ELB (Elastic Load Balancer)
Amazon ELB (Elastic Load Balancer) is an elastic load balancer provided by AWS, which assigns the most suitable servers for external access based on actual conditions. In practical usage, it is often necessary to restrict client access via ELB. This article introduces how to implement such access restrictions by configuring EC2 instances.
As shown in the figure, since ELB does not belong to a security group, applying restrictions at the security group level will not affect ELB; clients accessing via ELB can still reach the EC2 instance.
However, if you restrict ELB’s access to EC2, when ELB performs Health Checks on EC2, it will fail to access successfully and incorrectly determine that the EC2 instance is in an abnormal state. Therefore, access restrictions for clients passing through ELB must be configured on the web server of the EC2 instance.
When implementing client access restrictions, since all traffic passes through ELB, the detected source IP addresses will all be those of the ELB. In this case, you need to use the X-Forwarded-For (XFF) header for verification and restriction.
Examples
1. Allow only the IP address 172.24.40.83 to access the website.
Edit the website configuration file and add or modify it as follows:
SetEnvIf X-Forwarded-For "172.24.40.83" allow_ip Order deny,allow Deny from all Allow from env=allow_ip
2. Deny access to the website for IP addresses 172.24.40.83 and 172.24.40.84.
Edit the website configuration file and add or modify it as follows:
SetEnvIf X-Forwarded-For "172.24.40.83" deny_ip01 SetEnvIf X-Forwarded-For "172.24.40.84" deny_ip02 Order allow,deny Allow from all Deny from env=deny_ip01 Deny from env=deny_ip02
The function of X-Forwarded-For is to append the real client’s IP address to the end of the data packet when distributing requests received by ELB to EC2.
Using an Apache web server, you can modify the client IP to reflect the X-Forwarded-For value by installing and configuring mod_extract_forwarded. The specific method requires further research.
# yum install mod_extract_forwarded
Introduction to Load Balancer Distribution Methods
ELB (Elastic Load Balancer) is a relatively simple and easy-to-use load balancer. It uses the Round Robin method to evenly distribute external access among EC2 instances managed by ELB, ensuring optimal allocation and use of system resources for the instance cluster under high traffic volumes.
Additionally, common high-performance load balancers typically support: Least Connections, Observed, Dynamic Ratio, Round Robin, Ratio, Fastest, Predictive, etc. Since ELB only provides the Round Robin function, it is considered simple. Furthermore, because you can set up a load balancer with just a few steps via the web interface, it is also considered user-friendly.