1

I am using Google Cloud load balancer for balancing internal servers and blocking outside access via firewall rules as specified in the official docs.

I am just curious from a network performance standpoint, will the packets really leave the google network and back in? Or is it optimized because via DNS resolution Google servers can detect this is a Google IP and the route optimized. And traceroute command does show just one hop. But wanted to get some additional opinion on this. As if the 1 hop case is true, we really don't need an internal only load balancer from google. This setup at least for me, is just fine and sails the boat.

PS. (Some background: google currently does not offer load balancing capabilities for internal traffic. Its frontend IP is always currently an external IP address.)

Cheers.

V

1

The destination IP address is examined against the subnetwork's IP address range, which every instance knows.

  1. If the IP address is outside the network:

a. The instance sends the packet to the subnetwork's gateway MAC address with the destination set to the packet's final destination. The instance might need to make an ARP request to resolve the gateway's MAC address.

b. The network rewrites the IP header to declare the instance's external IP address as the source. If the instance has no external IP address, the call is not allowed, and the network drops the packet without informing the sender.

c. The network records the outgoing packet and adds the source and destination to the active connections table.

d. The network sends the packet on to its destination.

e. The destination gets the packet and responds if it chooses.

f. The network receives the response, consults the active connections table, notes that this is an active connection, and allows it. The network consults its network/external IP lookup table and replaces the instance's external IP address with the matching network address and sends the packet to the source instance.

g. The instance receives the packet.

  1. If the destination IP address is within the network:

a. The instance is configured with an IP with 255.255.255.255 mask, so the instance sends the packet to the subnetwork's gateway MAC address. The instance first might need to make an ARP request to resolve the gateway's MAC address.

b. The network, using Proxy ARP, responds with the MAC address of the destination instance.

c. The gateway receives the packet and routes the packet to the destination IP within the network.

d. The target instance receives the packet. The target instance checks ingress firewall to determine if the packet is allowed. If not, the packet is dropped silently. Otherwise, the instance processes the packet.

You can have more information about this matter in this Help Center article.

In addition, you can have more information about using Internal Load balancing using HAProxy on GCE in this help center article, as the L7 and L4 load balancers provided by Google don't support internal Load balancing as of yet.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.