Lecture 190: Hands On: NLB Proxy Protocol
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:10
- 来源：Udemy Lecture 28556007
- Slide 数量：7
- 画面切换：00:42、02:53、04:26、05:14、06:28、06:55
扫描说明
逐条读取了 Udemy 页面中的 147 条英文 Transcript cue，并按时间轴扫描全长约 07:10 的 Hands-on。依据 Web Server 准备、NLB 与 IP Target Group、启用前的 Source IP、Target Group Proxy Protocol v2、Apache RemoteIP 配置、启用后验证与资源清理划分为 7 个小节。截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 启动允许 SSH/HTTP 的 Amazon Linux Web Server
时间范围：00:00–00:42
总结 / Summary
中文
实验复用前讲思路：启动 Amazon Linux 2023 t2.micro，不使用 Key Pair，Security Group 同时允许 SSH 和 HTTP。User Data 安装、启动并启用 httpd，再写入包含 Hostname 的 Hello World 页面；先直接访问 Public IP，确认 Web Server 正常。
English
The lab repeats the earlier setup: launch an Amazon Linux 2023 t2.micro instance without a key pair and allow both SSH and HTTP in its security group. User data installs, starts, and enables httpd, then writes a hostname-based Hello World page. Verify the web server directly through its public IP first.
Transcript
00:00 So let's have a look at the proxy protocol.
00:02 For this, I'm going to launch an EC2 instance
00:04 just like before,
00:05 and I will launch a network load balancer.
00:08 So we'll use Amazon Linux 2023 T2 micro.
00:12 I will proceed without a key pair.
00:15 I will allow this time, SSH, and HTTP traffic,
00:18 this is perfect.
00:20 And then for advanced details yet again,
00:22 I'm going to choose user data file
00:26 that is the same as before to start an HTTP type of server.
00:33 Okay, so my instance is now running
00:35 and I can verify that the web server is working
00:38 and has been a while for me.
00:39 So yes it has, it is working, this is perfect.
2. 创建 NLB，并用 IP Address 注册 TCP/80 Target
时间范围：00:42–02:53
总结 / Summary
中文
创建 Internet-facing IPv4 Network Load Balancer demoNLB，选择 VPC、两个 Subnet 与允许 Port 80 的 Security Group。关键是 Target Group 选择 IP addresses，而不是 Instances；配置 TCP/80 后，从 EC2 详情复制 Private IPv4 并手动注册。这样 NLB 到 Target 的连接会显示 NLB 内部地址，便于验证 Proxy Protocol。
English
Create an internet-facing IPv4 Network Load Balancer named demoNLB across two subnets with a security group allowing port 80. The critical choice is IP addresses rather than instances for the target group. Configure TCP/80, copy the EC2 private IPv4 address, and register it manually. This causes the target connection to show the NLB internal address, making Proxy Protocol behavior observable.
Transcript
00:42 Now, I'm going to start a load balancer
00:44 and it's going to be a network load balancer.
00:47 So let's create a network load balancer
00:49 and we'll call this one demoNLB.
00:52 It's going to be internet facing of type IPv4.
00:55 I'm going to launch my VPC with two subnets for example.
00:59 And then for security group, I'm going to use the same one
01:02 as the ALB, which is going to allow access on port 80,
01:07 so this is perfect.
01:08 Now for listeners and routing,
01:10 I'm going to create a new target group.
01:12 And this one actually is very important,
01:15 we're going to have it not as instances of target type,
01:18 but as IP addresses.
01:20 Because when you use IP addresses, then the client,
01:23 the these two instances will see the IP address
01:26 of your network load balancer.
01:27 But if you use instances automatically,
01:30 the correct IP address and the correct port will be applied.
01:33 So we need to have the IP addresses here
01:37 so that we manually can verify
01:39 that the proxy protocol is being applied or not.
01:43 So let's choose IP addresses.
01:45 I'll call this one demo-nlb-proxy-protocol
01:50 on TCP port 80 and the rest is good.
01:54 So we need to enter an IPv4 of the VPC subnet
01:58 to add into our target.
02:01 So for this, let's go into our EC2 console yet again,
02:07 and I'm going to find my instance, click on it
02:11 and then look at this private IPv4 address.
02:14 So let's go here
02:16 and then we can paste that private IPv4 address,
02:20 so we're good to go.
02:21 Now click on include as pending below.
