How do I use proxy protocol version 2 to get client's real IP address with AWS Network Load Balancer?

user_2403724 0
Viewed 4149

Currently we are passing our requests through an AWS Network Load Balancer and then onto an AWS Application Load Balancer. However, we are trying to preserve the original IP address of the request, but this is being stripped out. We are attempting to enable Proxy Protocol v2, but this causes error. Does the AWS ALB speak proxy protocol v2?

amazon-web-services amazon-ec2 load-balancing load
2 Answers
user_2488230

From this document it looks like you do it on the Target Groups: https://docs.amazonaws.cn/en_us/elasticloadbalancing/latest/network/elb-ng.pdf

Specifically: To enable proxy protocol v2 using the new console

  1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.
  2. On the navigation pane, under LOAD BALANCING, choose Target Groups.
  3. Choose the name the target group to open its details page.
  4. On the Group details page, in the Attributes section, choose Edit.
  5. On the Edit attributes page, select Proxy protocol v2.
  6. Choose Save changes.

Or even by script (taken from https://docs.cloudbees.com/docs/cloudbees-ci/latest/eks-install-guide/eks-prerequisites-helm-install) , e.g.:

#!/bin/bash -eu
export AWS_PAGER=""
hostname=$(kubectl get -n ingress-nginx services ingress-nginx-controller --output jsonpath='{.status.loadBalancer.ingress[0].hostname}')
loadBalancerArn=$(aws elbv2 describe-load-balancers  --query "LoadBalancers[?DNSName==\`$hostname\`].LoadBalancerArn"  --output text)
targetGroupsArn=$(aws elbv2 describe-target-groups --load-balancer-arn $loadBalancerArn --query TargetGroups[\*].TargetGroupArn --output text)
for targetGroupArn in $targetGroupsArn; do
  aws elbv2 modify-target-group-attributes --target-group-arn $targetGroupArn --attributes Key=proxy_protocol_v2.enabled,Value=true --output text
done
user_112379890
Related