4 ms·
I don’t think that’s right. You wouldn’t use 0.0.0.0/32 you would use the private subnet range so they have no direct access to the internet and use a nat gatew
by philliphaydon 4y ago
I don’t think that’s right. You wouldn’t use 0.0.0.0/32 you would use the private subnet range so they have no direct access to the internet and use a nat gateway to give them access to the outside world but no inbound access.
Edit: in the first example the servers should be in a private subnet. And not have a public ip allocated. They would require ssh hopping via a bastion or a vpn.
- paranoidrobot 4y agoIf your traffic is coming through a NLB, then the instances attached to the target group need to have 0.0.0.0/0 as the permitted source. (Assuming you want traffic from anywhere) If you dont believe me, try setting it up yourself. As for instances being on a private VPC/non-public IPs thats deployment specific. In any case, everything then complains about listening on strange ports with 0.0.0.0/0
- philliphaydon 4y agoI will try test it out this evening.
- philliphaydon 4y agoI tried it out and I don’t know why but I feel like it’s complicated to me. Setting everything up with an application load balancer, public and private subnet’s and security groups all makes perfect sense. But the network load balancer makes me confused. But adding it to my list of things to learn and understand better.
- paranoidrobot 4y ago> But the network load balancer makes me confused yep, it just works differently from everything else. Once you realise that, from a network traffic perspective, AWS wants you to pretend its just a magic straw delivering traffic from your source to your targets, and it's basically invisible to everything, then it started to click more for me. That's why I want NLBs to support SGs. or at least a NLBv2 that does it.