To allow access from the server behind alb, which address should I enter, alb or server?

I created a server behind alb. You are trying to connect from that server to another server that is not connected to alb.

I am not sure whether to put the alb ip or the server ip to set the security group of the server not connected to alb, so I put both.

In the case of alb, I know that all server communication is done through alb, so I think alb alone is fine, but I think I need to write the destination, so I think I need to put the server ip as well.

I wonder if it is enough to set the security group with only one alb address or both.