(upbeat music)
- Hi, I'm Hannah, cloud Support Engineer
here at the AWS office in Sydney.
Sometimes I speak to customers,
who want their public facing ELB
to load balance EC2 instances
with private range IP addresses.
Thanks to network address translation NAT.
You don't have to expose the instances directly
to the internet, when you want them
to serve web content with a load balancer,
Let me walk you through the process
of setting up an example of a VPC and an ELB.
As you can see, I'm already signed in
to the AWS management console
and I'll navigate to the VPC console.
Click on the Start VPC wizard,
select the second option on the left hand menu,
VPC with public and private subnets,
Enter a name for your VPC.
Choose the same availability zone AZ for both the public
and the private subnet, So the ELB
and the EC2 instances can communicate with one another.
In this example, I'll choose ap-southeast-2b for both.
There are many settings on the section
can be left as is for the purpose of the video.
Public subnet will have the range of 10.0.0.0/24.
Private subnet will have the range of 10.0.1.0/24.
Choose an elastic IP address for the NAT gateway
and click on Create VPC
Wait a couple of minutes for the process to complete.
The wizard will create the subnets, route table,
default security group and NAT gateway for you.
As you can see the VPC was created successfully.
Now, let's create the ELB,
navigate to the EC2 console,
click on load balancers
and then Click on Create load balancer.
My example VPC is in one availability zone only,
So I'll choose the classic load balancer option ELB.
I'll name the ELB under create LB inside,
select the new VPC.
I'll leave the default port 80 listener as is,
scroll down at this point we can choose
which subnets to use.
The ELB must be accessible from the internet,
So let's place it under the public subnet.
Click on the plus sign next to the public subnet,
10.0.0.0/24,
hit next,
now let's create a security group for the ELB.
Select Create new security group,
Port 80 TCP is selected by default for HTTP traffic,
you can click Next, Close the security warning
and click Next.
Let's accept the default health Check values
and hit next.
We're asked to add EC2 instances.
We don't have any yet in the new VPC.
We'll do this later, So hit Next again
and add any optional tags, hit review
and create to review your set up,
hit Create when done.
The ELB was created successfully.
At this point we have an ELB with no web servers behind it
to test this classic load balancer,
let's go ahead and create a couple of basic ones,
back to the EC2 console,
We'll launch a new tier two micro instance
with Amazon Linux on it.
You can hit the next button till
you reach configure instance details.
The number of instances can be set to two,
under the network drop down
and you select the newly created VPC,
below select the private subnet
from the subnet drop down menu.
The value for auto assign public IP
should be set to disable, our instances
will have private IP addresses only.
Note that, while you will not be able to connect
to them using SSH from the internet,
you can connect to them from other hosts in your VPC.
I'll be passing a basic script to the instances
to install the Apache web server
another basic test web page.
You can do this with user data,
scroll down and expand the advanced detail section.
Enter the following lines into user data.
As you can see this basic user data script,
installs the Apache web server,
enables it to start automatically
the next time you boot,
starts it right now
and it also creates a basic test web page
that contains the EC2 instances host name.
Click on the next button,
till you reach configure security groups.
Our VPC has a default security group.
It's configured to allow all the traffic
in the security group itself,
This is enough for our needs our web servers need
to be able to communicate directly only with the ELB,
not with the outside world,
tick the box next to the default security group,
review and launch
and then launch with your existing private key.
We now have two new instances with private IP addresses
with the pattern of 10.0.1.X.
As you can see, they take a few moments to fully create.
Let's go back to a load balancers
and add the EC2 to instances,
click on load balancers On the left hand pane,
click on actions, edit instances,
Check the boxes next to both of the instances
and then hit save.
To allow the ELB to talk to the web servers,
click on actions, edit security groups,
check the box next to the default security group,
which allows old traffic within hosts
in the security group, save the changes,
if you accepted the default health check values earlier
of 30 sec interval
and healthy threshold of 10 health checks,
then it will take five minutes for the process to complete.
This depends on the health check values
you set up earlier on the ELB.
After five minutes, open a new browser tab
and navigate to the ELB's endpoint.
Refresh the page a few times,
it will display the host names of your web servers,
which consists of the private range IP addresses
of the instance, to recap we now have
two Apache web servers running on AC2 instances,
which are not exposed to the web,
behind the public ELB.
It's best practice to add HTTPS support
and an SSL certificate to your ELB.
Review our documentation on this topic.
Thanks for watching and happy cloud computing
from all of us here at AWS.
(upbeat music)