AWS Load Balancer with a static IP address

Question

I have a set-up running on Amazon cloud with a couple of EC2 Instances running through a load balancer.

It is important that the site has a unique(static) IP or set of IPs as I'm plugging in 3rd party APIs which only accept requests made from IPs which have been added to their whitelist.

So basically unless we can give these 3rd parties a static IP or range of IPs that the requests from the site will always come from then we would be unable to make any calls to them.

Anyone knows how to achieve this as I know that Elastic IPs are not compatible with load balancers?

If I were to look up the IP of the load balancer DNS name (e.g. dualstack.awseb-BAMobile-ENV-xxxxxxxxx.eu-west-1.elb.amazonaws.com resolves to 200.200.200.200) would that IP be Static?

Any help/advise is greatly appreciated guys.

Answer 1

The ip addresses of your load balancer is not static. In any event, your incoming load balancer IP wouldn't be used for outgoing connections.

You could assign elastic IPs to the actual instances behind the load balancer, which would then be used for outgoing requests. You get 5 free elastic ips, and I believe you can apply for more if you need them.

Additionally if using a VPC and if your instances are in a private subnet then they will only be able to access the internet via the NAT instance(s) you setup, and you can of course assign an elastic IP to the NAT instances

Answer 2

You can attache an additional ENI (Elastic Network Interface) to an instance in your VPC. This way the ELB (Elastic Load Balancer) routes the incoming Internet requests to the web server, and the additional ENI will be used to connect to your 3rd party (or internal) requests (Management network)

You can see more details about it in the VPC documentations

Answer 3

This is an old question, but things have changed now.

Now you can create a Network ELB to get a LB with a static IP.

from https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html

• Support for static IP addresses for the load balancer. You can also assign one Elastic IP address per subnet enabled for the load balancer.

https://aws.amazon.com/blogs/aws/new-network-load-balancer-effortless-scaling-to-millions-of-requests-per-second/

Answer 4

Really the only way I am aware of doing this is by setting up your instances within a VPC and having dedicated NAT instances by which all outbound traffic is routed.

Here is a link to the AWS documentation on how to set up NAT instances:

http://docs.amazonwebservices.com/AmazonVPC/latest/UserGuide/VPC_NAT_Instance.html

Answer 5

You CAN attach an elastic IP to the instances BUT NOT to the ELB (which is what the client sees).

You could use a full reverse proxy layer 7 load balancer like HAProxy:

Or a commercial implementation like Loadbalancer.org or Riverbed (Zeus)

They both are in the AWS Marketplace:

Answer 6

Your outbound requests to your 3rd party APIs will NOT go out via the ELB/ALB. That's for incoming connections. If you need an inbound static IP you'll probably need to forego the loadbalancer (or figure out how to implement Anshu's suggestion to attach an elastic IP to the loadbalancers, the doc is light on details). Update: I found some documentation that ALB use static addresses (and I just tried binding an elastic IP to one to be sure and that failed). If you're talking about outbound connections see below:

• If your server is deployed in a public subnet you can attach an elastic IP to that host. Outbound communications will go out over that address.
• If your server is deployed in a private subnet there's a NAT gateway attached to it. All outbound traffic from your private subnet will go out over that interface.

Answer 7

You could use as already mentioned loadbalancer.org appliance in AWS. It would replace the AWS NAT instance and give greater functionality and include both Layer4 and Layer7, along with SSL termination and a WAF.

Best of all you get free support in your 30 day trial in AWS to help you get up and running.

Yes I am biased as I work for loadbalancer.org however I would say nothing ventured nothing gained.

Answer 8

You can use a DNS service like DNSMadeeasy that allows "ANAME" records. These act like an A Record but can be pointed at a FQDN or IP. So in this case you can point it to the ELB DNS.

Dave