Connections time out of a client request to a Network Load Balancer


I connected two AWS Accounts with a peering connection. All subnets on each side are allowed to talk with each other. If I try to communicate between the two sides with the IPs of the instances it works fine. I added a NLB on one side to avoid IPs and use a DNS name as a host. The ECS service registers the IP automatically to the NLB target group to achieve the goal. The client on one side tries to make a request through the NLB to the same target as before. The NLB is configured as internal and assigned to 3 AZ, the target group contains the IP of the target I want to reach. Each AZ contains a subnet with its own small range of IPs(1.0.x.0/20) but all the CIDR used for the rules are using the broader IP range( to cover them all. There are no overlappings between any IP ranges on both Accounts. The NLB has 3 private IPs(one for each AZ) registered on its DNS entry. I can do the request to the IP behind the NLB with success and the request to the NLB IP which is associated with the AZ on which the target IP is located. The request to the two other IPs of the NLB results in a timeout. There's one ACL for the whole Account which allows all traffic, the default security group allows the traffic of the CIDR of both Accounts and the routing tables contains an entry to route the traffic to the peering connection for the CIDR of the other side and one route for the local CIDR to "local".

I also tried the Reachability Analyzer with the peer connection as sender and the NLB as a receiver and specify the IP of the target in the target group. This test succeeds because it uses the one NIC which is in the same AZ. I tried to use the peer connection as sender and the other two NICs of the NLB and set the IP of the target which fails with NO_PATH.

To me, it looks like the NLB doesn't route the request to the other NIC. But I couldn't find any limitations to this kind of setup on the documentation.

1 Answer

Did you enabled Cross-zone load balancing option for NLB? Or, is the target group located in all AZ which your NLB is located.

profile picture
answered 2 years ago
  • Cross-zone load balancing is disabled. For test purpose I enabled it once to be sure the documentation isn't misleading but it didn't change anything. The target group is assigned to the same vpc and it contains only one target which is in one of the 3 AZ assigned to the NLB.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions