0

Looking at using NLB to load balance two L3 transparent appliances, both of which listen on port 8181. But traffic hitting those appliances have arbitrary destination IP's. When I created the NLB, its eni has source/dest IP checking disabled by default. I am guessing NLB then won't care if incoming traffic has different destination IP's to its own. But it hasn't worked, so I don't know if it is my configuration or NLB won't support this.

As a side note, you can push arbitrary traffic to the NLB by using a route, with the target being the NLB eni.

1 Answer 1

1

"you can push arbitrary traffic to the NLB by using a route, with the target being the NLB eni."

Or, at least, you can configure it in such a way that this appears to be what would happen... but I suspect that this is a quirk of the rules that allow you to do this for NAT Gateways, NAT Instances, and EC2 VPN hosts with src/dest check disabled.

I have a difficult time imagining that NLB can actually do this, since the logical "device" connected to that ENI is not expecting what is, technically, misrouted traffic. The traffic is most likely dropped.

The source/dest check being disabled is probably an artifact of the way NLB hairpins traffic back into the network. Fire up some wireshark -- it's bizarre to behold.

Incoming traffic at the instance has a source MAC address of the NLB ENI, destination MAC of the instance, of course... but replies have the destination MAC of the default router of the subnet.

NLB actually hijacks routes in the VPC network for each flow it establishes, allowing the host instance to send reply traffic back to the "real" source of the connection, using the default gateway, which of course does not actually route the response back to the source using the route table but instead sends it back to the NLB (logically, anyway -- you can't sniff this part) so that the instance's IP can be NAT-ed away and the ENI IP NAT-ed back on, then as the traffic leaves the VPC, the Internet Gateway translates the ENi private IP back to the public IP... conceptually, anyway, because it's all smoke and mirrors on the VPC network. Early test revealed that it didn't even matter if the subnet's default route target was nonsensical -- as long as it had something as a default route, NLB is integrated into the VPC network fabric in such a way that the traffic still went back to the source as expected.

NLB is, at some level, a dynamic double-ended NAT mechanism, deeply embedded in the network, translating traffic from the ENI address to the instance address and back. It would make sense, in that light, that traffic addressed to anything other than the ENI address would be dropped, because trying to double-NAT traffic bound for random source addresses seems beyond the design scope, if not impossible.

But, for more authoritative answer, I suspect you'll need to engage AWS Support.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .