothing useful
Enable it on an NLB target group and the header is prepended to health check connections too. On those connections it contains no client information at all, so the feature adds nothing there and still marks every target unhealthy.
Networking5 min"The ephemeral port range" means four different things
Network ACLs get written with 32768-65535 because that is the number everyone knows. It is nobody's actual range — it is AWS's example. A NAT Gateway uses 1024-65535, and the gap between the two is an intermittent failure that retries hide for weeks.
Networking6 minWhen the AWS docs contradict themselves: NLB client IP preservation
Two pages in the same Network Load Balancer user guide state opposite defaults for client IP preservation. The disagreement decides which security group rules are correct, and getting it wrong produces a target that passes health checks and refuses every client.
Networking6 min