AWS Pass traffic from NLB to an ALB?

Question

I am trying to pass incoming traffic from amazon's Network Load Balancer to Application Load Balancer, I am using NLB since it has an Elastic IP attachment and I want it to serve as a proxy for the ALB. is that even possible?

Answer 1

September 2021 Update: AWS has announced the native availability of ALB Target Groups for NLBs. This not only reduces the complexity of needing a Lambda-based workaround but also removes the limitation concerning client IP preservation. ALBs targeted in this fashion will provide the X-Forwarded-For header containing the external IP address originally invoking the NLB.

---

It is possible, but it's slightly messy.

The problem is that Application Load Balancers can scale up, out, in, and/or down, and in each case the internal IP addresses of the balancers can change... but NLB requires static addresses for its targets.

So, at a low level, this means the NLB target group must be modified every time the IPs of the ALB change.

AWS has published an official solution for accomplishing this, using a Lambda function on a schedule to capture the addresses of the ALB and update the NLB configuration whenever the results change.

https://aws.amazon.com/blogs/networking-and-content-delivery/using-static-ip-addresses-for-application-load-balancers/

One notable limitation, here, is that this solution does not allow you to identify the client IP address. It is lost when the traffic goes through the NLB, because NLBs only preserve the source IP when the target is an instance (not an IP address) or when the target understands the Proxy protocol on the client side and the feature is enabled on the NLB, but ALB doesn't support such a configuration. With the setup shown at the link, above, the rightmost address in X-Forwarded-For will be set by the ALB to the internal address of the NLB.