I've created a Network Load Balancer for use with ECS Fargate. When I try to connect to the load balancer (using either the ELB domain name or it's IP addresses) it won't connect. I don't even see the connection in the flow logs. The machine I'm using to connect to the LB can reach the instances fine, but when I try to hit it through the load balancer I don't get a TCP connection. The security group on the Fargate containers allows anything from anywhere. The load balancer shows the instances health checks as "Healthy" but I still can't get to them.
Changing the ECS task definition to use awsvpc network mode instead of bridge mode resolved this issue for us.
Related
I set my load balancer to allow traffic on port 80 to the security group of my EC2 instance, but the load balancer refuses to connect. To do a sanity check, when I allow HTTP traffic from my IP to the load balancer, I'm able to connect seamlessly. I can only access the load balancer from my EC2 instance when I allow all traffic to port 80 on my load balancer. I keep checking back and forth to make sure the security group that the EC2 instance is in is the same as the one that the load balancer should allow, so I know it's not that. What else could be blocking the traffic?
Context: I used a load balancer because I wanted a static address for my EC2 instances to access and I don't want the IP to be dynamic. Basically, behind the load balancer is one coordinator instance that I want to manage jobs for the auto scaling EC2 instances. The load balancer can be internal for the purposes I need it for.
Network traffic between an EC2 instance and a public facing load balancer will go out to the Internet and back, it won't stay within the VPC. Once the request leaves the VPC it loses its association with the source security group, which is why your security group rule isn't working. If the EC2 instance has an Elastic IP address assigned to it, you could try adding that to the load balancer's security group instead.
There is probably a better way to do what you are trying to do without having your EC2 instance access a public load balancer. Perhaps the load balancer could be converted to an internal load balancer? Or maybe there is a better way for this EC2 server to communicate with the resources behind the load balancer directly somehow. You would need to post more information about your system and your desired goal for help with that.
I have looked all the issue but cannot find the issue as I'm working on https for rails on the EC2 so I have setup loading balance and security group, but it keep said instance is not working as it's mention 'OutOfService', i have look at the security group and all port is open
as it said Instance has failed at least the UnhealthyThreshold number of health checks consecutively. but when i open ip address from Ec2 dns address and it working fine
Check availability zones of both load balancer and ec2 instance. If both are in different zones make sure that you enabled cross zone load balancing in the classic load balancer. Also make sure that the ping target is TCP:80 in the Health check of the load balancer.
I am trying to setup a internal load balancer on GCP cloud , and the problem is, when i try to access the same via another instance which falls under same VPC I am facing "Connection refused" error. Firewall rules has been checked as well as cross checked that load balancer and standalone instance which is trying to access are in same subnet.
Internal load balancers are regional, i.e an instance in us-east cannot communicate with an internal load balancer in us-central, even within the same VPC.
You should make sure that your source VM's subnet is in the same region as your ILB's
As a potential workaround you could use this
I am trying to setup a TCP load balancer for ports 80 & 443. I have created an instance group and I can curl the instances and verify they are running. However the load balancer states the instances are unhealthy. I originally tried setting them up with health checks, but removed the health checks just to get the load balancer working. Even with the health checks removed, the load balancer says the nodes are unhealthy.
http://imgur.com/a/4Jefv
I'm also using Docker & Mesos, and changing the networking mode from Bridge to Host seems to have fixed the issue.
So I set up a proxy server in AWS EC2 (let's say EC2 A) under Elastic Load Balancer with AWS AutoScaling groups... So I have 5 of EC2 : A under this elastic load balancer that has one DNS server endpoint for this proxies.
Through this proxy DNS (e.g. http://myelb.elb.aws.com), I want to send HTTP request from EC2 B.
Then where should I set up the security group?
And what kind of security rules for this program flow?
I tried to add EC2 A to the Elastic Load Balancer but it keeps being OutofService, never got to InService mode.
OutofService indicates that your Elastic Load Balancer is either not ready, or the instances are failing their Health Check. If you point to the little "i" information icon, it will explain why an instance is not InService.
Within your Elastic Load Balancer, take a look at the Health Check tab and confirm that it is configured correctly. It will either be checking a URL (eg /index.htm) or checking a port (eg port 80). If your "A" servers are listening on port 80, the quickest way to pass the health check is to set it to TCP and set the Healthy Threshold to 2 attempts.
Your Security Groups should have these settings:
A Security Group on your Elastic Load Balancer (eg ELB-SG) that allows incoming traffic either from the whole Internet (0.0.0.0/0) or at least from your "EC2 B" instance (specifically, it should allow traffic where the source is the name of a security group associated with your B instance).
A Security Group on your "EC2 A" instances that allows incoming traffic from the security group on your Load Balancer (ELB-SG).
If you are worried that your Security Groups are incorrectly configured, start troubleshooting by opening up access to the entire Internet (0.0.0.0/0) and, once you have confirmed connectivity, progressively reduce access to the above settings.