Use ALB to load-balance IPv6 services

Example scenario

This topic uses the scenario shown in the following figure. A company wants to use an ALB instance to forward internet requests from IPv6 clients to IPv4 and IPv6 services within a Virtual Private Cloud (VPC). To achieve this, the company must create ECS instances with both IPv4 and IPv6 addresses, a dual-stack ALB instance in the VPC, and a server group with IPv6 enabled. Once configured, the ALB instance can route requests from IPv6 clients to the services on the backend IPv4 and IPv6 ECS instances.

Limits

• For information about the regions that support dual-stack ALB instances, see Regions that support dual-stack ALB instances.

• The dual-stack feature requires that you enable IPv6 for the vSwitches in the desired VPC zones.

• A dual-stack ALB instance can forward requests from IPv4 and IPv6 clients to IPv4 and IPv6 backend services. For more information, see ALB instance overview.

• You cannot upgrade an existing IPv4 instance to a dual-stack instance. You can only create new dual-stack instances.

• Server groups with the IP Version set to IPv4/IPv6 dual-stack can be added only to listeners or forwarding rules of dual-stack ALB instances.

Prerequisites

• You have created a VPC named VPC1 in the China (Shanghai) region, a vSwitch named VSW1 in Zone E, and a vSwitch named VSW2 in Zone G. An IPv6 CIDR block is enabled for VPC1, and IPv6 is enabled for both VSW1 and VSW2. After you enable an IPv6 CIDR block for the VPC, the system automatically creates an IPv6 gateway.

  If you plan to deploy the ALB instance in VSW1 and VSW2, note that an upgraded ALB instance reserves three IP addresses from each specified vSwitch: one virtual IP address (VIP) for providing services and two local IP addresses for communicating with backend servers. If a vSwitch has insufficient available IP addresses, instance creation fails. Ensure that VSW1 and VSW2 have enough available IP addresses. This limitation does not apply to non-upgraded ALB instances.

  Note

  • To ensure that all elastic capabilities of an upgraded ALB instance are available, we recommend that you reserve at least eight IP addresses in each vSwitch where the ALB instance is deployed.

  • To ensure connectivity between an upgraded ALB instance and its backend servers, if you have configured access policies (such as iptables or any other third-party security policy software) for your backend services, allow traffic from the CIDR block of the vSwitch where the ALB instance is deployed.

• You have registered a domain name and completed its ICP Filing.

Step 1: Create and configure ECS instances

1. Log on to the VPC console.

2. In the left-side navigation pane, click vSwitch.

3. Select the region of the vSwitch. In this example, China (Shanghai) is selected.

4. On the vSwitch page, find the target vSwitch. In the Actions column, choose Add Cloud Service > ECS Instance.

5. On the Elastic Compute Service buy page, click the Custom Launch tab. Create two ECS instances. Name the IPv4 instance ECS01 and the IPv6 instance ECS02. The security groups associated with both ECS instances must allow traffic on port 80. For more information, see Create an instance by using the wizard.

   Click to view the configurations of the ECS instances used in this topic

   ECS instance name	Region	VPC name	vSwitch	IP version	Image
   ECS01	China (Shanghai)	VPC1	VSW1 in Zone E	IPv4	Alibaba Cloud Linux 3.2104 LTS 64-bit
   ECS02	China (Shanghai)	VPC1	VSW2 in Zone G	IPv6 Note When you create an instance with an IPv6 address, select Assign IPv6 Address Free of Charge for the IPv6 parameter.	Alibaba Cloud Linux 3.2104 LTS 64-bit

6. Remotely connect to the ECS01 and ECS02 instances. For more information, see Connection methods.

7. On ECS01, run the following commands to deploy an NGINX service:

   yum install -y nginx
   systemctl start nginx.service
   cd /usr/share/nginx/html/
   echo "Hello World ! this is ipv4 rs." > index.html
   

8. On ECS02, run the following commands to deploy an NGINX service:

   yum install -y nginx
   systemctl start nginx.service
   cd /usr/share/nginx/html/
   echo "Hello World ! this is ipv6 rs." > index.html
   

9. Configure an IPv6 address for the ECS02 instance. For more information, see IPv6 communication.

   Note

   You can skip this step if your ECS02 instance uses the Alibaba Cloud Linux 3.2104 LTS 64-bit image and you selected Assign IPv6 Address Free of Charge for the IPv6 parameter during instance creation.

