Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're migrating our deployment from regular EC2 into a VPC, we have two load balancers in the public cloud that we have a number of domain "A" records pointed at, however I didn't realize that a public Elastic IP could not be attached to a VPC instance, you must use VPC based Elastic IP's.

So you're aware, our LB's are HAProxy based instances, NOT Elastic Load Balancers. So we've got Apache to work with here if that helps answer my question or offers an alternative.

Because not all of the domains in question pointing at the public LB's are under my control, it's very difficult to schedule the change to DNS with everyone, lets call it impossible.

So my question is, is it possible that I can redirect calls to our public LB's to their replacements in the VPC? This would have to be transparent while we go through our clients and have them update their DNS.

Any suggestions would be greatly appreciated!

EDIT: To expand just a little, it would be a benefit if I could do this simply using EC2 features so I don't have to keep the two public LB instances running. Failing that, I need to know specifically how to accomplish the "redirect", is it done in DNS, or is it done somewhere else?

EDIT 2: Nobody was able to offer any insights into an Amazon specific resolution that didn't require the LB instances to remain up, so I've outlined what we did with HAProxy in the selected answer below.

share|improve this question

You could redirect requests to your regular EC2 load balancers to your VPC load balancers. That's an extra hop for everyone who hasn't updated their DNS, but it's only temporary and good motivation for your clients to update ASAP.

share|improve this answer
I appreciate your answer, but you've just suggested doing what I was asking how to do ;) Could you expand upon how I might accomplish that? – oucil Aug 28 '13 at 21:55
Reconfigure HAProxy? (It is almost trivial, it will take 5 mins of googling even if you've never messed with haproxy before) – Dusan Bajic Aug 29 '13 at 5:04
@dusan.bajic I get the concept, it's why I mentioned it in my question, but my hope is that people that have done this before would have insights into things you should/shouldn't do, pitfalls, things to watch out for etc. These questions become guides for others experiencing the same problem, so the solution "google it" doesn't really help anyone. I'll update my question with it, but it also means that I'm less likely to award anyone credit for it. – oucil Aug 29 '13 at 13:12
up vote 1 down vote accepted

Since noone was able to provide the specifics, here's what we did:

First, we're a RightScale client so if you are too, you need to turn off the reconverge script which runs every 15 min or so using their provided operational script. This will prevent the script from overwriting your changes when it doesn't find any active app servers and removes any references.

Next, in /etc/haproxy we updated the haproxy.cfg backend section, the final line of what looks to be the default stuff is:

 # Special server line that allow HAProxy to start with cookies enabled and no valid servers.
    server disabled-server disabled

So just below that where the app servers would be defined we included:

server THE-INSTANCE-REF_ID check inter 3000 rise 2 fall 3 maxconn 500

We have two LB's so we just pointed one old to one new, respectively. Everything is working like a charm. We'll leave these two old LB's up for a couple weeks while our clients update their DNS and then bring them down afterwards, saved a lot of headache rather than trying to organize everyone's IT into a scheduled move!

share|improve this answer

If you're trying to keep the local dns information hidden, I suggest your best bet is either:

a) Stand up an internal DNS server, properly firewalled to only serve DNS requests within your system.

b) Automate management of individual /etc/hosts files (Chef, Puppet, CFEngine, Ansible, etc etc.)

If you're not concerned with revealing the DNS information via public query, why not simply use the CNAME information in your external DNS provider (Or AWS's Route53) i.e.: =>

share|improve this answer
This is only going to be a short period where I want the overlap in place, both A and B seem like a bit of overkill. I'm not concerned with exposing anything as the only thing we're talking about here are publicly visible Load Balancers, the application servers are all on a private subnet in the VPC and so out of the public purview. An LB just passes through a request to an app server so couldn't I just pass the request through to another LB address instead? I'm sure it's possible, but how is the question? Thanks for your suggestions btw! – oucil Aug 28 '13 at 22:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.