Server Load Balancer:Forward IPv4 and IPv6 traffic with NLB affinity

Scenario

During IPv4-to-IPv6 migration, both services often need to coexist. When a server group contains both IPv4 and IPv6 backend servers, NLB by default does not distinguish between the IP versions of client requests and forwards traffic based only on the scheduling algorithm, such as round-robin or least connections.

This can cause cross-protocol forwarding — for example, an IPv6 client request might reach an IPv4-only backend server, or vice versa. Such mismatches can cause the following issues:

• The backend server cannot obtain the real client IP address, which affects source-based regional analysis and access control.

• To obtain the source IP address, you must deploy an additional proxy layer, such as Nginx with Proxy Protocol enabled, which increases operational costs.

Solution

NLB server groups support IP version affinity for 4-to-4 and 6-to-6 forwarding.

Backend servers can directly obtain original client IP addresses without an additional proxy layer. If all backend servers for a specific protocol fail health checks, requests are forwarded on a best-effort basis to other servers within the same protocol group but are not routed across protocols.

1. Create ECS instances and deploy services

1. Create two ECS instances with the following configurations.

   Parameter	Region	VPC	vSwitch	IP version	Image
   ecs-ipv4	China (Shanghai)	VPC1	VSW1	IPv4	Alibaba Cloud Linux 3.2104 LTS 64-bit
   ecs-ipv6			VSW2	IPv6 When you purchase the ECS instance, in the Network and Security Groups section, select Assign IPv6 Address Free of Charge.

2. Remotely connect to ecs-ipv4 and ecs-ipv6, and run the following commands to deploy Nginx services.

   ecs-ipv4

   sudo yum install -y nginx
   sudo systemctl start nginx
   echo "Hello from IPv4 backend" | sudo tee /usr/share/nginx/html/index.html

   ecs-ipv6

   sudo yum install -y nginx
   sudo systemctl start nginx
   echo "Hello from IPv6 backend" | sudo tee /usr/share/nginx/html/index.html

3. Add inbound rules to the security groups of both ECS instances to allow inbound traffic on port 80. Make sure the rules have a high enough priority.

   Instance Name	Action	Protocol	Source	Destination
   ecs-ipv4	Allow	Custom TCP	After you select IPv4, select CIDR block of this VPC.	After you select Port Range, select HTTP (80).
   ecs-ipv6			After you select IPv6, select CIDR block of this VPC.

For more information, see Create an instance by using the wizard, Connect to an ECS instance, and Add security group rules.

2. Create a dual-stack NLB instance

1. Log on to the NLB console, select the China (Shanghai) region, and then click Create NLB.

2. Specify the following parameters, keep the default values for other options, and then click Create:

   • Network Type: Select Public.

   • VPC: Select VPC1.

   • Zone: Select availability zones E and G, select the corresponding vSwitches VSW1 and VSW2, and select Purchase EIP.

   • IP Version: Select Dual-Stack.

3. After the instance is created, click the instance ID to go to the Instance Details page. In the Basic Information section, find Network Type, and click Change Network Type to the right of IPv6: Private. In the dialog box that appears, click OK. Then, verify that the IPv6 network type is now public.

3. Create a dual-stack server group and enable affinity

1. In the Server Group console, click Create Server Group.

2. Specify the following parameters and click Create:

   • Server Group Type: Select Server.

   • Server Group Name: Enter sgp-dualstack.

   • VPC: Select VPC1.

   • Backend Server Protocol: Select TCP.

   • IP Version: Select IPv4/IPv6 dual-stack. This allows you to add both IPv4 and IPv6 backend servers.

   • IP Version Affinity: Select Affinity mode. When enabled, IPv4 requests are forwarded only to IPv4 backend servers, and IPv6 requests are forwarded only to IPv6 backend servers.

3. In the The server group is created dialog box, click Add Backend Server. In the IP column, select the IPv4 address for ecs-ipv4 and the IPv6 address for ecs-ipv6. Select both instances and click Next.

   When you add IPv6 backend servers in batches, click the settings icon next to the IP column header and select Prefer IPv6 over IPv4. The system then selects the IPv6 addresses of servers by default.

4. In the Ports/Weights step, set the Port for both servers to 80 and click OK.

4. Create a listener

1. In the NLB console, click the ID of the target instance to go to the Instance Details page. On the Listener tab, click Create Listener.

2. In the Configure Listener step, set Listener Protocol to TCP, enter 80 for Listener Port, and then click Next.

3. In the Select Server Group step, select the sgp-dualstack server group and click Next.

4. In the Configuration Review step, confirm the configuration and click Submit.

5. Configure DNS records

Create a CNAME record to map your custom domain name to the DNS name of the NLB instance.

This tutorial uses Alibaba Cloud DNS as an example. If your domain name is not registered with Alibaba Cloud, you must first add the domain name to the Alibaba Cloud DNS console.

1. In the NLB console, copy the Domain Name of the target instance.

2. Log on to the Alibaba Cloud DNS console. In the Actions column of your target domain name, click Settings. On the Settings page, click Add Record.

3. Add a CNAME record with the following settings and click OK:

   • Record Type: Select CNAME.

   • Hostname: Enter a prefix for the domain name, such as test. If your root domain name is example.com, the domain name used to access the NLB instance is test.example.com.

   • Query Source and TTL: Keep the default values.

   • Record Value: Enter the DNS name of the NLB instance.

4. In the Change Resource Record Confirmation dialog box, confirm the DNS record information and click OK.

6. Verify affinity-based forwarding

When a client accesses the dual-stack NLB instance through a custom domain name, the DNS server returns an A record (IPv4) or AAAA record (IPv6) based on the client's IP version.

curl -4 http://test.example.com

curl -6 http://test.example.com

Billing

• NLB instance: NLB supports two billing methods: pay-as-you-go and resource plan. For more information, see NLB billing.

• ECS instance: For more information, see ECS billing overview. For testing, create a low-specification pay-as-you-go instance and release it after testing to avoid unnecessary charges.

• Domain name and DNS resolution fees: In addition to the domain name fee from your provider, Alibaba Cloud charges public authoritative DNS fees for DNS resolution.

• Public network fees: Public network fees apply to the EIP associated with the NLB instance and the IPv6 public bandwidth of the VPC where the instance resides.

Supported regions for dual-stack NLB

Production environment considerations

• High-availability deployment: Deploy backend servers across multiple availability zones. Ensure redundancy for both IPv4 and IPv6 backends to prevent single points of failure.

• Health check configuration: Adjust the health check interval, timeout period, and thresholds based on your business requirements to ensure that unhealthy servers are promptly removed.

FAQ