AWS Load Balancer with a static IP address

Question

I have a set-up running on Amazon cloud with a couple of EC2 Instances running through a load balancer.

It is important that the site has a unique(static) IP or set of IPs as I'm plugging in 3rd party APIs which only accept requests made from IPs which have been added to their whitelist.

So basically unless we can give these 3rd parties a static IP or range of IPs that the requests from the site will always come from then we would be unable to make any calls to them.

Anyone knows how to achieve this as I know that Elastic IPs are not compatible with load balancers?

If I were to look up the IP of the load balancer DNS name (e.g. dualstack.awseb-BAMobile-ENV-xxxxxxxxx.eu-west-1.elb.amazonaws.com resolves to 200.200.200.200) would that IP be Static?

Any help/advise is greatly appreciated guys.

Solution 1

The ip addresses of your load balancer is not static. In any event, your incoming load balancer IP wouldn't be used for outgoing connections.

You could assign elastic IPs to the actual instances behind the load balancer, which would then be used for outgoing requests. You get 5 free elastic ips, and I believe you can apply for more if you need them.

Additionally if using a VPC and if your instances are in a private subnet then they will only be able to access the internet via the NAT instance(s) you setup, and you can of course assign an elastic IP to the NAT instances

Solution 2

This is an old question, but things have changed now.

Now you can create a Network ELB to get a LB with a static IP.

from https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html

• Support for static IP addresses for the load balancer. You can also assign one Elastic IP address per subnet enabled for the load balancer.

https://aws.amazon.com/blogs/aws/new-network-load-balancer-effortless-scaling-to-millions-of-requests-per-second/

Solution 3

You can attache an additional ENI (Elastic Network Interface) to an instance in your VPC. This way the ELB (Elastic Load Balancer) routes the incoming Internet requests to the web server, and the additional ENI will be used to connect to your 3rd party (or internal) requests (Management network)

You can see more details about it in the VPC documentations

Solution 4

Really the only way I am aware of doing this is by setting up your instances within a VPC and having dedicated NAT instances by which all outbound traffic is routed.

Here is a link to the AWS documentation on how to set up NAT instances:

http://docs.amazonwebservices.com/AmazonVPC/latest/UserGuide/VPC_NAT_Instance.html

Solution 5

You CAN attach an elastic IP to the instances BUT NOT to the ELB (which is what the client sees).

You could use a full reverse proxy layer 7 load balancer like HAProxy:

Or a commercial implementation like Loadbalancer.org or Riverbed (Zeus)

They both are in the AWS Marketplace:

View more solutions

Comments

[Frederick Cheung]

Really ? Why wouldn't you be able to able to assign an elastic ip to an instance that just happens to also be hooked up to an elb? If I understand the request they are only intested in outgoing requests to these 3rd party services, not incoming requests handled by the ELB

[Mike Brant]

Unless this has recently changed, you cannot assign an Elastic IP to an instance that is running behind ELB.

[Roman Newaza]

This dedicated NAT Instance is SPOF! Bad idea.

[AndrewB87]

Thank you for your reply however I am not really understanding. The instances are not part of a VPC. They have been set up using elastic beanstalk.

[Guy]

You can deploy elastic beanstalk to a VPC (no extra charge): docs.amazonwebservices.com/elasticbeanstalk/latest/dg/…

[Paul Jowett]

Frederick you are correct on both counts (#1 outgoing to the email system isn't the ELB and #2 the nodes behind the ELB can have static IP addresses).

[Machisuji]

Hence you use two NAT/Proxy instances like this.

[user3086014]

Inside the VPc also the ELB has variable IPs. I did nslookup Cname_of_ELB, it gave me two IP's . what does that mean?

[jorfus]

AWS offers a nat gateway. You can assign an elastic IP to that.

[Spiff]

What if auto scaling adds and removes instances? What will be the IP of each instance then?

[jorfus]

If you deploy your app servers in a private subnet with the AWS provided nat gateway every outbound request from your private subnet will originate from the same IP.

[Nathan Wallace]

Oh Amazon... note that to add an Elastic IP to your network load balancer, you have to disassociate the IP address before you start creating the load balancer (if it's associated to something already), then associate the address during creation. At least right now, you cannot associate the Elastic IP after creating the load balancer.

[TJ Zimmerman]

FYI here in 2020 I'm currently running an EC2 instance behind an ELB that does in fact have an Elastic IP associated with it.