Docs

Load Balancer

NLB instances

Configuring the security group and Network ACL for NLB

Scenarios

To ensure that the NLB instance functions properly, both the NLB instance and backend server must have security groups and Network ACs to allow necessary traffic. This article explains how to allow the necessary traffic for the NLB instance's security group and Network Access Control List.

For information on configuring the security groups and network ACLs of backend servers to allow relevant traffic, see Configuring the security group and network ACLs for backend servers.

Configuration instructions

Security groups are stateful. Return Traffic: Return data flows are automatically permitted and are not affected by these rules.

Network ACL is stateless. Return traffic must be explicitly allowed by rules, meaning that both outbound and inbound directions must be explicitly permitted by the rules.

The requirements for allowing traffic in the security group and Network Access Control List associated with the NLB instance are as follows:

Security groups and Network Access Control List (ACL)			Traffic Configuration Guide (The traffic descriptions below include the corresponding return data flows)
Security group			Inbound rule: Client traffic sent to NLB: client IP addresses based on listener protocol and listening port traffic. Traffic used by the system to detect the availability of the NLB private IP address: ICMP protocol traffic from 100.64.0.0/10 CIDR block ICMPv6 protocol traffic from fd00:64::/32 CIDR block Outbound rule: Traffic forwarded by NLB to backend servers: data transfer based on server group protocol and server port with backend server IP addresses Health check traffic: data transfer based on health check protocol and health check port with backend server private IP addresses For ease of configuration and management, it is recommended to allow all outbound traffic.
Network ACL	NLB instances and backend servers belong to same subnets	Network ACL inbound and outbound rules must allow the following traffic (outbound rules are recommended to allow 0.0.0.0/0): Traffic sent from the client to the NLB: client IP address traffic based on the listener protocol and listening port Traffic used by the system to detect the availability of the NLB private IP address: ICMP protocol traffic from 100.64.0.0/10 CIDR block ICMPv6 protocol traffic from fd00:64::/32 CIDR block Since the NLB and backend servers belong to the same subnet, the following traffic bypasses the network ACL and does not require network ACL configuration: Access traffic forwarded by the NLB to backend servers. Health check traffic For ease of configuration and management, it is recommended to allow all outbound traffic.
Network ACL		NLB instances and backend servers belong to different subnets	Network ACL inbound and outbound rules must allow the following traffic: Client-to-NLB access traffic: client IP address traffic based on the listener protocol and listener port NLB-to-backend server access traffic: backend server private IP address traffic based on the listener protocol and backend server port Health check traffic: traffic to the backend server private IP address based on the health check protocol and health check port Traffic used by the system to detect the availability of the NLB private IP address: ICMP protocol traffic from 100.64.0.0/10 CIDR block ICMPv6 protocol traffic from fd00:64::/32 CIDR block For ease of configuration and management, it is recommended to allow all outbound traffic.

Configuration examples

tip

For IPv4 NLB instances, no IPv6 traffic allowance rules are required as below.

Security group

Only allow specific IP addresses to access NLB

Direction	Priority	Strategy	Protocol type	Port range	Source/destination address	Description
Inbound	1	Allow	ALL	Listening port	Client IP address	Allow inbound client traffic to the NLB
		1	Allow	ICMP	ALL	100.64.0.0/10	Allow traffic to detect the availability of the NLB instance private IPv4 address
		1	Allow	ICMPV6	ALL	fd00:64::/32	Allow the traffic probing the availability of the private IPv6 address of the NLB instance
		100	Deny	ALL	ALL	0.0.0.0/0	Deny-all fallback policy
Outbound	100	Allow	ALL	ALL	0.0.0.0/0	Allow-all fallback policy

Reject specific IP addresses from accessing NLB

Direction	Priority	Strategy	Protocol type	Port range	Source	Description
Inbound	1	Deny	ALL	Listening port	Access to the NLB's IP address is not allowed	Deny specified IP addresses from accessing the NLB

Network ACL

The backend server is in the same subnet as the NLB

Rule direction	Priority	Strategy	Agreement	Source/destination address	Destination port	Description
Inbound	1	Allow	Listening protocol	Client IP address	Listening port	Allow inbound client traffic to the NLB
		2	Allow	ICMP	100.64.0.0/10	ALL	Allow traffic for system probes to detect the availability of the NLB private IPv4 address
		3	Allow	ICMPV6	fd00:64::/32	ALL	Allow traffic for system probes to detect the availability of the NLB private IPv6 address
Outbound	1	Allow	ALL	0.0.0.0/0	ALL	Allow all IPv4 traffic
Outbound		2	Allow	ALL	::/0	ALL	Allow all IPv6 traffic

The backend server is in a different subnet from the NLB

Rule direction	Priority	Strategy	Agreement	Source/destination address	Destination port	Description
Inbound	1	Allow	Listening protocol	Client IP address	Listening port	Allow client access traffic
		2	Allow	Health check protocol	Backend server private IP address	Health check port	Allow the health check response traffic from backend server to the NLB
		3	Allow	Listening protocol	Backend server private IP address	Backend server port	Allow the client's response traffic from backend server to the NLB
		4	Allow	ICMP	100.64.0.0/10	ALL	Allow traffic for system probes to detect the availability of the NLB private IPv4 address
		5	Allow	ICMPV6	fd00:64::/32	ALL	Allow traffic for system probes to detect the availability of the NLB private IPv6 address
Outbound	1	Allow	ALL	0.0.0.0/0	ALL	Allow all IPv4 traffic
Outbound		2	Allow	ALL	::/0	ALL	Allow all IPv6 traffic

Last updated: 2026.06.12 15:23:50