aws-samples / aws-gateway-load-balancer-code-samples Goto Github PK
View Code? Open in Web Editor NEWLicense: MIT No Attribution
License: MIT No Attribution
In the Appliance user data, you are currently only creating the iptables nat rules for the same AZ GWLB endpoint IP. If the user enables Cross Zone Load Balancing for the GWLB, the appliance will not route Geneve encapsulated traffic from the other GWLB AZ endpoints, thus resulting in intermittent connection timeouts.
To fix this, can I propose you iterate through the GWLB IPs and create the iptable nat rules per GWLB IP.
For example, Inside the appliance bootstrap user data:
Replace:
iptables -t nat -A PREROUTING -p udp -s $gwlb_ip -d $instance_ip -i eth0 -j DNAT --to-destination $gwlb_ip:6081;
iptables -t nat -A POSTROUTING -p udp --dport 6081 -s $gwlb_ip -d $gwlb_ip -o eth0 -j MASQUERADE;
With something like this:
for gwlb_ipaddress in $(aws --region $instance_region ec2 describe-network-interfaces --filters Name=vpc-id,Values=$instance_vpcid | jq ' .NetworkInterfaces[] | select(.InterfaceType=="gateway_load_balancer") |.PrivateIpAddress' -r)
do
iptables -t nat -A PREROUTING -p udp -s $gwlb_ipaddress -d $instance_ip -i eth0 -j DNAT --to-destination $gwlb_ipaddress:6081
iptables -t nat -A POSTROUTING -p udp --dport 6081 -s $gwlb_ipaddress -d $gwlb_ipaddress -o eth0 -j MASQUERADE
done
I'm going in after a launch and doing this manually to demonstrate the solution with Cross Zone Load Balancing enabled.
This document should mention that AL2 requires the iptables-services package.
Application instance in spoke VPC fail running userdata script. have to run manually after launch
Hello,
I have 2 questions about the Centralized inspection architecture :
1 - why you configure GLWBE on each VPC instead of using TGW to route traffic to the Inspection VPC ?
2 - how we can use the same archi for inboud traffic, from Internet to spoke VPC ? if I understand well the prinicpe of GWLB, it's not possible to do configure EIP on the the fw appliance and do Destination NAT, so how we can do NAT before accessing the GWLB ? I thought maybe I can use Network LB to handle the EIP and on the target specify the IP address of the private instance (on spoke VPC), but I'm not sure if we can do that ? any idea to have the same archi for outbound and inboud flow ?
Regards
GWLB should support Transit Gateway as a target.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.