Manage a load balancer's network and security groups

A load balancer’s Network tab holds its public IP and its VPCs, and its Security Group tab holds its security groups. Your users reach your servers only when two sets of rules agree: the load balancer’s security group lets your users in, and each server’s security group lets the load balancer in.

Before you begin

• The load balancer reads Running or Backend Connection Failure, the statuses in which the Network and Security Group tabs are available.
• Any VPC you plan to attach is in the load balancer’s region and has finished Creating. See Create a VPC.
• Any security group you plan to attach has the rules you need. See Create a security group.
• Your role in the project has the update permission for Load Balancers.

See the network

In MyAccount, under Compute, click Load Balancers, click the load balancer, and open its Network tab. It shows:

• Public IP, marked (Reserved) once you reserve it.
• Associated VPC, with each VPC’s VPC Name, Subnet Name, IP, and Network Mask, or No VPC attached.

The list’s Private IP column shows the first VPC address, or the load balancer’s private IP when no VPC is attached.

Reserve the public IP

Reserve the public IP of an external load balancer to keep the address when you delete the load balancer, for your next one or for a node.

1. On the Network tab, next to Public IP, click Click here. Or, on the Info tab, click Reserve Public IP.
2. In Reserve IP Address, click Reserve IP. The IP stays yours after the load balancer is deleted, and each reserved IP has a monthly charge.

Public IP then reads (Reserved). A reserved IP is billed until you release it; see Reserved IP and E2E’s pricing page.

A reserved IP you already own becomes a load balancer’s public IP only when you create the load balancer, under IPV4 on Peak Performance Features. A load balancer has one public IP and takes no add-on IP. A Floating IP attaches only to nodes.

Attach a VPC

Attach a VPC to reach servers at their addresses in that VPC, or to make an internal load balancer reachable from another VPC. You can attach up to three VPCs. The load balancer talks over its VPC address only with resources in the same VPC.

Attaching the first VPC removes the load balancer’s private IP. From then on, it reaches your servers from its VPC address, so your servers need an address in that VPC.

1. On the Network tab, under Associated VPC, click Click here when no VPC is attached, or + to attach another.
2. In Attach VPC, under Select VPC, pick one of your VPCs in the region that has finished Creating and is not yet attached to this load balancer.
3. (Optional) For a custom VPC, pick a subnet under Select Subnet (Optional). The load balancer takes its VPC address from that subnet. Each subnet shows how many of its addresses are in use; pick one with addresses free.
4. Confirm, and the VPC attaches with VPC attached successfully.

The VPC is attached once the load balancer reads Running again.

After you attach the first VPC:

1. On Backend Mapping, change each server’s Server IP to its address in the VPC. See Add or change servers.
2. In each server’s security group, allow the server port from the load balancer’s VPC address. See Allow traffic from the load balancer to your servers.

Detach a VPC

1. On the Network tab, in the VPC’s row, click Detach VPC, and confirm.

VPC detached successfully shows, and the detach takes effect once the load balancer reads Running again. Detaching the last VPC gives the load balancer a private IP again. Then:

1. On Backend Mapping, change each Server IP back to the node’s private IP.
2. In each server’s security group, allow the server port from the load balancer’s private IP, shown in the list’s Private IP column.

An internal load balancer must have at least one VPC. To move it to another VPC, attach the new one first, then detach the old one.

Allow traffic to the load balancer

The load balancer’s security group must allow its listening ports from your users: 80 for HTTP, 443 for HTTPS, both for Both (HTTP and HTTPS), and each LB Listening Port on a Network Load Balancer. Allow only these ports, from the addresses that need them. Your project’s default security group allows all traffic.

The load balancer accepts connections only on ports 80 and 443, and on each LB Listening Port of a Network Load Balancer. A security group rule for any other port leaves that port closed.

To test the load balancer, connect to a listening port; it does not answer ping, whatever its security group allows. On an Application Load Balancer that serves HTTP or Both (HTTP and HTTPS):

curl -I http://<load-balancer-ip>/

On one that serves HTTPS only, use your domain, since the certificate covers the domain:

curl -I https://<your-domain>/

On a Network Load Balancer, connect to a listening port:

nc -zv -w 5 <load-balancer-ip> <listening-port>

<load-balancer-ip> is the load balancer’s Public IP, <your-domain> a domain pointed at it, and <listening-port> a group’s LB Listening Port. For an internal load balancer, run the command from a machine in the same VPC, with the VPC address shown in the list’s Private IP column.

Allow traffic from the load balancer to your servers

Each server’s security group must allow the server port from the load balancer:

• Without a VPC, from the load balancer’s private IP, in the list’s Private IP column.
• With a VPC, from the load balancer’s address in that VPC, on the Network tab.

See Add or edit rules. A firewall inside the server’s operating system needs the same rule.

Change the load balancer’s security groups

The Security Group tab lists each attached group with its description and its Inbound Rules and Outbound Rules. Each rule shows its Protocol, Port Range, Network Type, First IP Address, and Size. The security groups work as they do on a node:

• To add groups, click Attach Security Group, find a group by name, pick one or more, and confirm; the groups attach with Security Group Attached Successfully. When no group is left to attach, the tab says No more Security Groups are available.
• To rule out the security group while you test, click Allow All Traffic. It attaches one more group that allows all inbound and outbound traffic, and that group stays until you detach it. Detach it when the test is done. The load balancer still accepts connections only on its listening ports.
• To remove one, click Detach on it, and click Confirm in Detach Security Group. Security Groups Detached Successfully confirms it. The load balancer must have at least one security group. To replace the last one, attach the new group first, then detach the old one.

For the rules themselves, see Security Group.

Check the network

When the load balancer reads Running again, the Network tab shows the reserved IP and the attached VPCs with their addresses, and the Security Group tab lists the groups you attached. Open the load balancer’s address from a client, and your application opens.

If the load balancer reads Backend Connection Failure after a VPC or security group change, see The load balancer shows Backend Connection Failure.