Forward traffic across multiple ports with the NLB full-port listener - Server Load Balancer

Full-port listener

A full-port listener enables NLB to monitor and process traffic on all ports within a specified range, instead of a single fixed port.

When enabled, NLB monitors the entire specified port range and forwards incoming requests to the corresponding ports on backend servers.

This simplifies configuration and reduces maintenance overhead for scenarios requiring numerous or dynamic ports.

Key features

Port range coverage: You specify a continuous port range (for example, 1000-2000), and NLB listens on every port within that range.
Simplified configuration: Eliminates the need to configure individual listeners. Ports map one-to-one to backend service ports, and new ports take effect without updating the listener configuration.

Use cases

Scenarios that require listening on numerous or dynamic ports:

Online games: RPGs, PvE games, and simulation games use a wide range of ports for different scenes or separate game rooms.
Real-Time Communication (RTC): Video conferencing and online education platforms use a wide range of ports for real-time media streams and signaling data.

Example

An enterprise deploys an NLB instance in a VPC in the China (Hangzhou) region. The backend server group contains two ECS instances (ECS01 and ECS02), both running application services.

The enterprise uses the full-port listener to listen on port range 8080–8090, enabling access to different backend services through different ports.

Limitations

A full-port listener must be associated with a server group that has All-port Forwarding enabled. You cannot enable or disable these features on existing listeners or server groups — you must create new ones with these features enabled.

Prerequisites

A VPC and two vSwitches (VSW1 and VSW2) are created in two different availability zones in the China (Hangzhou) region. Create a VPC and a vSwitch.

ECS01 and ECS02 are created in VSW1 and VSW2 respectively, with application services accessible on ports 8080–8090.

Reference commands for deploying a test service

The following example uses CentOS 7.9 and Nginx 1.20.1. You can use the following scripts to deploy a test service that listens on ports 8080 through 8090:

Log on to ECS01 and perform the following steps.

Run vi ECS01_server_install.sh and press the i key to enter edit mode.

Copy and paste the following script:

#!/bin/bash

# Install Nginx
yum install -y nginx

# Directory for Nginx server block configurations
NGINX_CONF_DIR=/etc/nginx/conf.d

# Directory to store index.html files
HTML_DIR=/usr/share/nginx/html

# Create configs and HTML files in a loop
for PORT in $(seq 8080 8090); do
  CONF_FILE=${NGINX_CONF_DIR}/app_${PORT}.conf
  HTML_FILE=${HTML_DIR}/index_app${PORT}.html
  
  # Create HTML content
  echo "Hello World! This is ECS01, server port is ${PORT}." > ${HTML_FILE}
  
  # Create Nginx server block configuration
  cat > ${CONF_FILE} << EOF
server {
    listen ${PORT};
    server_name localhost;

    location / {
        root ${HTML_DIR};
        index index_app${PORT}.html;
    }
}
EOF

done

# Test the Nginx configuration and start Nginx
nginx -t && systemctl start nginx

echo "Nginx has been configured to listen on ports 8080 to 8090."

# Access localhost ports 8080 to 8090 by using curl
for PORT in $(seq 8080 8090); do
  echo "Accessing http://localhost:${PORT}"
  curl http://localhost:${PORT}
done

Press the Esc key, enter :wq to save the changes.
Run the sudo sh ECS01_server_install.sh command to run the script.

If the following output is displayed, the services on ports 8080 through 8090 are accessible.

...
Nginx has been configured to listen on ports 8080 to 8090.
Accessing http://localhost:8080
Hello World! This is ECS01, server port is 8080.
Accessing http://localhost:8081
Hello World! This is ECS01, server port is 8081.
Accessing http://localhost:8082
Hello World! This is ECS01, server port is 8082.
Accessing http://localhost:8083
Hello World! This is ECS01, server port is 8083.
Accessing http://localhost:8084
Hello World! This is ECS01, server port is 8084.
Accessing http://localhost:8085
Hello World! This is ECS01, server port is 8085.
Accessing http://localhost:8086
Hello World! This is ECS01, server port is 8086.
Accessing http://localhost:8087
Hello World! This is ECS01, server port is 8087.
Accessing http://localhost:8088
Hello World! This is ECS01, server port is 8088.
Accessing http://localhost:8089
Hello World! This is ECS01, server port is 8089.
Accessing http://localhost:8090
Hello World! This is ECS01, server port is 8090.

