I have an internal AWS ALB behind an NLB which has static ips. Then I have a Sucuri WAF infront of the NLB. My concern is a WAF bypass. What do you think is the best way to whitelist so that the aws load balancers only takes traffic from the sucuri waf? My ec2s are running on nginx. Looks like NLB does not have a security group and nginx may not see the real ip of the user. Any thoughts?

Edit: I need static ips thats why I have an NLB with elastic ips. I also need the features of ALB thats why I have both. I can roll out my own nginx load balancers but I'd like less problem and I need it for some other AWS features.

  • With NLB, the security group of the instances is used for access control. That's why the NLB itself has no security group. To help clarify: Where is this WAF located, logically and physically? Also, is the ALB directly behind the NLB with no instances in between? If so, your configuration may eventually fail if the ALB needs to scale up or down or in or out. – Michael - sqlbot May 26 '18 at 14:47
  • From the route53, the A records are pointed to the sucury ip. The sucury then talks to the NLB. Yes, ALB is directly behind the NLB. I have a cloudwatch event that runs to get the ips of the ALB and tell the target group of the NLB. – tungsten_carbide May 26 '18 at 14:55
  • Okay, good, so it sounds like you have the ALB ENI issue under control. The Sucuri WAF is outside AWS then, connecting to the NLB via the Internet? Yes, I see the problem, here. Since the NLB target group is connecting to addresses, not instances, you lose the ability to use security groups on the ALB, because the source address is always the NLB address. Can the Sucuri not use a hostname instead of static IPs to connect to the backend? Or is there some other reason for static IPs via NLB? – Michael - sqlbot May 26 '18 at 15:55
  • Yes, that's right. Sucuri is outside of AWS and it talks to the NLB via internet. It's requires static ips. Looks like my biggest chance then is some nginx config. Maybe real ip or something. Thanks for all the aws info. Im not much of a network guy. – tungsten_carbide May 26 '18 at 16:04

Why do you have both an NLB and an ALB?


AWS Application Load Balancer has security groups (documentation link). You can use that to limit which IPs traffic can from from. That relies on NLB not messing with that information.


The AWS Network Load Balancer works at Layer 4, and according to Wikipedia "Class 4 is closest to TCP". I wonder if NLB doesn't change the source IP - hopefully someone else who's more familiar with this can answer / comment, it's been a long time since I learned the OSI model. If so this would work well with the ALB security groups.


Another approach is that Securi most likely sets the X-Forwarded-For header. In Nginx you can use the "real_ip_header" command to say "for the IPa addresses I specify (ie that belong to Securi) the original IP address is in this header". eg:

set_real_ip_from  2001:0db8::/32;
real_ip_header    X-Forwarded-For;
real_ip_recursive on;

To be careful of is that the AWS ALB might also set that header, hiding what Securi sets.

Nginx Allow / Deny

Once that's done you have another method using Nginx that lets you block all hosts other than those you allow.

allow;   # Allow a single remote host
deny all;        # Deny everyone else


If you can simplify your architecture you can probably find a simpler solution.

  • Thanks for the advice. I need a static ip thats why the NLB is there. – tungsten_carbide May 26 '18 at 12:58
  • 2
    NLB is not implemented by hidden managed EC2 instances, like ALB or ELB Classic are -- it's network magic, essentially a dynamic bidrectional address translation table. In a standard configuration, the source address is preserved and seen by the instances. In more exotic configs, such as VPC PrivateLink or using NLB to balance things that aren't instances, the source IP is the balancer IP, but the real source can be identified by enabling Proxy Protocol V2, which injects client identity in a non-proprietary binary format into the fist TCP packet before the payload is cut through. – Michael - sqlbot May 26 '18 at 14:42
  • Michael, thanks as always for the useful information. I assumed NLB was a hardware load balancer or similar. How would TC ensure NLB is in standard mode rather than using an "exotic config"? Sounds like it'll be automatic with this setup. – Tim May 26 '18 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.