Question

Digital Ocean Load balancer has trouble accessing hosts behind the firewall

Posted November 2, 2017 2.6k views
UbuntuLAMP StackFirewallLoad BalancingUbuntu 16.04

I am running 2 droplets (LAMP) with service running on port 80.

Basically the setup looks like this..

                           Digital Ocean Firewall
                                     | 
                                     |                                
                                     |                                  
                                     |  +--------------+ +---+----------+
                                     |  | Web Server 1 | | Web Server 2 |
                                     |  +---+------+---+ +----------+---+
                                     |             ^                ^    
                                     |             |                |    
                                     |             |                |    
                                     |             |                |    
+---------+                          |             |                |    
| Visitor +--+                       |             |                |    
+---------+  |  +-----------------+----------------+                |    
             +->+ Load Balancer 1 |  |                              |    
                +-----------------+---------------------------------+  
                                     |
                                     |
                                     |

I want the port 80 on both these web servers to be accessible from the load balancer only.
Typically port 443 on the load balancer should forward the request to port 80 of either of these machines.
But it seems that the firewall is expecting the internal IP of the load balancer which I am not able to figure out.

Is there something wrong with the setup I am trying to make or any step I am missing ??

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
1 answer

I’m not sure how you currently have your firewall configured, but what you’ve described should be possible. Your incoming rule should be set to allow HTTP (tcp port 80) and you can specify the name of your load balancer as the source. If you’re not already using Droplet tags I recommend doing so and using the Droplet tag under the section “Apply to Droplets”. That will make it so that the Droplets running your service can only be accessed from the load balancer on port 80.

Just be sure to allow SSH as well for management.

Submit an Answer