21

What is the difference between the internal and external load balancer?

Assume I created an internal load balancer inside a VPC. Is it possible to access the internal load balancer outside the VPC?

Consider I have two AWS accounts A and B. I created an internal load balancer in account A. Is it possible to attach the internal load balancer to Route 53 in account B?

Castro Roy
  • 7,623
  • 13
  • 63
  • 97
Nithin
  • 9,661
  • 14
  • 44
  • 67

3 Answers3

31

An internal load balancer is assigned to a private subnet and does not have a public IP. It cannot be accessed by a client not on the VPC (even if you create a Route53 record pointing to it). If you want clients to be able to connect to your load balancer who are not on the VPC, you need to set up an internet-facing load balancer.

An internal load balancer routes traffic to your EC2 instances in private subnets. The clients must have access to the private subnets.

Sean Vieira
  • 155,703
  • 32
  • 311
  • 293
9

The nodes of an Internet-facing load balancer have public IP addresses. The DNS name of an Internet-facing load balancer is publicly resolvable to the public IP addresses of the nodes. Therefore, Internet-facing load balancers can route requests from clients over the Internet.

The nodes of an internal load balancer have only private IP addresses. The DNS name of an internal load balancer is publicly resolvable to the private IP addresses of the nodes. Therefore, internal load balancers can only route requests from clients with access to the VPC for the load balancer.

Ref: https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-internal-load-balancers.html

look3y
  • 356
  • 3
  • 5
  • 5
    "The nodes of an Internet-facing load balancer have public IP addresses." - not exactly true. it is common practice to keep your EC2 instances private, but allow internet access through a public load balancer. – SteamDev Sep 20 '19 at 16:04
  • 2
    I guess something to bring to the attention of AWS since its mentioned in their documentation [here](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-internal-load-balancers.html) – look3y Sep 23 '19 at 08:07
  • 11
    The statement is correct - the nodes of the load-balancer are not the EC2 instances that they front. – Dermot Williams Sep 30 '19 at 21:20
3

It is possible to access the internal load balancer outside the VPC.

You need to have an IP route to the private addresses. In your example you might have a VPC-A in AWS account A and VPC-B in AWS account B.

If you connect those 2 VPC for example via AWS VPC Peering (or any other method) and you have proper routing tables configured to route the IP traffic between the two VPCs (or subnets) then you can access the private ALB in VPC-A from the VPC-B.

Harald Svab
  • 31
  • 1