Why can an instance in a target group not reach itself via NLB?

0

I have set up an NLB with a target group that contains one EC2 instance (referenced via instance ID). In the same subnet I have deployed a second instance. The NLB listens on port 80 and I can connect from instance A to instance B on port 80 via the DNS name of the NLB.

But I CANNOT connect to instance B on port 80 from instance B itself!? DNS resolution works fine (i.e., the HTTP client tries to connect to the IP of the NLB) but the request times out.

In short: wget <dns-name-of-NLB> will work on instance A but will time out on instance B.

Is this some VPC networking magic or am I missing something? Or both?

AWS
已提问 4 年前3779 查看次数
1 回答
-1
已接受的回答

I assume you have an internal load balancer with targets registered by instance ID. This is because of hair pinning / loop back issues. Internal network load balancers do not support hairpinning or loopback. When you register targets by instance ID, the source IP addresses of clients are preserved. If an instance is a client of an internal load balancer that it's registered with by instance ID, the connection succeeds only if the request is routed to a different instance. Otherwise, the source and destination IP addresses are the same and the connection times out.

Network Load Balancers preserve the source IP, so both the source and destination of the arriving packet are the private IP address of the target. Then, the host operating system sees the packet as invalid and fails to send response traffic, which causes the connection to fail. To correct this type of Network Load Balancer connection failure, use an IP target type. With an IP target type, the target sees the IP address of the Network Load Balancer. Because the source and destination are unique, the connection succeeds.

To summarize, if you have the requirement of accessing same target through NLB, use IP based target group.

Additional details are here - https://aws.amazon.com/premiumsupport/knowledge-center/target-connection-fails-load-balancer/ , https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-troubleshooting.html#loopback-timeout

AWS
已回答 4 年前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则