Use an EIP with Anti-DDoS (Enhanced) to enable public network access for NLB - Server Load Balancer

Alibaba Cloud Elastic IP Addresses (EIPs) offer EIPs with Anti-DDoS (Enhanced), which provide professional DDoS mitigation capability at the Tbps level. These are suitable for scenarios that require high security protection and low latency, such as large-scale online games and major live streaming events. This topic describes how to attach an EIP with Anti-DDoS (Enhanced) to a Network Load Balancer (NLB) instance and use it to enable public network access. image..png

About EIPs with Anti-DDoS (Enhanced)

Alibaba Cloud provides EIPs with Anti-DDoS (Enhanced). When you purchase an EIP instance, you can select this option in the Elastic IP Address console. EIPs with Anti-DDoS (Enhanced) deliver Tbps-level professional DDoS mitigation capability in native protection mode. With these EIPs, you do not need to configure additional Anti-DDoS Proxy services or change your business IP addresses. For more information, see EIP with Anti-DDoS (Enhanced).

Limits

The region of the NLB instance must match the region of the EIP with Anti-DDoS (Enhanced).

Usage limits for EIPs with Anti-DDoS (Enhanced)

Only pay-as-you-go EIPs with BGP (Multi-ISP) line type support Anti-DDoS (Enhanced).
When you specify an IP address pool to create an Anti-DDoS (Enhanced) EIP, the IP address pool must also be of the Anti-DDoS (Enhanced) type.

Regions that currently support Anti-DDoS (Enhanced):

Regions that support EIPs with Anti-DDoS (Enhanced)

Area	Region
China	China (Beijing), China (Hangzhou), China (Shanghai), China (Hong Kong)
Asia-Pacific	Philippines (Manila), Japan (Tokyo), Singapore, Malaysia (Kuala Lumpur), Indonesia (Jakarta)
Europe and Americas	US (Virginia), US (Silicon Valley), Germany (Frankfurt), UK (London)

Regions that support IP address pools with Anti-DDoS (Enhanced)

Area	Region
China	China (Hong Kong)
Asia-Pacific	Philippines (Manila), Japan (Tokyo), Singapore, Malaysia (Kuala Lumpur), Indonesia (Jakarta)
Europe and Americas	US (Virginia), US (Silicon Valley), Germany (Frankfurt), UK (London)

Usage limits for attaching EIPs with Anti-DDoS (Enhanced) to NLB instances

To associate an NLB instance with an EIP protected by Anti-DDoS Pro/Premium, make sure that the EIP is not associated with an Internet Shared Bandwidth instance. After associating the NLB instance with the EIP protected by Anti-DDoS Pro/Premium, you can associate the EIP with shared bandwidth in the Server Load Balancer console. EIPs protected by Anti-DDoS Pro/Premium can be associated only with Internet Shared Bandwidth instances that use BGP (Multi-ISP) lines.

Billing overview

After attaching an EIP with Anti-DDoS (Enhanced) to an NLB instance, you incur security protection fees charged by the Anti-DDoS service. NLB绑定高防EIP

Charge item	Billing formula	References
Instance fee	`Instance fee = Instance unit price (USD/hour) × Billing duration (hours)`	Instance fee
LCU fee	`LCU fee = max{New Connections LCU value, Concurrent Connections LCU value, Data Volume LCU value, Rule Evaluations LCU value} × LCU unit price × Billing duration (hours)`	Load balancer capacity unit (LCU) fee
Public network fee	Private NLB does not incur Internet data transfer fees, and you are charged Internet data transfer fees only when you purchase a public NLB. After you attach NLB to an EIP with Anti-DDoS (Enhanced), the EIP incurs instance fees and traffic fees. For more information, see pay-as-you-go.
Security protection fee	Attaching an EIP with Anti-DDoS (Enhanced) to an NLB instance incurs security protection fees. For more information, see Anti-DDoS Origin 2.0 (pay-as-you-go). Warning The Anti-DDoS Origin (pay-as-you-go) service activated when purchasing an EIP with Anti-DDoS (Enhanced) is billed monthly and requires a minimum active period of 30 days. You cannot deactivate the service within 30 days of activation.

Prerequisites

You have created a virtual private cloud (VPC) named VPC1. For more information, see Create a VPC.
You have created ECS01 and ECS02 instances in VPC1 and deployed two different Nginx services on them.
- For instructions on creating ECS instances, see Custom purchase of instances.
- For instructions on deploying Nginx, see Manually deploy an LNMP environment (CentOS 7).
You have created an NLB server group named RS01 and added ECS01 and ECS02 as backend servers. For more information, see NLB server groups.
If you plan to use Internet Shared Bandwidth, you must purchase it first. In this example, you have purchased BGP (Multi-ISP) Internet Shared Bandwidth. For more information, see Create and manage Internet Shared Bandwidth.

