Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Network Load Balancer

aws.amazon.com

Post reply on HN
Print view View original

111–120 of 122 posts

Re: AWS Network Load Balancer

#111

Post by ckozlowski »

discodave wrote: post #109
Corrado wrote: post #75

Earlier quoted context omitted.

I would assume that it's something developed internally at Amazon. Networking inside of AWS isn't standard fare and I doubt something like NetScaler or F5 products would be able to be used. Generally speaking, they aren't using TCP/IP behind the curtain, to move packets between nodes. AWS has even created their own routing hardware/software because no other company could do what they need at the scale that they need.…

AWS & Amazon uses a LOT of routers from one of these vendors. Although, they would probably try and avoid baking it into a public-facing product like this.

Not necessarily: https://www.geekwire.com/2017/amazon-web-services-secret-wea...

Re: AWS Network Load Balancer

#112

Post by paulddraper »

9point6 wrote: post #88
paulddraper wrote: post #41

Static IP, source IP, and zonality are game changing. Unfortunately, it lacks a very significant existing feature of ELB: SSL/TLS termination. It's very convient to manage the certs in AWS without having to deploy them to dedicated EC2 instances.

It won't ever be possible to do this as the NLB runs a few network layers below where TLS runs

Does it? It has HTTPS health checks.

Re: AWS Network Load Balancer

#113

Post by stelund »

colmmacc wrote: post #95
jdc0589 wrote: post #93

Earlier quoted context omitted.

that threw me for a bit of a loop as well. This means that responsibility for doing ACL whitelisting at the edge is now moved from the actual edge, to the security groups on the actual servers responding to request, right? That's do-able and all, but I kind of didn't hate the old paradigm of having an extra layer there.

One way to think of NLB is that it's an Elastic IP address that happens to go to multiple instances or containers, instead of just one. Everything else stays the same.

Yeh, it's easy to use it like that for now. I hope they update it later on though. Seems like an missing feature in their otherwise nice firewall rules setup.

Re: AWS Network Load Balancer

#114

Post by zob_cloud »

076ae80a-3c97-4 wrote: post #80
friendzis wrote: post #54

Earlier quoted context omitted.

Demo page states "Your browser may keep a connection open for a few seconds and re-use it for a reloaded request. If it does, you'll get the same target", but when I attempted to abuse the power of F5, I was alternated between ice cream and bumblebee. If you are going to look at it, attempt time - ~04:50 UTC, remote address from 88.119.128.0/20 network

Same, got a different one each time.

Browsers typically use a few connections to load a page so that it can load faster. Each of those threads has a different source port, and thus may route to a different target. In Colm's demo, it depends which thread your browser uses when requesting the part including the CSS which decorates the object. In my Chrome on Mac I see 6 TCP connections to the demo NLB

tcp4 0 0 192.168.100.101.49615 54.69.111.179.80 ESTABLISHED tcp4 0 0 192.168.100.101.49614 54.69.111.179.80 ESTABLISHED tcp4 0 0 192.168.100.101.49613 54.69.111.179.80 ESTABLISHED tcp4 0 0 192.168.100.101.49612 54.69.111.179.80 ESTABLISHED tcp4 0 0 192.168.100.101.49611 54.69.111.179.80 ESTABLISHED tcp4 0 0 192.168.100.101.49610 54.69.111.179.80 ESTABLISHED

Each of those will be routed to the same target, so it's up to your browser to decide which to use for what.

Re: AWS Network Load Balancer

#116

Post by gnur »

gregmac wrote: post #106

I have just finished setting up a new front-end for a few services (we are just about to start migrating production systems to it). I was aiming to use static IPs (for client firewall rules), and simplify networking configuration, so what I ended up with is an auto-scaling group of HAProxy systems that run a script every couple of minutes to assign themselves an elastic IP from a provided list. Route 53 is configured…

Have you tried/evaluated traefik? It sounds like it could do nearly everything you just mentioned.

Re: AWS Network Load Balancer

#117

Post by chronid »

discodave wrote: post #19
uji wrote: post #7

Earlier quoted context omitted.

Seems like this limitation has been for long time (since 2009). Curious to know how everyone has been using ELB. To me, ELB seems to be an unfinished product. It must be painful to first predict heavy load on your application and then notify AWS well in advance.

It's almost like AWS released what they thought was the best product at the time, regretted some of their decisions and then launched other product(s) to replace it.... In this case, it seems like the one-size-fits-all ELB has been replaced by ALB for those using containers, who want L7 LB, and don't need insanity-scale. NLB for those who want massive scale, a dumb pipe and/or need consistent IPs. They could have tri…

good > perfect is somewhat standard thinking in AWS.

Re: AWS Network Load Balancer

#118

Post by bogomipz »

toast0 wrote: post #102
bogomipz wrote: post #72

Earlier quoted context omitted.

Direct Server Return works at layer 3 not layer 2, its routing and encapsulation - IP in IP, GRE etc.

You can do it at layer 2 as well, but it requires that the load balancer have an interface on the same broadcast domains as the hosts.

I am confused at how this would work. Can you elaborate? Also broadcast domain is a layer 3 construct.

Re: AWS Network Load Balancer

#119

Post by takeda »

bogomipz wrote: post #73
takeda wrote: post #51

Earlier quoted context omitted.

I should have read the blog instead of skimming before responding. This appears as Layer 4 load balancing, IPVS is more of Layer 3. So the person who was voted down by mentioning HAProxy might not be too far off. It could be implemented through HAProxy + TPROXY enabled in the kernel[1]. Then just make sure that default gateway configured on targets routes back to the load balancer or it is the load balancer. [1] http…

>"This appears as Layer 4 load balancing, IPVS is more of Layer 3." No, IPVS is L4 load balancing. L3 load balancing would be a routing protocol plus ECMP.

Ah my bad, even the wiki link I posted said it is layer 4. I guess both solutions could be utilized then, perhaps it was IPVS then since it would be more performant than HAProxy.

Re: AWS Network Load Balancer

#120

Post by 9point6 »

paulddraper wrote: post #112
9point6 wrote: post #88

Earlier quoted context omitted.

It won't ever be possible to do this as the NLB runs a few network layers below where TLS runs

Does it? It has HTTPS health checks.

I expect the health-checking happens independently of the routing. The routing will just act upon a list of routes which is modified independently by the health check.
Post reply on HN