To allow access from the server behind alb, which address should I enter, alb or server?

Question

I created a server behind alb.
You are trying to connect from that server to another server that is not connected to alb.

I am not sure whether to put the alb ip or the server ip to set the security group of the server not connected to alb, so I put both.

In the case of alb, I know that all server communication is done through alb, so I think alb alone is fine, but I think I need to write the destination, so I think I need to put the server ip as well.

I wonder if it is enough to set the security group with only one alb address or both.

Accepted Answer

If the traffic is **initiated** from the server then it will come from the server IP address and it won't go through the ALB. Traffic that comes from the server but is in response to a session that was initiated from the ALB (in turn, which came from something external) will return through the ALB.

To allow access from the server behind alb, which address should I enter, alb or server?

Relevant questions