If the curl command fails, check whether the ports are already in use or if there was an error in the command.

Log on to ECS02 and perform the following steps.

Run vi ECS02_server_install.sh and press the i key to enter edit mode.

Copy and paste the following script:

#!/bin/bash

# Install Nginx
yum install -y nginx

# Directory for Nginx server block configurations
NGINX_CONF_DIR=/etc/nginx/conf.d

# Directory to store index.html files
HTML_DIR=/usr/share/nginx/html

# Create configs and HTML files in a loop
for PORT in $(seq 8080 8090); do
  CONF_FILE=${NGINX_CONF_DIR}/app_${PORT}.conf
  HTML_FILE=${HTML_DIR}/index_app${PORT}.html
  
  # Create HTML content
  echo "Hello World! This is ECS02, server port is ${PORT}." > ${HTML_FILE}
  
  # Create Nginx server block configuration
  cat > ${CONF_FILE} << EOF
server {
    listen ${PORT};
    server_name localhost;

    location / {
        root ${HTML_DIR};
        index index_app${PORT}.html;
    }
}
EOF

done

# Test the Nginx configuration and start Nginx
nginx -t && systemctl start nginx

echo "Nginx has been configured to listen on ports 8080 to 8090."

# Access localhost ports 8080 to 8090 by using curl
for PORT in $(seq 8080 8090); do
  echo "Accessing http://localhost:${PORT}"
  curl http://localhost:${PORT}
done

Press Esc, and then type :wq to save your changes.
Run the sudo sh ECS02_server_install.sh command to run the script.

If the following output is displayed, the services on ports 8080 through 8090 are accessible.

...
Nginx has been configured to listen on ports 8080 to 8090.
Accessing http://localhost:8080
Hello World! This is ECS02, server port is 8080.
Accessing http://localhost:8081
Hello World! This is ECS02, server port is 8081.
Accessing http://localhost:8082
Hello World! This is ECS02, server port is 8082.
Accessing http://localhost:8083
Hello World! This is ECS02, server port is 8083.
Accessing http://localhost:8084
Hello World! This is ECS02, server port is 8084.
Accessing http://localhost:8085
Hello World! This is ECS02, server port is 8085.
Accessing http://localhost:8086
Hello World! This is ECS02, server port is 8086.
Accessing http://localhost:8087
Hello World! This is ECS02, server port is 8087.
Accessing http://localhost:8088
Hello World! This is ECS02, server port is 8088.
Accessing http://localhost:8089
Hello World! This is ECS02, server port is 8089.
Accessing http://localhost:8090
Hello World! This is ECS02, server port is 8090.

If the curl command fails, check whether the ports are already in use or if there was an error in the command.

The security groups of ECS01 and ECS02 allow inbound traffic on ports 8080-8090.
An Internet-facing NLB instance is in the Running state within your VPC. Create and manage an NLB instance.
A domain name is registered with ICP filing completed. Register an Alibaba Cloud domain name, ICP filing process.

Step 1: Create a server group with all-port forwarding

Log on to the Network Load Balancer (NLB) console.
In the top navigation bar, select the region where the NLB instance is deployed.
In the left-side navigation pane, choose NLB > Server Groups.
On the Server Groups page, click Create Server Group.

Configure the server group with the following key settings. For more information, see NLB server groups.

Parameter	Description
Server Group Type	Select Server.
Server Group Name	Enter a custom name for the server group.
VPC	Select the VPC where the NLB instance resides. Only servers in this VPC can be added.
Multi-port Forwarding	Enable All-port Forwarding. With this feature enabled, you do not specify ports when adding backend servers. NLB forwards traffic to the corresponding port on each backend server. Important A full-port listener can only be associated with a server group that has All-port Forwarding enabled.
Configure Health Check	Enable health checks.
Health Check Port	When All-port Forwarding is enabled, you must specify a health check port. The health check probes this port on backend servers. The server must return a valid response; otherwise, the check fails. In this example, set the port to 8080.