02:24 And as you can see now this target will be registered
02:27 and then create target group.
02:30 So now my target group is created in IP mode.
02:35 So now I'm going to go into my NLB, refresh this
02:37 and select my demo NLB proxy protocol target group.
02:42 Okay, so let's scroll down and create this load balancer
02:47 and I'm going to pause the video
02:49 until my low balancer is fully provisioned.
3. 启用前，NLB 访问在 Apache 中显示内部 NLB 地址
时间范围：02:53–04:26
总结 / Summary
中文
NLB Provisioned 后，DNS Name 能返回 Hello World。通过 EC2 Instance Connect 运行 tail -f 观察 Access Log：直接访问 Instance Public IP 时显示客户端 Public IP；通过 NLB 访问时却显示 172.31.x.x 的 VPC 内部地址，即 NLB 节点地址。原因是 Target 以 IP 注册，TCP Source IP 未被保留。
English
After the NLB is provisioned, its DNS name returns Hello World. In EC2 Instance Connect, tail the access log: direct access to the instance public IP shows the client public IP, while access through the NLB shows a 172.31.x.x VPC address belonging to the NLB node. Because the target is registered by IP, the TCP source IP is not preserved.
Transcript
02:53 So my network load balancer is now ready
02:55 and I can connect to it
02:56 and I still get my hello world.
02:58 So everything is set up,
03:00 now, let's go ahead and have a look at the proxy protocol.
03:03 So if I go to my instance
03:05 and then connect using EC2 instance connect
03:08 to open a shell into my instance
03:12 and then go back to my instances here, perfect, this one.
03:16 Okay, so into my instance,
03:18 we're going to do the same as we did before.
03:21 We are going to have a look at the access log.
03:23 So we're going to do sudo tail and then the access log
03:27 and then press Enter to just clean the screen.
03:31 And so if I go onto my instance right away
03:36 from the IP, public IP, as you can see now
03:40 the originating IP is my public IP.
03:44 So 185.128, et cetera. So that's my public IP.
03:48 If I try to access now my server BERT from VNLB,
03:55 as you can see now, the address I'm getting is
03:58 172. 31. 20. 43,
04:01 And this is actually the internal IP
04:05 of my network load balancer from within my DPC.
04:08 So it turns out that this is a bit of a problem
04:10 because I registered my instance as an IP address,
04:13 and now the instance sees originating traffic
04:17 being from within the VPC,
04:20 but this is actually just the network load balancer.
04:22 So we want to fix this
04:23 and we want to enable proxy protocol for that.
4. 在 Target Group Attributes 启用 Proxy Protocol v2
时间范围：04:26–05:14
总结 / Summary
中文
进入 NLB Target Group 的 Attributes，编辑 Traffic Configuration，启用 Proxy protocol v2，并在演示中同时打开 Preserve client IP addresses。Console 明确警告 Target Application 必须能够处理 Proxy Protocol Header，否则应用可能损坏。保存后仅改 Load Balancer 侧仍不够，Apache 尚未解析前置 Header。
English
Open the NLB target group attributes and edit traffic configuration to enable Proxy Protocol v2; the demo also enables preserve client IP addresses. The console warns that targets must be able to process Proxy Protocol headers or the application may break. Saving only the load-balancer-side change is insufficient because Apache still does not parse the prepended header.
Transcript
04:26 So let's go ahead in our target group
04:29 and you do action.
04:30 Actually, you go to our target group, sorry,
04:32 and you go to Attributes
04:34 and then you edit the attributes.
04:36 You scroll down,
04:37 and then you enable proxy protocol v2
04:39 as well as preserve client IP addresses,
04:43 and this is going to make sure
04:45 that you pass on information about your client IP address
04:49 to your downstream instances.
04:52 So let's say these changes,
04:54 and let's have a look at what happens.
04:55 So if I refresh
04:56 and have access to my instance right away,
05:00 nothing has changed.
05:00 I still see my IP and everything is good.
05:04 Now, if I go to my network load balancer
05:06 and refresh in here,
05:09 and what I see is
05:10 that my request still come from
05:11 within my internal IP address.
