Lecture 189: Proxy Protocol
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：03:00
- 来源：Udemy Lecture 28556003
- Slide 数量：6
- 画面切换：00:26、01:14、01:27、02:08、02:35
扫描说明
逐条读取了 Udemy 页面中的 75 条英文 Transcript cue，并按时间轴扫描全长约 03:00 的视频。依据 TCP 层用途、Proxy Header 内容、CLB/NLB 版本、NLB Target/Protocol 保留矩阵、前置代理与 ALB 对比、IP Target 适用场景划分为 6 个小节。截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Proxy Protocol 是 TCP 层的客户端身份传递机制
时间范围：00:00–00:26
总结 / Summary
中文
当 NLB 或 CLB 终止连接、无法直接保留 Client Source IP 时，Proxy Protocol 用于把原始客户端信息传到后端。它与 HTTP 的 X-Forwarded Header 目的相似，但工作在更低的 TCP 层，因此适合不解析 HTTP 的 TCP/TLS 流量。
English
When an NLB or CLB terminates a connection and cannot directly preserve the client source IP, Proxy Protocol carries the original client information to the backend. Its purpose resembles HTTP X-Forwarded headers, but it operates at the lower TCP layer and therefore applies to TCP/TLS traffic that is not parsed as HTTP.
Transcript
00:00 Now let's talk about the Proxy Protocol.
00:03 And this is a solution to understanding
00:06 what is the originating IP of your clients, okay.
00:09 when your Network Load Balancer
00:11 or your CLB is not able to carry that information over.
00:15 And this is similar to what we have
00:17 with the HTP headers X-Forwarded, okay.
00:20 This one is for the
00:22 TCP, so it's a lower level type of feature.
2. Load Balancer 在 TCP Payload 前置 Proxy Header
时间范围：00:26–01:14
总结 / Summary
中文
Load Balancer 会在原始 TCP Data 前加一个 Proxy Header，写入 Source/Destination IP Address 与 Source/Destination Port。Backend 必须理解 Proxy Protocol，读取前置数据后再处理实际 Payload，才能恢复原始客户端地址。若应用不支持或没有启用解析，前置字节会被当成业务数据并可能导致错误。
English
The load balancer prepends a Proxy Protocol header to the original TCP data, containing source and destination IP addresses and ports. The backend must understand Proxy Protocol, parse the prepended information, and then process the real payload to recover the original client address. If the application does not support or enable parsing, those bytes may be treated as application data and cause errors.
Transcript
00:26 And so the idea is that, on top of the request
00:29 that is sent for example from the clients to the instance,
00:32 the NLB is going to prepend some data
00:35 and it's called the Proxy Protocol in the Proxy Header,
00:37 and in that information is going to include the
00:40 originating IP of your clients.
00:43 So this is a protocol that is used to carry information
00:45 from the source requesting the connection
00:46 to the destination, where the connection was requested.
00:49 And in case the LB does terminate the connection,
00:52 then of course the source IP cannot be preserved
00:55 and therefore it has to be prepended, okay,
00:57 using the Proxy Protocol.
00:59 So you will add the source destination IP address
01:01 and the port numbers.
01:02 Then it will be added as an editor to the TCP data.
01:05 And then the Institute instance,
01:06 when it reads the data, can understand,
01:08 can just look at the prepended data and find out
01:11 what IP the client had in the beginning.
3. CLB 使用 v1，NLB 使用 v2
时间范围：01:14–01:27
总结 / Summary
中文
Classic Load Balancer 使用 Proxy Protocol Version 1，Network Load Balancer 使用 Version 2。设计或排障时必须让 Target 端软件与 Load Balancer 发送的版本一致，不能只说“支持 Proxy Protocol”而忽略具体版本与编码格式。
English
Classic Load Balancer uses Proxy Protocol version 1, while Network Load Balancer uses version 2. Backend software must match the version sent by the load balancer; saying that an application supports Proxy Protocol is insufficient without confirming the specific version and encoding.
Transcript
01:14 So this is available for both the classic load balancer
01:17 and the Network Load Balancer.
01:19 Now, the CLB use diversion one of the Proxy Protocol,
01:23 and the Network Load Balancer use diversion two
01:25 of the Proxy Protocol.
