0

I have a web-application that contains events that I'm interested in reading from the internet.

To do this, I have an AWS EC2 load balancer that sits in front of two EC2 instances. I have an application that tracks events on both of these servers.

The setup can be visualized like this: Instance 1 and 2 -> Load Balancer -> Event Monitor

The problem I'm seeing is that each event appears to be coming from the load balancer IP and not from the EC2 instance IP. I'm convinced that when the load balancer forwards traffic, it puts its IP on the packet.

Is there a setting in AWS on the load balancer that I can change to forward packets with the actual IP address instead of the load balancer IP?

  • 1
    You really need to expand on exactly what you're trying to achieve if you want any real help. Don't tell us how you're trying to do something, give us the big picture of what you're trying to achieve. Please edit your question. ELB does add a header which tells you the source of the request docs.aws.amazon.com/elasticloadbalancing/latest/classic/… – Tim Sep 2 '16 at 21:02
  • Thank you for the link, it's helpful, I've added a preface of what I'm trying to achieve. Unfortunately I can't explain more because of the need to protect sensitive information about the setup. – Jason D Sep 2 '16 at 21:14
4

The problem I'm seeing is that each event appears to be coming from the load balancer IP and not from the EC2 instance IP. I'm convinced that when the load balancer forwards traffic, it puts its IP on the packet.

You're convinced of this because yes, that is precisely how load balancers are designed to work.

Is there a setting in AWS on the load balancer that I can change to forward packets with the actual IP address instead of the load balancers IP?

Think that through for a minute. Sure, an LB could theoretically change the IP headers so that the source IP matches the backend server. There are several problems with this, though:

  1. Your backend servers have private IPs. Which your clients aren't going to be able to hit.
  2. When your clients hit your ELB, they first have to stand up a TCP connection before any HTTP can happen. So they have a TCP connection with the ELB, not with the backend server. Therefore when the client sees a packet with a source IP that doesn't match a current connection, it's going to discard it.
  3. You likely don't want to do this anyway, as backend instances change frequently and your clients shouldn't need to worry about that, nor should they be able to discover your private infrastructure.

Why do you want this anyway? If you really want your clients to be able to discover this information, you can possibly put the private IP into an HTTP response header, which your client has access to.

  • Thanks, the reason I'm trying to do this is to monitor which of the two servers the events came from. The clients are restricted, so only certain users over the internet would ever be able to get these events. However, I like your idea about the HTTP response header holding the private IP, I may use that instead. Thank you. – Jason D Sep 2 '16 at 20:59
  • Yep, then just stick the server ID into a header of some sort. – EEAA Sep 2 '16 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.