7 ms·
If you're curious to see NLB in action, here's a live demo: http://nlb-34dc3b430638dc3e.elb.us-west-2.amazonaws.com/ http://nlb-34dc3b430638dc3e.elb.us-west-2.a
by colmmacc 9y ago
If you're curious to see NLB in action, here's a live demo: http://nlb-34dc3b430638dc3e.elb.us-west-2.amazonaws.com/ http://nlb-34dc3b430638dc3e.elb.us-west-2.amazonaws.com/ , it took about 5 minutes in the console to set it up and no changes on the targets/backends.
Massive disclaimer: I work on NLB.
- irl_zebra 9y agoAny idea how long for GovCloud?
- neom 9y agoHello fellow GovCloud user, would love to compare notes if you're game. je@h4x.club :)
- icebraining 9y agoI got to say, asking about GovCloud and with that email address your post sounds like a terrible spear phishing attempt :)
- p0rkbelly 9y agoPretty sure that's the entire point :)
- icebraining 9y agoWas it? neom has posted that email in the past.
- neom 9y agoAin't no dark arts over here. Just a buddy trying to fix cities. <3
- ckozlowski 9y agoDo you have a support POC? I'd reach out to them as they should be able to provide you with a roadmap update. If you're not sure who that is, you can reach out to me at kozlowck at amazon.com.
- knite 9y agoIt sounds like NLB passes through source IP - does that mean outbound flows are through the IGW?
- cperciva 9y agoThere must be some magic happening somewhere, because otherwise outgoing packets would have the wrong source address.
- ec109685 9y agoYou can use direct server return to manipulate the Ethernet frames so that packets don't travel back through the load balancer on the way to the parent switch.
- toast0 9y agoThat generally requires config on the serving hosts, which wasn't mentioned in the setup. I think I saw a reference to adding hosts with a different port number than the service port as well. For people in EC2-VPC (not classic), all their traffic is going through an Amazon NAT anyway, perhaps this new service is setting up translations there. (Note all the references to VPC, and never a mention of EC2-classic)
- bogomipz 9y agoDirect Server Return works at layer 3 not layer 2, its routing and encapsulation - IP in IP, GRE etc.
- mdouglass 9y agoIs there any intent to add TLS termination? That’s a dealbreaker for us switching from the classic load balancer. Otherwise this looks really awesome, thanks!
- nonane 9y agoI don't think they can add TLS termination because of the way it's implemented. NLB runs on Layer 4 - the transport layer where TCP/UDP run on. TLS technically runs on top of the transport layer.
- paulddraper 9y agoHuh? It's no different than ELB.
- mdouglass 9y agoThat’s kind of the answer I was expecting, just hoping it wasn’t the case. From the marketing material they really want you to move, but not having a solution to offload tls makes it impossible for us. And it worries me to see the CLB getting effectively deprecated with it an alternative
- seanp2k2 9y agoALB can term TLS for h2 and wss: https://aws.amazon.com/elasticloadbalancing/ https://aws.amazon.com/elasticloadbalancing/ sounds like that's what you might want?
- mdouglass 9y agoUnfortunately we are currently on a custom TCP-based protocol (we're in the game space). But yes, this is more incentive for us to consider h2 or wss.
- EwanToo 9y agoI'm hopeful AWS will follow this up with ACM supporting SSL certs on instances, so you can run a LetsEncrypt equivalent on each instance, providing TLS end to end encryption
- posnet 9y agoAre there any plans to add UDP support?
- chii 9y agois there a cloudformation template for this demo that i can look at?
- nikolay 9y agoI doubt. Unfortunately, CloudFormations lags severely behind...
- colmmacc 9y agoCloudFormation, CodeDeploy, and ECS all support NLB today :) I used the console to create the simple demo though, so I don't have a template to recreate it. Sorry!
- nikolay 9y agoGood as I'm tired spending days writing Customer Resources!
- sidds 9y agoCloudFormation provides support for Network Load Balancer. Check the 'Type' property mentioned in the CloudFormation templates reference in public documentation http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-loadbalancer.html http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuid...
- friendzis 9y agoDemo page states "Your browser may keep a connection open for a few seconds and re-use it for a reloaded request. If it does, you'll get the same target", but when I attempted to abuse the power of F5, I was alternated between ice cream and bumblebee. If you are going to look at it, attempt time - ~04:50 UTC, remote address from 88.119.128.0/20 network
- 076ae80a-3c97-4 9y agoSame, got a different one each time.
- zob_cloud 9y agoBrowsers typically use a few connections to load a page so that it can load faster. Each of those threads has a different source port, and thus may route to a different target. In Colm's demo, it depends which thread your browser uses when requesting the part including the CSS which decorates the object. In my Chrome on Mac I see 6 TCP connections to the demo NLB tcp4 0 0 192.168.100.101.49615 54.69.111.179.80 ESTABLISHED tcp4 0 0 192.168.100.101.49614 54.69.111.179.80 ESTABLISHED tcp4 0 0 192.168.100.101.49613 54.69.111.179.80 ESTABLISHED tcp4 0 0 192.168.100.101.49612 54.69.111.179.80 ESTABLISHED tcp4 0 0 192.168.100.101.49611 54.69.111.179.80 ESTABLISHED tcp4 0 0 192.168.100.101.49610 54.69.111.179.80 ESTABLISHED Each of those will be routed to the same target, so it's up to your browser to decide which to use for what.
- stelund 9y agoThere is no Security Group for NLB, how is that reasoned?
- jdc0589 9y agothat threw me for a bit of a loop as well. This means that responsibility for doing ACL whitelisting at the edge is now moved from the actual edge, to the security groups on the actual servers responding to request, right? That's do-able and all, but I kind of didn't hate the old paradigm of having an extra layer there.
- colmmacc 9y agoOne way to think of NLB is that it's an Elastic IP address that happens to go to multiple instances or containers, instead of just one. Everything else stays the same.
- stelund 9y agoYeh, it's easy to use it like that for now. I hope they update it later on though. Seems like an missing feature in their otherwise nice firewall rules setup.