4. NLB 是否需要 Proxy Protocol 取决于 Target Type 与 Protocol
时间范围：01:27–02:08
总结 / Summary
中文
NLB Target 以 Instance ID 或 ECS Task 注册时，Client Source IP 会自动保留，不需要 Proxy Protocol。以 IP Address 注册时，TCP/TLS 会终止且不保留 Source IP，应启用 Proxy Protocol；UDP 或 TCP_UDP 则保留 Client IP。考试题应先识别 Target Type，再看 Listener/Target Group Protocol。
English
For NLB targets registered by instance ID or ECS task, the client source IP is preserved automatically and Proxy Protocol is unnecessary. For IP-address targets, TCP/TLS does not preserve the source IP and should use Proxy Protocol, whereas UDP or TCP_UDP preserves the client IP. Exam questions should identify the target type first, then the listener and target-group protocol.
Transcript
01:27 So for the NLB, remember,
01:29 if you have specified your targets with instance IDs
01:32 or ECS tasks,
01:33 then automatically the source IP of the client
01:36 is going to be preserved,
01:37 So no need to use the Proxy Protocol in this case,
01:40 if you're using it with IP address,
01:42 then if you're using the TCP or TLS protocol,
01:46 then the source IP of the clients will not be preserved.
01:48 There will be a termination,
01:50 and therefore you need to enable the Proxy Protocol
01:52 to carry along that information
01:54 into your downstream Institute instances,
01:57 or servers because it's IP addresses,
01:59 So you have to register them manually
02:00 into your target group.
02:02 But if you're using UDP or TCP UDP,
02:04 then the source IP of the clients is going to be preserved.
5. 避免 Load Balancer 自身位于另一个 Proxy 后面
时间范围：02:08–02:35
总结 / Summary
中文
若 Load Balancer 前面还有 Proxy Server，后端可能收到重复的连接元数据并因配置不匹配而报错，需要结合实际链路验证。ALB 不需要 Proxy Protocol，因为它会在 HTTP 层自动插入 X-Forwarded-For 等 Header；两种机制应按负载均衡器层级选用，而非叠加。
English
If the load balancer itself sits behind another proxy server, the backend may receive duplicate connection metadata and fail because of configuration mismatches, so the actual chain must be tested. ALB does not need Proxy Protocol because it inserts HTTP X-Forwarded-For and related headers automatically; choose the mechanism by load-balancer layer rather than stacking them.
Transcript
02:08 So finally, if you want it to work properly,
02:11 the load balancer should not be
02:12 behind a proxy server itself.
02:14 Otherwise you may receive duplicate information
02:17 in the backend configuration,
02:18 and this is something you just see
02:20 with your application and your setup.
02:22 Now, as you know,
02:23 the Proxy Protocol is not needed when you have an ALB,
02:27 because the ALB will insert it to make clear headers
02:30 X 44, for example, to get the source client's IP.
6. 典型场景是 NLB 的跨 VPC或本地 IP Target
时间范围：02:35–03:00
总结 / Summary
中文
课程把 Proxy Protocol 的重点场景归纳为：NLB Target Group 以 IP Address 手动注册，并使用 TCP 或 TLS。IP Target 可能是 On-premises Server，也可能是通过 VPC Peering 可达的另一 VPC 中的 Instance；此时后端若需要原始 Client IP，就应启用并解析 NLB Proxy Protocol v2。
English
The course reduces the key use case to an NLB target group with manually registered IP-address targets using TCP or TLS. Those IP targets may be on-premises servers or instances in another VPC reachable through VPC peering. If the backend needs the original client IP, enable and parse NLB Proxy Protocol v2.
Transcript
02:35 So the Proxy Protocol remember is only helpful,
02:38 when your targets in your target group are registered
02:41 using IP addresses, okay.
02:43 So you have to hard-code the IP address,
02:44 it could be on premises servers
02:46 or institute instances in other VPC
02:49 that you're paired with.
02:50 And then this only applies if you're using the TCP
02:52 or TLS type of protocol for your NLD.
02:56 So that's it.
02:57 I hope you liked it.
02:58 And I will see you in the next lecture.
整讲总结 / Overall Summary
中文
Proxy Protocol 在 TCP 层通过前置 Header 传递原始 Source/Destination IP 与端口。CLB 用 v1，NLB 用 v2。NLB 的 Instance ID/ECS Target 自动保留客户端 IP；IP Target 的 TCP/TLS 需要 Proxy Protocol，UDP/TCP_UDP 会保留 IP。ALB 已有 X-Forwarded Header，不使用 Proxy Protocol。
English
Proxy Protocol carries original source/destination IPs and ports in a header prepended at the TCP layer. CLB uses v1 and NLB uses v2. NLB instance-ID/ECS targets preserve client IP automatically; IP targets using TCP/TLS need Proxy Protocol, while UDP/TCP_UDP preserves the IP. ALB relies on X-Forwarded headers instead.
返回顶部 ↑