Configuration workflow

配置流程

Step 1: Create an EIP with Anti-DDoS (Enhanced)

Before attaching an EIP with Anti-DDoS (Enhanced) to an NLB instance, go to the Elastic IP Address console to purchase one.

Log on to the Elastic IP Addresses console.
On the Elastic IP Addresses page, click Create EIP.
On the Elastic IP Address creation page, if this is your first time purchasing an EIP with Anti-DDoS (Enhanced), follow the on-screen instructions and click Anti-DDoS Origin (pay-as-you-go) to activate the Anti-DDoS Origin (pay-as-you-go) service.

Warning
The Anti-DDoS Origin (pay-as-you-go) service activated when purchasing an EIP with Anti-DDoS (Enhanced) is billed monthly and requires a minimum active period of 30 days. You cannot deactivate the service within 30 days of activation.

After activating the Anti-DDoS Origin (pay-as-you-go) service, log on to the Traffic Security console. Then, navigate to Network Security > Anti-DDoS Native > Billing Management or Network Security > Anti-DDoS Native > Instance Management to view details of your activated Anti-DDoS Origin instance.

After activating Anti-DDoS Origin, on the Elastic IP Address creation page, configure the EIP as follows and click Buy Now to complete payment.

This section lists only configuration items relevant to this topic. For other parameters, see Request an EIP.

Configuration	Description
Billing Method	Select a billing method for the EIP. In this example, select Pay-as-you-go.
Region	Select a region for the EIP. Ensure the EIP region matches the region of your NLB instance. In this example, select China (Hangzhou).
Line type	Select a line type for the EIP. In this example, select BGP (Multi-ISP).
Security protection	Select a security protection level based on your business needs. In this example, select Anti-DDoS (Enhanced). Default: Provides basic DDoS mitigation capability up to 5 Gbps. Anti-DDoS (Enhanced): Provides professional DDoS mitigation capability at the Tbps level.
Traffic	Select a metering method for EIP traffic. In this example, select Pay-by-traffic.
Quantity	Select the number of EIPs with Anti-DDoS (Enhanced) to purchase based on your business needs.

Step 2: Attach the EIP with Anti-DDoS (Enhanced) to an NLB instance

You can attach an EIP with Anti-DDoS (Enhanced) when creating a new NLB instance or changing the network type of an existing NLB instance. Choose the appropriate scenario based on your needs.

New NLB instance

When creating a new NLB instance, you can select an existing EIP with Anti-DDoS (Enhanced) on the purchase page.

Log on to the NLB console.
In the top navigation bar, select the region of the NLB instance. In this example, select China (Hangzhou).
On the Instances page, click Create NLB.
On the Network Load Balancer (Pay-as-you-go) International Site purchase page, complete the following configurations and click Create Now. Then, follow the on-screen instructions to complete payment.
This section lists only configuration items relevant to this topic. For other parameters, see Create an NLB instance.
- Network Type: Select Public.
- VPC: Select the existing VPC1.
- Zone: Select zones and vSwitches, and assign the created EIP with Anti-DDoS (Enhanced) to the selected zones.
  Note
  
  NLB supports multi-zone deployment. If the region supports two or more zones, select at least two zones to ensure high availability. NLB does not charge extra fees for multiple zones.
  
  If no vSwitch exists in a zone, create one as prompted by the console.
  
  A single NLB instance can use both an EIP with Anti-DDoS (Enhanced) and a default security protection EIP. The default option Automatically assign public IP creates a pay-as-you-go (pay-by-traffic) BGP (Multi-ISP) default security protection EIP.
Configure a listener for the NLB instance. In this example, a TCP listener is configured using the existing NLB server group RS01.
1. Return to the NLB Instances page. In the Actions column of the target instance, click Create Listener.
2. In the Configure Listener wizard, configure the listener parameters and click Next.
  This section lists only some parameters. Keep other parameters at their default values. For more information, see Add a TCP listener.
  - Listener Protocol: In this example, select TCP. Configure as needed.
  - Listener Port: Set to 80.
3. In the Select Server Group wizard, select the existing RS01 server group and click Next.
4. In the Configuration Review wizard, confirm the settings and click Submit.

Existing private NLB instance

To attach an EIP with Anti-DDoS (Enhanced) to an existing private network NLB instance, you can assign an EIP with Anti-DDoS (Enhanced) to the NLB instance when changing the network type.

