AWS Load Balancer with a static IP address

Question

I have a set-up running on Amazon cloud with a couple of EC2 Instances running through a load balancer.

It is important that the site has a unique(static) IP or set of IPs as I'm plugging in 3rd party APIs which only accept requests made from IPs which have been added to their whitelist.

So basically unless we can give these 3rd parties a static IP or range of IPs that the requests from the site will always come from then we would be unable to make any calls to them.

Anyone knows how to achieve this as I know that Elastic IPs are not compatible with load balancers?

If I were to look up the IP of the load balancer DNS name (e.g. dualstack.awseb-BAMobile-ENV-xxxxxxxxx.eu-west-1.elb.amazonaws.com resolves to 200.200.200.200) would that IP be Static?

Any help/advise is greatly appreciated guys.

Shark

Answer 1

The ip addresses of your load balancer is not static. In any event, your incoming load balancer IP wouldn't be used for outgoing connections.

You could assign elastic IPs to the actual instances behind the load balancer, which would then be used for outgoing requests. You get 5 free elastic ips, and I believe you can apply for more if you need them.

Additionally if using a VPC and if your instances are in a private subnet then they will only be able to access the internet via the NAT instance(s) you setup, and you can of course assign an elastic IP to the NAT instances

Evacuate

Really ? Why wouldn't you be able to able to assign an elastic ip to an instance that just happens to also be hooked up to an elb? If I understand the request they are only intested in outgoing requests to these 3rd party services, not incoming requests handled by the ELB – Evacuate

Unless this has recently changed, you cannot assign an Elastic IP to an instance that is running behind ELB. – Pommel

Frederick you are correct on both counts (#1 outgoing to the email system isn't the ELB and #2 the nodes behind the ELB can have static IP addresses). – Algia

FYI here in 2020 I'm currently running an EC2 instance behind an ELB that does in fact have an Elastic IP associated with it. – Olcott

Answer 2

This is an old question, but things have changed now.

Now you can create a Network ELB to get a LB with a static IP.

from https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html

• Support for static IP addresses for the load balancer. You can also assign one Elastic IP address per subnet enabled for the load balancer.

https://aws.amazon.com/blogs/aws/new-network-load-balancer-effortless-scaling-to-millions-of-requests-per-second/

Ozell

Oh Amazon... note that to add an Elastic IP to your network load balancer, you have to disassociate the IP address before you start creating the load balancer (if it's associated to something already), then associate the address during creation. At least right now, you cannot associate the Elastic IP after creating the load balancer. – Nies

Answer 3

You can attache an additional ENI (Elastic Network Interface) to an instance in your VPC. This way the ELB (Elastic Load Balancer) routes the incoming Internet requests to the web server, and the additional ENI will be used to connect to your 3rd party (or internal) requests (Management network)

You can see more details about it in the VPC documentations

Filagree

Thank you for your reply however I am not really understanding. The instances are not part of a VPC. They have been set up using elastic beanstalk. – Shark

You can deploy elastic beanstalk to a VPC (no extra charge): docs.amazonwebservices.com/elasticbeanstalk/latest/dg/… – Filagree

Answer 4

Really the only way I am aware of doing this is by setting up your instances within a VPC and having dedicated NAT instances by which all outbound traffic is routed.

Here is a link to the AWS documentation on how to set up NAT instances:

http://docs.amazonwebservices.com/AmazonVPC/latest/UserGuide/VPC_NAT_Instance.html

Pommel

This dedicated NAT Instance is SPOF! Bad idea. – Italy

Hence you use two NAT/Proxy instances like this. – Direful

Inside the VPc also the ELB has variable IPs. I did nslookup Cname_of_ELB, it gave me two IP's . what does that mean? – Nernst

AWS offers a nat gateway. You can assign an elastic IP to that. – Sacrosanct

Answer 5

You CAN attach an elastic IP to the instances BUT NOT to the ELB (which is what the client sees).

You could use a full reverse proxy layer 7 load balancer like HAProxy:

Or a commercial implementation like Loadbalancer.org or Riverbed (Zeus)

They both are in the AWS Marketplace:

Brigette

Answer 6

Your outbound requests to your 3rd party APIs will NOT go out via the ELB/ALB. That's for incoming connections. If you need an inbound static IP you'll probably need to forego the loadbalancer (or figure out how to implement Anshu's suggestion to attach an elastic IP to the loadbalancers, the doc is light on details). Update: I found some documentation that ALB use static addresses (and I just tried binding an elastic IP to one to be sure and that failed). If you're talking about outbound connections see below:

• If your server is deployed in a public subnet you can attach an elastic IP to that host. Outbound communications will go out over that address.
• If your server is deployed in a private subnet there's a NAT gateway attached to it. All outbound traffic from your private subnet will go out over that interface.

Sacrosanct

What if auto scaling adds and removes instances? What will be the IP of each instance then? – Windpipe

If you deploy your app servers in a private subnet with the AWS provided nat gateway every outbound request from your private subnet will originate from the same IP. – Sacrosanct

Answer 7

You could use as already mentioned loadbalancer.org appliance in AWS. It would replace the AWS NAT instance and give greater functionality and include both Layer4 and Layer7, along with SSL termination and a WAF.

Best of all you get free support in your 30 day trial in AWS to help you get up and running.

Yes I am biased as I work for loadbalancer.org however I would say nothing ventured nothing gained.

Monkfish

Answer 8

You can use a DNS service like DNSMadeeasy that allows "ANAME" records. These act like an A Record but can be pointed at a FQDN or IP. So in this case you can point it to the ELB DNS.

Dave

Voigt