After you configure the server group, click Create. In the dialog box that appears, click Add Backend Server .
Select ECS01 and ECS02. Because All-port Forwarding is enabled, you do not need to configure server ports. Keep default values for other parameters and click OK.

Step 2: Create a full-port listener

Note

This example uses a TCP listener.

Log on to the Network Load Balancer (NLB) console.
In the top navigation bar, select the region where the NLB instance is deployed.
On the Instances page, find the NLB instance and click Create Listener in the Actions column.

Configure the listener with the following key settings. For more information, see Add a TCP listener. After configuration, click Submit.

The following table describes the listener parameters.

Parameter

Description

Multi-port Listening/Forwarding

Enable the All-port Feature.

Listener Port Range

Specify the start and end ports. In this example, set the range from 8080 to 8090.

NLB listens on all ports in this range and forwards requests to the corresponding backend server ports.

Important

The listener port range cannot be modified after the listener is created.

The following table describes the server group parameters.

Parameter	Description
Server Group	Select the server group created in Step 1 (contains ECS01 and ECS02 with All-port Forwarding enabled). Important A server group added to a full-port listener must have All-port Forwarding enabled. Otherwise, it cannot be added.

Step 3: Configure DNS resolution

Use CNAME records to map your custom domain name to the NLB instance domain name.

Log on to the Network Load Balancer (NLB) console.
On the Instances page, copy the Domain Name of the NLB instance that you want to manage.

Perform the following steps to create a CNAME record:

Note

If your domain name is not registered through Alibaba Cloud Domains, you must add it to Alibaba Cloud DNS before configuring a DNS record. Add a domain name. If registered through Alibaba Cloud Domains, skip this step.

Log on to the Alibaba Cloud DNS console.
On the Public Zone page, find your domain name and click Settings in the Actions column.
On the Settings tab of the domain name details page, click Add Record.

In the Add Record panel, configure the parameters and click OK. The following table describes the parameters.

Parameter	Description
Record Type	Select CNAME from the drop-down list.
Hostname	The prefix of the domain name. In this example, enter @. Note If the domain name is a root domain name, enter @.
Query Source	Select Default.
Record Value	Enter the CNAME, which is the domain name of the NLB instance.
TTL	TTL value for the CNAME record cached on the DNS server. In this example, the default value is used.

Step 4: Test the full-port listener

Verify that the NLB instance correctly forwards traffic across all ports.
1. This example uses a Linux client with public network access. If telnet is not installed, run yum install -y telnet.
2. Run telnet domain_name port with any port from 8080 to 8090. A Connected to ... response confirms NLB is forwarding requests to the backend server.
```
Trying *.*.*.*...
Connected to www.example.com.
Escape character is '^]'
```
  Access the domain name in a browser on any port from 8080 to 8090 (for example, http://domain_name:8080). A page like the following confirms the client can access the application.
```
Hello World! This is ECS01, server port is 8080.
```
Simulate backend server failures to verify high availability.
1. Stop the service on ECS01. On ECS01, run systemctl stop nginx.service to stop the application.
2. After a few minutes, run telnet domain_name port again with any port from 8080 to 8090. You should still receive the Connected to ... response.
```
Trying *.*.*.*...
Connected to www.example.com.
Escape character is '^]'
```
  Access the domain name in a browser on any port from 8080 to 8090 (for example, http://domain_name:8080). A page like the following confirms the client can access the application.
  Hello World! This is ECS02, server port is 8080.
3. Start the service on ECS01 and stop the service on ECS02. On ECS01, run systemctl start nginx.service to restart the application, and on ECS02, run systemctl stop nginx.service to stop the application.
4. After a few minutes, run telnet domain_name port again (where port is any port from 8080 to 8090). You should still receive Connected to ....
```
Trying *.*.*.*...
Connected to www.example.com.
Escape character is '^]'
```
  Access the domain name in a browser on any port from 8080 to 8090 (for example, http://domain_name:8080). A page like the following confirms the client can access the application.
  Hello World! This is ECS01, server port is 8080.
The test confirms that a single backend server failure does not affect NLB availability — all ports from 8080 to 8090 remain accessible.