I have 3 subnets setup in a Amazon VPC: public, private application, private database. My web servers are currently in the private application subnet and use a NAT Instance to see the internet.

I need to setup a Win 2012 mail server that will also be used for Jabber and other services. I was hoping to use the same setup as the application servers so that any websites on the mail server will use a Elastic Load Balancer to add a public address and then I was thinking to add a ENI with public address for the mail IP and a 2nd address for Jabber.

I wanted to keep it more secure by placing it in the private subnet, but if the general rule is to put them in public subnets, then I will consider that.


ELB is good at HTTP and HTTPS, but can be problematic for other protocols..... for complete control over your load balancing / perimeter security, use an haproxy box with a public elastic ip, in combination with ec2 vpc security group rules and host based iptables

  • So I would put a HAProxy box in the public subnet of each of my zones and then I could put all my instances in private subnets? – Developr Nov 21 '13 at 13:22
  • @Developr thats how i do it :D – nandoP Nov 21 '13 at 14:40
  • How do you handle high availability with the HaProxy instance? Ideally I would want to have one of them in each zone, but I am not sure how to achieve a proper failover solution. – Developr Nov 21 '13 at 20:10
  • you would want at least two hap's in each zone.... so if your elb has four zones, thats 8 hap's – nandoP Nov 21 '13 at 21:31
  • Why 2 in each zone? Is it because I cannot remap IPs between zones/subnets? How do I setup the HA between zones? Do I have to use Route53 active/passive load balancing? – Developr Nov 22 '13 at 13:57

The "general" rule is to a a three-tier-architecture.

This is typically suited for web-servers with dynamic content and a database backend.

  1. First Tier: Frontend - Webserver - in your case - public IP

  2. Second Tier: This is where the work gets done - Application-Server - in your case: e-Mailserver

  3. Third Tier: Database - in your case propable storage groups for the mailserver.

In your case the frist tier can contain a load-balancer, a web-application-firewall or just a dedicated firewall.

  • Yes, I have 3 tiers... My web servers are in a private subnet with ELB in front. I am trying to figure out how to get a public IP (non- elb) to point to my mail server in a private subnet. I think I should be able to do this using ENI with EIP, but it is not working. – Developr Nov 21 '13 at 13:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.