Network load balancer can't put it private

Question

Hello,

I am using a network load balancer (NLB) and I have an issue. I would like my NLB to be accessible only by my EC2 instances within my VPC. The problem is that I can access the NLB by setting 0.0.0.0/0 in my security group. If I do that, my NLB is visible to the public, which I do not want.

How can I resolve this problem?

Thank you

Leo K · Accepted Answer

It'd be best that you recreate your NLB, place it in a private subnet, and set the NLB's type as "internal" instead of "internet-facing". In addition to preventing connections from the outside, it'll save a bit of money in not allocating public IPv4 addresses for your NLB.

Additionally, in the security group you attach to the NLB, you should only permit inbound traffic from the CIDR (IP address block) of your VPC. You can see the CIDR, such as 10.123.0.0/22), in the VPC console, in the properties of your VPC. Allowing inbound traffic only from the VPC's CIDR will be effective in blocking traffic from elsewhere, regardless of whether the NLB has public IPs or not.

Alex · Answer

Thanks @Leo K & @Didier Durand.

We can close this topic

Didier_Durand · Answer

Hi,

You can assign a sec group to the NLB itself: https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-security-groups.html

If you create one, you can use it to limit access to only machines on your VPC.

Best,

Didier

Network load balancer can't put it private

Relevant content