   1. Remotely connect to the ECS02 instance in the VPC.

   2. Configure the IPv6 address.

      Run the ip addr | grep inet6 or ifconfig | grep inet6 command.

      If the output resembles the following, an IPv6 address is already configured, and you can skip this step.

      [root@iZbpxxx fxe4Z ~]# ip addr | grep inet6
          inet6 ::1/128 scope host
          inet6 2408:4005:xxx:xxx:7cd5:aa9c/128 scope global dynamic noprefixroute
          inet6 fe80::xxx:cc1c/64 scope link noprefixroute

      1. If the command output does not contain inet6 information, IPv6 is disabled on the instance. You must enable the IPv6 service.

      2. If the command output contains inet6 information, the IPv6 service is enabled on the ECS02 instance and an IPv6 address is assigned. You can proceed to configure the IPv6 address.

Step 2: Configure IPv6 security group rules

You need to configure an IPv6 security group rule for the ECS02 instance to allow inbound requests from IPv6 clients.

1. Log in to the ECS console.

2. In the left-side navigation pane, choose Network & Security > Security Group.

3. In the top navigation bar, select the region of the security group. In this example, China (Shanghai) is selected.

4. On the Security Groups page, find the target security group and click Manage Rules in the Actions column.

5. On the details page of the security group, click the Inbound tab in the Rules section.

6. Click Add Rule, configure an IPv6 security group rule based on the following information, and then click Save.

   Parameter	Description
   Action	The action of the security group rule. In this example, select Allow.
   Priority	The priority of the security group rule. A smaller value indicates a higher priority. Valid values: 1 to 100. In this example, the default value 1 is used.
   Protocol type	The protocol type for inbound traffic that is allowed by the security group rule. In this example, select ALL ICMP (IPv6).
   Source	The IPv6 CIDR block to which you want to grant access. In this example, enter ::/0 to grant access to all IPv6 addresses. Note The source specified in this topic is only an example. You can grant access to a specific IPv6 CIDR block based on your business requirements.
   Destination (this instance)	The port range for inbound traffic that is allowed by the security group rule. If you set Protocol Type to ALL ICMP (IPv6), the destination port can be set only to Any (-1/-1) and cannot be modified.
   Description	Enter a custom description.

Step 3: Create an ALB instance

1. Log on to the ALB console.

2. On the Instances page, click Create ALB.

3. On the buy page, specify the following parameters, click Buy Now, and then follow the on-screen instructions to create the instance.

   This section describes only the parameters that are relevant to this topic. Use the default values for other parameters. For more information, see Create an ALB instance.

   Parameter	Description
   Region	Select the region where you want to deploy the instance. In this example, China (Shanghai) is selected.
   Network Type	Select the network type of the instance. The system assigns a private or public IP address based on your selection. In this example, Public is selected. Note Selecting Public for Network Type applies only to IPv4. The default network type for IPv6 is Public. This topic uses a public IPv6 address. You must perform the operations described in the final part of this step to change the IPv6 network type to public.
   VPC	Select the VPC where you want to deploy the instance. Note Make sure that IPv6 is enabled for the VPC.
   Zone ID	Select at least two zones. In this example, Shanghai Zone E and Shanghai Zone G are selected. Select a vSwitch in each selected zone. In this example, VSW1 in Zone E and VSW2 in Zone G are selected.
   IP Version	Select the IP version of the instance. In this example, Dual-stack is selected.
   Edition (Instance Fee)	Select the edition of the instance. In this example, Standard is selected.
   Instance Name	Enter a custom name for the instance.
   Service-linked Role	If you are creating an ALB instance for the first time, click Create Service-Linked Role to create a role named AliyunServiceRoleForAlb. The system attaches the AliyunServiceRolePolicyForAlb policy to this role to grant ALB permissions to access other cloud services. For more information, see System policies for ALB.

4. After you create a public dual-stack ALB instance, a public IPv6 address is required for the steps in this topic. Perform the following steps to change the IPv6 address of the ALB instance to a public address. For more information, see Protocol Version.