5. 在 Apache 启用 mod_remoteip 与 RemoteIPProxyProtocol
时间范围：05:14–06:28
总结 / Summary
中文
先运行 httpd -M 并筛选 remoteip，确认 remoteip_module (shared) 已加载；随后编辑 /etc/httpd/conf/httpd.conf，在 Listen 80 后加入 RemoteIPProxyProtocol On。保存配置，执行 systemctl reload httpd，再次 tail Access Log。这样 Apache 才能解析 NLB 发送的 Proxy Protocol v2 Header。
English
Run httpd -M and filter for remoteip to confirm that remoteip_module (shared) is loaded. Then edit /etc/httpd/conf/httpd.conf and add RemoteIPProxyProtocol On after Listen 80. Save, reload httpd with systemctl, and tail the access log again. Apache can now parse the Proxy Protocol v2 header sent by the NLB.
Transcript
05:14 So that's because we need to tell our HTTP server
05:18 to treat these requests as being from the proxy protocol.
05:22 So let's clear our screen
05:24 and then we're gonna go into our code proxy protocol
05:27 steps.md,
05:28 and we're going to make sure first
05:30 that this remote IP module exists.
05:33 So we're going to run this command,
05:35 and if we get remote IP module shared as a response,
05:39 that means that the module is successfully loaded.
05:43 Then we need to edit this http.confile
05:45 to add one line to enable the proxy protocol.
05:49 So let's edit this file
05:51 and then you can add the line wherever you want.
05:54 I'm going to add it right after the listen 80.
05:58 So I'm going to have a new line here
05:59 and you paste in remote IP proxy protocol on,
06:04 then you save your file and we're good to go.
06:08 Next, we need to reload our Apache server,
06:11 so let's reload it.
06:15 And finally, we need to run the same comment as before
06:18 to tell the access logs.
06:20 So let's do it, now we tell the access logs
06:24 and I'm going to do a bit of space to get new lines.
6. 经 NLB 刷新后，日志恢复真实客户端 Public IP
时间范围：06:28–06:55
总结 / Summary
中文
连续刷新 NLB DNS 页面后，Apache Access Log 中的 Source Address 从 NLB 的 172.31.x.x 变为用户真实 Public IP（演示为 185.128.x.x）。这证明 NLB 已把连接元数据随 Proxy Protocol v2 传入，且 Apache 的 RemoteIP 模块成功解析并替换日志中的客户端地址。
English
After repeatedly refreshing the NLB DNS page, the Apache access-log source changes from the NLB 172.31.x.x address to the user's real public IP (185.128.x.x in the demo). This proves that the NLB carries connection metadata through Proxy Protocol v2 and that Apache RemoteIP successfully parses it for logging.
Transcript
06:28 And now if I go into my network load balancer
06:30 and I refresh this page, I refresh it three times,
06:34 this way we can see a lot of outputs.
06:36 As you can see now, the IP that is being shown
06:39 is now the IP of my own personal public IP
06:43 and not the one from the network load balancer,
06:45 which proves that the proxy protocol is actually working
06:49 between my network load balancer and my EC2 instance.
06:53 So that's a pretty cool hands-on. I hope you liked it.
7. 结束后终止 EC2 并删除 NLB
时间范围：06:55–07:10
总结 / Summary
中文
实验完成后应 Terminate 临时 EC2 Instance，并删除 demoNLB；Target Group 和专用 Security Group 若不再使用也应清理。NLB 即使没有流量也可能持续计费，不能只停止测试访问。
English
After the lab, terminate the temporary EC2 instance and delete demoNLB. Remove the target group and dedicated security groups as well if they are no longer needed. An NLB may continue incurring charges even with no test traffic, so simply stopping access is not sufficient.
Transcript
06:55 And to just finish it, please make sure
06:58 to actually terminate your EC2 instance
07:01 as well as deleting your network load balancer.
07:05 So that's it. I hope you liked it,
07:07 and I will see you in the next lecture.
整讲总结 / Overall Summary
中文
本实验用 IP Address Target 的 TCP/80 NLB 复现 Source IP 丢失：启用前 Apache 看到 NLB 私网地址。随后在 Target Group 打开 Proxy Protocol v2，并在 Apache 启用 mod_remoteip 与 RemoteIPProxyProtocol On，日志恢复真实客户端 Public IP。验证结束后清理 EC2 与 NLB。
English
This lab reproduces source-IP loss with an NLB TCP/80 target registered by IP address: Apache initially sees the NLB private address. After enabling Proxy Protocol v2 on the target group and configuring Apache mod_remoteip with RemoteIPProxyProtocol On, the log shows the real client public IP. Clean up EC2 and NLB afterward.
返回顶部 ↑