Routing public and private traffic to an AWS ALB

user_15440765 0
Viewed 1435

I have a VPC with a public subnet containing a NAT gateway and a private subnet containing ec2 instances running my application.

A public ALB provides inbound internet access to the application running in the private subnets.

I also want to allow access to this ALB over a site-to-site VPN using a customer gateway and transit gateway.

What is the best pattern to do this that avoids duplicating the ALB and it’s configuration (i.e avoid having a public and internal ALB)? Is it possible to run a single private ALB that the VPN users will connect to directly and route public internet traffic to it from a public NLB?

amazon-vpc amazon-elb amazon-web-services
2 Answers

You can use AWS API Gateway private integration Pattern using VPC link to provide public access to your service, and host your service behind internal application load balancer like the following: enter image description here

Also you may need to consider dns resolution between your AWS and on premises networks.

user_89059090

You should be able to use transit gateway routing tables to accomplish this. Create two TGW attachment points; one for your VPN and one for the subnet where your ALB resides. Now, disassociate those two attachment points from the main TGW routing table. Create two new TGW routing tables:

  • one that points 0.0.0.0/0 to your ALB subnet attachment and associate that to your VPN TGW attachment (enable DNS resolution)
  • one that points 0.0.0.0/0 to your VPN subnet attachment and associate that to your ALB subnet TGW attachment (enable DNS resolution)

In this way any traffic coming in from your VPN will land in your private ALB subnet and resolve to the ALB private IP address. Any traffic leaving your ALB destine to a non-local IP address (the return traffic) will be routed to your VPN TGW attachment.

Although I have not tested your specific scenario, I was able to use this method to route TGW traffic to and from GWLB endpoints.

You can leave your routes for public internet traffic to your ALB as they are (from your public NLB). Now you have two ways customers can reach the same ALB; one public and one private.

user_93664460
Related