AWS/ELB - Revision history

Pio2pio: /* Use Nginx to preserve headers/client IP when working with ELB */

2019-11-19T22:29:28Z

Use Nginx to preserve headers/client IP when working with ELB

← Older revision		Revision as of 00:29, 20 November 2019
Line 23:		Line 23:
	# This policy operates on TCP listeners only."		# This policy operates on TCP listeners only."

	aws elb create-load-balancer-policy --load-balancer-name <~~elb-name~~> --policy-name "<free_form_POLICY_NAME>" --policy-type-name ProxyProtocolPolicyType --policy-attributes AttributeName=Proxy Protocol, AttributeValue-true		aws elb create-load-balancer-policy --load-balancer-name "<LOAD BALANCER NAME>" \
	aws elb describe-load-balancer-policies --load-balancer-name ~~aws~~ "<LOAD BALANCER NAME>" #~~make sure the~~ policy ~~got attached~~		--policy-name "<free_form_POLICY_NAME>" --policy-type-name ProxyProtocolPolicyType \
	aws elb set-load-balancer-policies-for-backend-server --load-balancer-name "<LOAD BALANCER NAME>" --instance-port 80 --policy-names linuxacademy-protocol-policy ~~#attach policy to a port/listener~~		--policy-attributes AttributeName=Proxy Protocol, AttributeValue-true

			# check the policy got attached
			aws elb describe-load-balancer-policies --load-balancer-name "<LOAD BALANCER NAME>"

			# attach policy to a port/listener
			aws elb set-load-balancer-policies-for-backend-server --load-balancer-name "<LOAD BALANCER NAME>" \
			--instance-port 80 --policy-names linuxacademy-protocol-policy

	# Configure Nginx to grab extra headers and put in access.log file		# Configure Nginx to grab extra headers and put in access.log file

Pio2pio at 21:13, 26 March 2019

2019-03-26T21:13:01Z

← Older revision		Revision as of 23:13, 26 March 2019
Line 3:		Line 3:

	HAproxy developed Proxy Protocol to solve this problem, so we are going to configure the Proxy_Protocol on our load balancer, then configure nginx for the proxy protocol. Proxy protoclol allows to confiure additional header including a client IP.		HAproxy developed Proxy Protocol to solve this problem, so we are going to configure the Proxy_Protocol on our load balancer, then configure nginx for the proxy protocol. Proxy protoclol allows to confiure additional header including a client IP.

			<source>
			R53 -> ELB -> Nginx
			/ \
			app1 app2
			</source>

Pio2pio: /* Use Nginx to preserve headers/client IP when working with ELB */

2019-03-26T21:06:24Z

Use Nginx to preserve headers/client IP when working with ELB

← Older revision		Revision as of 23:06, 26 March 2019
Line 12:		Line 12:
	aws configure		aws configure
	aws elb describe-load-balancer-policy-types		aws elb describe-load-balancer-policy-types
	aws elb create-load-balancer-policy --load-balancer-name ~~linuxacademy~~-~~protocol-policy~~ --policy-name "<~~POLICY NAME~~>" --policy-type-name ProxyProtocolPolicyType --policy-attributes AttributeName=Proxy Protocol, AttributeValue-true		# <serach for policy ProxyProtocol>
	aws elb describe-load-balancer-policies --load-balancer-name aws "<LOAD BALANCER NAME>"		# "AttributeName": "ProxyProtocol"
	aws elb set-load-balancer-policies-for-backend-server --load-balancer-name "<LOAD BALANCER NAME>" --instance-port 80 --policy-names linuxacademy-protocol-policy		# "Policy that controls whether to include the IP address and port of the orginiating request for TCP messages.
	cd /etc		# This policy operates on TCP listeners only."
	cd nginx/
	~~vim~~ nginx.conf		aws elb create-load-balancer-policy --load-balancer-name <elb-name> --policy-name "<free_form_POLICY_NAME>" --policy-type-name ProxyProtocolPolicyType --policy-attributes AttributeName=Proxy Protocol, AttributeValue-true
			aws elb describe-load-balancer-policies --load-balancer-name aws "<LOAD BALANCER NAME>" #make sure the policy got attached
			aws elb set-load-balancer-policies-for-backend-server --load-balancer-name "<LOAD BALANCER NAME>" --instance-port 80 --policy-names linuxacademy-protocol-policy #attach policy to a port/listener