Log on to the NLB console.
In the top navigation bar, select the region of the instance. In this example, select China (Hangzhou).
On the Instances page, find the target private NLB instance and click its instance ID.
On the Instance Details tab, in the Basic Information section, click Change Network Type next to IPv4 under Network Type.
In the Change Network Type dialog box, set IP Address Type to EIP. In the Assign EIP drop-down list, select the EIP with Anti-DDoS (Enhanced) created in Step 1: Create an EIP with Anti-DDoS (Enhanced). Click OK.

A single NLB instance can use both an EIP with Anti-DDoS (Enhanced) and a default security protection EIP. Selecting Purchase EIP creates a pay-as-you-go (pay-by-traffic) BGP (Multi-ISP) default security protection EIP.

Existing public NLB instance

If your public network NLB instance is already attached to a default security protection EIP, you must attach this NLB instance to an EIP with Anti-DDoS (Enhanced). Perform the following steps:

Change the public NLB instance to private.
When changing the network type, assign the EIP with Anti-DDoS (Enhanced) to the private NLB instance.

Note

When you create a public NLB instance, the default option Automatically assign public IP attaches a pay-as-you-go (pay-by-traffic) BGP (Multi-ISP) default security protection EIP.

公网ALB实例绑定高防EIP

Step 1: Change the public NLB instance to private

On the Instances page, find the target public NLB instance and click its instance ID.
On the Instance Details tab, in the Basic Information section, click Change Network Type next to IPv4 under Instance Details.
In the Change Network Type dialog box, confirm the impact of the change and click OK.

This change takes about one minute to take effect. On the Instance Details tab, when Network Type changes to Private, the conversion is complete.

Step 2: Change the private NLB instance back to public

On the Instances page, find the target private NLB instance and click its instance ID.
On the Instance Details tab, in the Basic Information section, click Change Network Type next to IPv4 under Network Type.
In the Change Network Type dialog box, set IP Address Type to EIP. In the Assign EIP drop-down list, select the EIP with Anti-DDoS (Enhanced) created in Step 1: Create an EIP with Anti-DDoS (Enhanced). Click OK.

A single NLB instance can use both an EIP with Anti-DDoS (Enhanced) and a default security protection EIP. Selecting Purchase EIP creates a pay-as-you-go (pay-by-traffic) BGP (Multi-ISP) default security protection EIP.

(Optional) Step 3: Add to Internet Shared Bandwidth

By default, a dual-zone NLB instance has a public bandwidth limit of 400 Mbps when not added to Internet Shared Bandwidth. To increase bandwidth, add the instance to Internet Shared Bandwidth.

On the NLB Instances page, find the target instance. Use either of the following methods to add it to Internet Shared Bandwidth.
- In the Actions column, choose > Associate with EIP Bandwidth Plan, or in the EIP Bandwidth Plan column, click Associate.
- Click the target instance ID. On the Instance Details tab, in the Billing Information section, click Associate with EIP Bandwidth Plan.
In the Associate with EIP Bandwidth Plan dialog box, select the target shared bandwidth and click OK.

Step 4: Configure domain name resolution

NLB lets you resolve your custom domain names to the public service domain name of the NLB instance using CNAME records, making it easier to access network resources.

In the navigation pane on the left, choose NLB > Instances.
In the top navigation bar, select the region of the NLB instance. In this example, select China (Hangzhou).

Perform the following steps to create a CNAME record:

Note

If your domain name is not registered through Alibaba Cloud Domains, add it to Alibaba Cloud DNS first. For more information, see Manage domain names. Skip this step for domains registered through Alibaba Cloud Domains.

Log on to the Alibaba Cloud DNS console.
On the Authoritative DNS Resolution page, find your domain name and click DNS Settings in the Actions column.
On the DNS Settings tab of the domain name details page, click Add DNS Record.

In the Add Record panel, configure the parameters and click OK. The following table describes the parameters.

Parameter	Description
Record Type	Select CNAME from the drop-down list.
Hostname	Domain name prefix. `@` is used in this example. Note If the domain name is a root domain name, enter @.
DNS Query Source	Select Default.
Record Value	Enter the CNAME, which is the domain name of the NLB instance.
TTL Period	TTL value for DNS caching. The default is used in this example.

Step 5: Test access

This example uses a TCP listener configured on the NLB instance with the existing NLB server group RS01. For more information, see:

After configuring domain name resolution for the NLB instance, enter the domain name resolved in Step 4: Configure domain name resolution into your browser to test public access through the EIP with Anti-DDoS (Enhanced).

You will observe that requests are forwarded to both ECS servers. The page returns Hello World ! This is ECS01., indicating that the request was successfully forwarded to backend server ECS01. On another access, the page displays Hello World ! This is ECS02., confirming successful forwarding to backend server ECS02.