aws-samples/aws-gateway-load-balancer-code-samples

AWS Code Sample for AWS Gateway Load Balancer

Welcome

This is a respository for code examples to help accelerate your development of AWS Gateway Load Balancer (GWLB). The repository is organized by programming language or technology:

• AWS CloudFormation
• AWS SDK for Python (Boto3)
• AWS SDK for Go
• AWS CLI

To learn more about Gateway Load Balancer, checkout the Gateway Load Balancer page and the documentation.

Note:

• While code samples in this repository has been tested and believe it works well, as always, be sure to test it in your environment before using it in production!

Security

See CONTRIBUTING for more information.

License

This library is licensed under the MIT-0 License. See the LICENSE file.

aws-gateway-load-balancer-code-samples's Issues

GWLB support for Transit Gateway.

GWLB should support Transit Gateway as a target.

Current iptables implementation doesnt support GWLB Cross Zone Load Balancing

In the Appliance user data, you are currently only creating the iptables nat rules for the same AZ GWLB endpoint IP. If the user enables Cross Zone Load Balancing for the GWLB, the appliance will not route Geneve encapsulated traffic from the other GWLB AZ endpoints, thus resulting in intermittent connection timeouts.

To fix this, can I propose you iterate through the GWLB IPs and create the iptable nat rules per GWLB IP.
For example, Inside the appliance bootstrap user data:

Replace:
iptables -t nat -A PREROUTING -p udp -s $gwlb_ip -d $instance_ip -i eth0 -j DNAT --to-destination $gwlb_ip:6081;
iptables -t nat -A POSTROUTING -p udp --dport 6081 -s $gwlb_ip -d $gwlb_ip -o eth0 -j MASQUERADE;

With something like this:
for gwlb_ipaddress in $(aws --region $instance_region ec2 describe-network-interfaces --filters Name=vpc-id,Values=$instance_vpcid | jq ' .NetworkInterfaces[] | select(.InterfaceType=="gateway_load_balancer") |.PrivateIpAddress' -r)
do
iptables -t nat -A PREROUTING -p udp -s $gwlb_ipaddress -d $instance_ip -i eth0 -j DNAT --to-destination $gwlb_ipaddress:6081
iptables -t nat -A POSTROUTING -p udp --dport 6081 -s $gwlb_ipaddress -d $gwlb_ipaddress -o eth0 -j MASQUERADE
done

I'm going in after a launch and doing this manually to demonstrate the solution with Cross Zone Load Balancing enabled.

Spoke application

Application instance in spoke VPC fail running userdata script. have to run manually after launch

Centralized inspection architecture for Inbound traffic

Hello,
I have 2 questions about the Centralized inspection architecture :
1 - why you configure GLWBE on each VPC instead of using TGW to route traffic to the Inspection VPC ?
2 - how we can use the same archi for inboud traffic, from Internet to spoke VPC ? if I understand well the prinicpe of GWLB, it's not possible to do configure EIP on the the fw appliance and do Destination NAT, so how we can do NAT before accessing the GWLB ? I thought maybe I can use Network LB to handle the EIP and on the target specify the IP address of the private instance (on spoke VPC), but I'm not sure if we can do that ? any idea to have the same archi for outbound and inboud flow ?
Regards

iptables-services needed to save iptables rules in configure_iptables_al2.md

This document should mention that AL2 requires the iptables-services package.