			# Configure Nginx to grab extra headers and put in access.log file
			sudo vi /etc/nginx/nginx.conf
			# change
			server {
			listen 80; -> 80 proxy_protocol;
			# add
			set_real_ip_from <vpc_cidr>; #allow header modifications if request comes from this range
			real_ip_header proxy_protocol;
			# update access logs
			http {
			logh_format main '$remote_address -> '$proxy_protocol_addr

	systemctl restart nginx		systemctl restart nginx
	</source>		</source>

Pio2pio: /* Use Nginx to preserve headers/client IP when working with ELB */

2019-03-26T20:47:58Z

Use Nginx to preserve headers/client IP when working with ELB

← Older revision		Revision as of 22:47, 26 March 2019
Line 1:		Line 1:
	= Use Nginx to preserve headers/client IP when working with ELB =		= Use Nginx to preserve headers/client IP when working with ELB =
	If you configure ELB for Http/s then ~~headers forwardes (~~application layer mode~~) but~~ if you decide to use TCP load balancing ELB is not not aware of any headers. For this we going to use Nginx to proxy_websocket connections L4 TCP.		If you configure ELB for [https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/x-forwarded-headers.html#x-forwarded-for Http/s then ELB injects] <code>X-Forwarded-For: client-ip-address</code> header that has orginal client IP address this is an application layer mode. But if you decide to use TCP load balancing ELB is not not aware of any headers. For this we going to use Nginx to proxy_websocket connections L4 TCP.

			HAproxy developed Proxy Protocol to solve this problem, so we are going to configure the Proxy_Protocol on our load balancer, then configure nginx for the proxy protocol. Proxy protoclol allows to confiure additional header including a client IP.


	<source lang=bash>		<source lang=bash>

Pio2pio at 20:41, 26 March 2019

2019-03-26T20:41:21Z

← Older revision		Revision as of 22:41, 26 March 2019
Line 1:		Line 1:
	= Use Nginx to preserve headers/client IP when working with ELB =		= Use Nginx to preserve headers/client IP when working with ELB =
	If you configure ELB for Http/s then headers forwardes but if you decide to use TCP load balancing		If you configure ELB for Http/s then headers forwardes (application layer mode) but if you decide to use TCP load balancing ELB is not not aware of any headers. For this we going to use Nginx to proxy_websocket connections L4 TCP.

	<source lang=bash>		<source lang=bash>

Pio2pio: Created page with "= Use Nginx to preserve headers/client IP when working with ELB = If you configure ELB for Http/s then headers forwardes but if you decide to use TCP load balancing
2019-03-26T20:34:17Z

Created page with "= Use Nginx to preserve headers/client IP when working with ELB = If you configure ELB for Http/s then headers forwardes but if you decide to use TCP load balancing <source..."

New page
= Use Nginx to preserve headers/client IP when working with ELB =
If you configure ELB for Http/s then headers forwardes but if you decide to use TCP load balancing

<source lang=bash>
sudo apt-get install nginx
systemctl status nginx
tail -f /var/log/nginx/access.log
pip install awscli==1.6.6
aws configure
aws elb describe-load-balancer-policy-types
aws elb create-load-balancer-policy --load-balancer-name linuxacademy-protocol-policy --policy-name "<POLICY NAME>" --policy-type-name ProxyProtocolPolicyType --policy-attributes AttributeName=Proxy Protocol, AttributeValue-true
aws elb describe-load-balancer-policies --load-balancer-name aws "<LOAD BALANCER NAME>"
aws elb set-load-balancer-policies-for-backend-server --load-balancer-name "<LOAD BALANCER NAME>" --instance-port 80 --policy-names linuxacademy-protocol-policy
cd /etc
cd nginx/
vim nginx.conf
systemctl restart nginx
</source>