   1. Return to the Instances page, find the target ALB instance, and then click the instance ID.

   2. On the Instance Details tab, in the Basic Information section, find Network. Then, click Change Network Type to the right of IPv6: private.

   3. In the Change Network Type dialog box, click OK.

      After the network type is changed, the IPv6 network type is now public.

Step 4: Create a server group

1. In the left-side navigation pane, choose ALB > Server Groups.

2. On the Server Groups page, click Create Server Group.

3. In the Create Server Group dialog box, configure the following parameters and click Create.

   This section describes only the parameters that are relevant to this topic. Use the default values for other parameters. For more information, see Create and manage a server group.

   Parameter	Description
   Server Group Type	Select a backend type. In this example, Server Type is selected.
   Server Group Name	Enter a name for the server group.
   VPC	You can add only servers from the selected VPC to the server group. Note Make sure that IPv6 is enabled for the selected VPC and that the VPC is the one that you selected when you created the ALB instance.
   Backend Server Protocol	Select a backend protocol. In this example, HTTP is selected.
   Scheduling Algorithm	Select a scheduling algorithm. In this example, Weighted Round-robin is selected.
   IP Version	Select IPv4/IPv6 dual-stack.
   Session Persistence	Enable or disable session persistence. In this example, the default setting (disabled) is used.
   Health Check	Enable or disable health checks. In this example, health checks are enabled.
   Health Check Settings	After you enable health checks, you can click Edit to specify more settings.

4. On the Server Group page, find the server group that you created and click its ID.

5. Click the Backend Servers tab and then click Add Backend Server.

6. In the Add Backend Server panel, select the ECS01 and ECS02 instances. In the IP Address column, select the IPv4 address of the ECS01 instance and the IPv6 address of the ECS02 instance. Then, click Next.

7. On the Ports/Weights step, set the ports and weights for the ECS01 and ECS02 instances, and then click OK.

   In this example, the port for the ECS instances is set to 80 and the weight is set to the default value 100.

Step 5: Configure a listener

1. On the Instances page, find the target instance and click its ID.

2. Click the Listener tab and then click Create Listener.

3. In the Configure Listener wizard, specify the following parameters and click Next.

   This section describes only the parameters that are relevant to this topic. Use the default values for other parameters. For more information, see Add an HTTP listener.

   Parameter	Description
   Select Listener Protocol	Select the protocol for the listener. In this example, HTTP is selected.
   Listener Port	The listener port that receives and forwards requests to backend servers. In this example, enter 80.
   Listener Name	Enter a name for the listener.
   Advanced Settings	The default settings are used in this example. You can click Modify to change the settings.

4. In the Server Group configuration wizard, select the Server Type and the target server group under the Server Type, view the backend server information, and then click Next.

5. In the Confirm step, confirm the configurations and click Submit.

6. Click OK to return to the Listener tab. When the Health Check Status column for the target listener is Healthy, this indicates that the backend servers ECS01 and ECS02 can process requests forwarded by the ALB instance.

Step 6: Configure DNS resolution

For production, we recommend mapping a custom domain name to the ALB instance's domain name by creating a CNAME record.

1. In the left-side navigation pane, choose ALB > Instances.

2. On the Instances page, copy the DNS name of the created ALB instance.

3. Follow these steps to add a CNAME record.

   Note

   If your domain name is registered by a provider other than Alibaba Cloud, you must add the domain name to the Alibaba Cloud DNS console before you can configure DNS resolution. For more information, see Manage domain names. If your domain name is registered with Alibaba Cloud, proceed with the following steps.

   1. Log on to the Alibaba Cloud DNS console.

   2. On the Authoritative DNS Resolution page, find the target domain name, and click Settings in the Operations column.

   3. On the Settings page, click Add Record.

   4. In the Add Record panel, configure the CNAME record by setting the following parameters, and then click OK.

      Parameter	Description
      Record Type	Select CNAME from the drop-down list.
      Hostname	The prefix of your domain name. This tutorial uses @. Note To use a root domain, set the hostname to @.
      Query Source	Select Default.
      Record Value	Enter the DNS name of the ALB instance that you copied.
      TTL	Time to live (TTL) is the duration that a DNS record is cached on a DNS server. Use the default value.

