Setting up DNS routing to a network ELB

Question

I have been trying to set up a network ELB on AWS so that traffic arriving on the configured elastic I.P gets forwarded to a healthy instance on the TCP port it is directed at. So incoming traffic for port 80 gets forwarded to a healthy instance on port 80, and incoming traffic for port 443 gets forwarded to a health instance on port 443.

From trying to configure this it seems to want an elastic I.P address per port. This makes no sense, I am able to do this on internal infrastructure with Pacemaker and on Google Cloud, I could do this 4 years ago. Am I missing something?

What I ultimately want is handle HTTP and HTTPS traffic and to terminate SSL with my services to an application level ELB will not do. I then want DNS traffic arriving at a configured elastic I.P to get to a healthy node. A super common use case, but can't manage to see how it will work with AWS network load balancers.

Answer 1

If I'm understanding you correctly, the main reason that you want use an nlb is so you can terminate ssl at the application and not the lb? Is there a reason that you need to use an elastic ip?

First paragraph:

You'll set up listeners on the lb for both port 80 and port 443. The elastic ip address is assigned to each AZ, so you'll have one eip for us-west-2a and one eip for us-west-2b, for example. Then you'll set up a target group for each port. You'll have one target group for port 80 and one target group for 443. The target group will contain the same instances, but they will be for different ports.

Second paragraph: You should have one eip per AZ, not per port.

Third paragraph: Each eip is assigned to one AZ, so if you specify the eip in your dns config, then it will route to the servers in the target group for that AZ. Unless there is a reason that you need to hard code the ip address in the dns record, then I'd just point your dns entry to the A record that AWS gives you for the elb.

The main reason that I would use elastic IPs for each AZ is so I can be sure of the ip addresses behind the A record. In the case that a customer has to white list those ip addresses, for example.