Nginx Loadbalancer with private Network (Firewall Rules)

Question

Dear Digital Ocean Community

I am currently setting up our new hosting environment which includes 2 nginx load balancers and 2 nginx webserver. My setup looks like this so far:

Amazon Route 53 -> Load Balancer 1 (Public IP : 128.199.160.xxx) -> Web1 (Private IP: 10.130.224.xxx) & Web2 (Private IP: 10.130.221.xxx)

Amazon Route 53 -> Load Balancer 2 (Public IP : 128.199.150.xxx) -> Web1 (Private IP: 10.130.224.xxx) & Web2 (Private IP: 10.130.221.xxx)

On both Webserver I configured the following Firewall Rules: [ 2] 80 ALLOW IN 10.130.224.xxx (Private IP Load Balancer1 ) [ 3] 80 ALLOW IN 10.130.221.xxx (Private IP Load Balancer2)

On both Load Balancers I opened only port 80 from anywhere.

I would like to limit permissions to the 2 web server so only the Load Balancers have access to them. Is this setup correct? I am not exactly sure how the nginx load balancing works as so far I only used ELB from aws.

Will clients every talk directly to the web servers or will all traffic go trough the loadbalancers at all time?

Would really appreciate your help on this to be sure that this configuration will work.

Thank you in advance.

info650411 · Answer

Hi Kamal thanks again for taking the time to answer my questions. I will configure the same settings on both servers. Have a great weekend ;-)

info650411 · Answer

Hi Kamal

Thank you very much for your quick response and the great answer ;-)

May I ask you another question? I saw many replies from you in other threads and it looks like you know what you’re doing ;-)

On which server should I configure compression (gzip) and expire rules? So far I always used the h5bp nginx config (https://github.com/h5bp/server-configs-nginx)

Does it make sense to apply the same configuration to the loadbalancers and the webservers or is it enough to set compression, caching and expire rules only on one of the servers? In case only one server which should it be? The load balancer or the webserver?

Thank you again for your efforts! Really appreciate it ;-) Menelik

ps: how can I change my display name in the community? Instead of my name only the first part of my email “info” is shown . Tried to find it in the control panel but no luck so far.

Kamal Nasser · Answer

Is this setup correct?

Looks like it is. Make sure your firewall denies all other requests by default, otherwise you will need to explicitly block all traffic to port 80 from anything that isn’t your load balancers.

Will clients every talk directly to the web servers or will all traffic go trough the loadbalancers at all time?

No, the clients will only talk to the load balancers. The connections are proxied through the load balancers to your webservers, so only the load balancers will connect to your webservers.

Basically, it would look something like this:

                                     +-----------------------+           
                                     |                       |           
                                     |                       v           
                                     |  +--------------+ +---+----------+
                                     |  | Web Server 1 | | Web Server 2 |
                                     |  +---+------+---+ +----------+---+
                                     |      ^      ^                ^    
                                     |      |      |                |    
                +-----------------+---------+      |                |    
             +->+ Load Balancer 1 |  |             |                |    
+---------+  |  +-----------------+--+             |                |    
| Visitor +--+                                     |                |    
+---------+  |  +-----------------+----------------+                |    
             +->+ Load Balancer 2 |                                 |    
                +-----------------+---------------------------------+

Question

Nginx Loadbalancer with private Network (Firewall Rules)