Fixed IP address for service behind aws application load balancer

Question

our company just moved to a new office and therefore also got new network equipment. Es it turns out, our new firewall does not allow pushing routes over VPN that it first has to look up ip addresses for.

As we all know, amazon aws does not allow static ip addresses for its application load balancer.

So our idea was to simply put a network load balancer in front of the application load balancer (there is a pretty hacky way described by aws itself ( https://aws.amazon.com/blogs/networking-and-content-delivery/using-static-ip-addresses-for-application-load-balancers/ ) that seemed to work fine (even if I don't really like the approach with the lambda script registering and deregistering targets)

So here is our problem: as it turns out, the application load balancer only gets to see the network load balancers ip address. This prevents us to use security groups for ip whitelisting which we do quite heavily. On top of that some of our applications (Nginx/PHP based) also do ip address verification and the alb used to pass the clients ip address as an x-forwarded-for header. Now our application only sees the one from the nlb.

We know of the possibility to use the global accelerator but that is a heavy investment as we don't really need what the GA is trying to solve.

So how did you guys solve this problem?

Thankful for any help:)

Greetings

Answer 1

You could get the list of AWS IP addresses for the region your ALB is located, and allow for them in your firewall. They do publish the list and you can filter through it https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html

I haven't done this myself and I'm unsure if the addresses for ALB are included under the EC2 category of you would take the whole of AMAZON service "to be safe".

Answer 2

Can you expand on this? "We know of the possibility to use the global accelerator but that is a heavy investment as we don't really need what the GA is trying to solve." GA should give you better, more consistent performance, especially if your office is far away from the AWS Region where the ALB is running