Step 7: Test the connectivity

Use a client that can access the IPv6 network to test the connectivity to the ECS01 and ECS02 instances.

1. Open the command-line interface (CLI) on your computer.

2. Run the following command multiple times to test if an IPv6 client can access the IPv4 ECS and the IPv6 ECS through the ALB in a round-robin manner.

   curl -6 http://<your domain name> -v

   If a response similar to the following one is returned, the IPv6 client can access the IPv4 ECS instance.

   C:\Users\w***g>curl -6  http://xxx.com -v
   * Rebuilt URL to: http://xxx.com/
   *   Trying 2408:xxx:d3:c2b:df22:bc09...
   * TCP_NODELAY set
   * Connected to xxx.com (2408:xxx:f22:bc09) port 80 (#0)
   > GET / HTTP/1.1
   > Host: xxx.com
   > User-Agent: curl/7.55.1
   > Accept: */*
   >
   < HTTP/1.1 200 OK
   < Date: Wed, 07 Sep 2022 06:52:47 GMT
   < Content-Type: text/html
   < Content-Length: 31
   < Connection: keep-alive
   < Last-Modified: Wed, 07 Sep 2022 03:13:10 GMT
   < ETag: "63180c46-1f"
   < Accept-Ranges: bytes
   <
   Hello World ! this is ipv4 rs.

   If a response similar to the following one is returned, the IPv6 client can access the IPv6 ECS instance.

   C:\Users\wxxx>curl -6 http://xxx.s.com -v
   * Rebuilt URL to: http://xxx.com/
   *   Trying 2408:40xxx:df22:bc09...
   * TCP_NODELAY set
   * Connected to xxx.s.com (2408:xxx:22:bc09) port 80 (#0)
   > GET / HTTP/1.1
   > Host: xxx
   > User-Agent: curl/7.55.1
   > Accept: */*
   >
   < HTTP/1.1 200 OK
   < Date: Wed, 07 Sep 2022 06:53:04 GMT
   < Content-Type: text/html
   < Content-Length: 31
   < Connection: keep-alive
   < Last-Modified: Wed, 07 Sep 2022 03:13:50 GMT
   < ETag: "63180c6e-1f"
   < Accept-Ranges: bytes
   <
   Hello World ! this is ipv6 rs.

After you complete the preceding operations, IPv6 clients can access the IPv4 and IPv6 services deployed in the VPC through ALB in a round-robin manner.

Clean up resources

1. Clean up ECS instances, security groups, and related resources:

   1. Delete the ECS01 instance and its security group:

      1. Log on to the ECS console. In the top navigation bar, select the region where the instance is deployed. Find the ECS01 instance, click the icon in the Actions column, and then select Release. In the dialog box that appears, immediately release the instance and confirm the operation.

      2. Log on to the security group console. In the top navigation bar, select the region where the security group is deployed. Select the custom security group of the ECS01 instance and click Delete.

   2. Follow the preceding steps to delete the ECS02 instance and its security group.

2. Delete the DNS record:

   Delete the DNS record. For more information, see Delete a DNS Record.

3. Clean up ALB resources:

   1. Log on to the Application Load Balancer console. In the top navigation bar, select the region where the instance is deployed. Find the target instance, click the icon in the Actions column, and then select Release and confirm the operation.

   2. Remove the backend servers. For more information, see Manage backend servers.

   3. Delete the server group. For more information, see Create and manage a server group.

4. Clean up VPC resources:

   1. Log on to the VPC console and select the region where the instance is deployed.

   2. Find the target instance and click Delete in the Actions column. The system checks whether undeleted cloud resources or associated resources exist. If dependent resources exist, you must release all of them before you can delete the VPC and vSwitches.

Related topics

• For more information about the use cases and components of ALB, see What is Application Load Balancer?.

• For more information about the features of ALB, see Features.

• For more information about ALB quotas and how to increase a quota, see Quotas.

• For more information about the regions supported by ALB, see Regions and zones that support ALB.

• For more information about the billing methods, billable items, and pricing of ALB, see Billing overview of ALB.