1 Answer
- Newest
- Most votes
- Most comments
0
On your target group disable the setting to preserve client IP. All future packets are sourced from the NLB so return traffic will be via the NLB.
I believe this may get you result you’re looking for.
Relevant content
- asked 5 months ago
- Accepted Answer
asked 4 years ago - asked 7 months ago
AWS OFFICIALUpdated 10 months ago- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 2 years ago
We want to use client-ip for this UDP use case. Moreover, client ip preservation cannot be disabled for UDP packets for Network load balancer.
From https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#client-ip-preservation :
"By default, client IP preservation is enabled (and can't be disabled) for instance and IP type target groups with UDP and TCP_UDP protocols."
Yes that is correct. I miss read the type. Hmm You need the return packets to be sourced from the NLB still? The only way I’ve done this in the past was with F5s on prem with return packets flow around the load balancer and layer 2 arping with loop backs on the target NICS.
You need some kind of source NAT firewall.
Actually return packet works fine, if it is sent back immediately. But if it is sent after sometime, it does not go via NLB, it source ip/port shows up as ec2 instance ip/port at peer, which I do not want !!