Hi, everyone, and welcome back.
Now, in today's video, we are going to discuss about capturing the client IP behind LP.
Now, whenever you're working in organization, this is one of the very important topic that you will
be implementing for most of the use cases.
So let's go ahead and understand this in detail.
Now, in a typical setup where you have the elastic load balancer in place, the backend application
does not receive the IP address of the client.
For example, let's say that you have the EC two instance that is behind the load balancer.
Now you have a client with the IP address of 192 168 0.10.
So when a client sends a request to the elastic load balancer, the elastic load balancer will go ahead
and forward the request to the backend EC2 instance.
Now, in such case, the EC two instance here will know that the request of gate login dot PHP has come
from a resource with the IP address of one 7231 10.5 all right.
So you see got get request from one 7231 10.5 now although this looks good, but in many of the use
cases it is very important that the back end EC2 instance knows the IP address of the client that made
the request.
So for example, instead of one 7231 10.5 this easy to instance needs the original client IP, which
is 192 168 0.10 And this is what we are going to discuss in today's video.
Now, depending upon the load balancer type as well as the listener, the way in which the client IP
is forwarded to the backend server also changes.
For example, in classic load balancer for HTTP based listeners, client IP is forwarded by default
to the servers.
However, for TCP IP based listeners, proxy protocol needs to be enabled for application load balancer.
Client IP is passed with the request, so you have to use the x forwarded for header in the application
to capture the client address.
Now we will be discussing this from a tactical point of view as well because this is a little confusing.
So let's quickly hold on for a minute and just complete the theoretical part.
Now, when we discuss about the network load balancer, the client IP address preservation is enabled,
for instance, and IP type target groups with UDP and TCP UDP protocol.
So this is the default and you cannot disable it.
However, you can enable or disable the client IP preservation for TCP and TLS based target groups.
So let's do one thing.
Let's go ahead and quickly understand this from a practical point of view.
Now for today's video, I have a network load balancer and I have an application load balancer, both
of them.
Will be sending the request to the same EC2 instance that you see over here.
Now let's quickly open up and see what exactly the instance is hosting.
So from the browser, if I'll add the URL all it does, it states.
Welcome to Engine X.
Now from the EC two instance where the engine X is running, let's go ahead and quickly do a tale on
var log engine x access dot log.
All right.
We'll look into what exactly the request captures.
So first, let's go ahead and copy the DNS of the application load balancer.
And from a new tab, I'll quickly do a curl on the ALB DNS.
So at this stage, let's quickly wait.
All right.
We got a response back now.
You see, we had a gate request that was made and the IP address is the IP of the application load balancer.
In fact, if you want to just make it more simple, you can do test dot.
And now you see here for the request of test, the the IP address is the one of the load balancer.
Now here one more important point is mentioned with states that use the x forwarded for header in the
application to capture the client IP.
So the load balancer is also sending the client IP to the EC2 instance.
However, the application or the web server that is running in the AC two must use the x forwarded for
header as well.
Now let me also quickly show you so here you have the LP IP, but in the last you have the actual client
IP.
So this IP address that you see is the current IP address of my ISP that is assigned to me.
Now how is this specific IP address captured?
Let's do a control C.
Now if you quickly look into the configuration associated with Engine X, now again, from a practical
point of view in exams, you do not need to know about engine X in detail, but I'm just showing you
because it might help you in real world scenarios.
Now in the engine x log format over your first one is the remote addr.
So this is the address which is replaced by the IP address of the elastic load balancer.
Apart from that, you are also capturing the http x forwarded for.
So in here the IP address of the actual client will be replaced because anyways, load balancer is sending
the IP address of the client with the x forwarded for header.
So at the engine x level you capture it.
And this is the reason why at the last at the end of the line you see the IP address of the client.
All right, this is for the application load balancer.
Now, in case if you do not have it configured in the engine X, you will not see it.
So in the log format you will have to explicitly edit.
Now, going back again to the access log.
This time we will be sending the request to the EC two instance through the network load balancer.
So let's go back to the network load balancer.
I'll copy the DNS name.
We'll do a curl on nlrp3.
So let's quickly wait for a moment.
I'll quickly do a call.
Again, we got a response here.
Now, if you look into the log, we have the NLB txt log.
Now within here, you see the IP address is 1010.
So directly you're seeing the client IP address.
You do not really need to capture the x forwarded for header to find the client IP address if we are
using the network load balancer.
All right.
So I hope with this in a better terms, you understood on how the client IP can be captured.
Again, it all depends upon the listener and the elastic load balancer that you're using.
Now, before we conclude one more thing that I wanted to show you.
In fact, let's look into what target group this network load balancer is using.
It is using a target group called a sample Target group.
So let's go.
To the target groups, the sample target group.
Now, if you look into the attributes, there is one specific attribute related to preserve the client
IP address.
So this is the important attribute here.
Now, in case if you disable this specific attribute, let's go back to the load balancer.
Let's copy the Dennis again.
So from the CL, I will be running the same set of command on the demo NLB.
Let's also capture the logs again so when we do call this time.
You see, instead of the client IP.
This time we are seeing the load balancer IP for the get request on NLP.
All right.
So depending upon the requirements, you do have certain amount of flexibility.
However, most of the time in many of the use cases you will need the client IP address preservation
enabled.
So with this will conclude today's video.