通过ELB将不同端口流量路由至多后端实例的技术问询

Hey there! Based on your existing setup (where xyz.test.com:443 routes to Server A via your private subnet ELB), here's a step-by-step guide to add Server B and get that 444 port traffic flowing correctly:

1. Create a Target Group for Server B #

First, we need a dedicated target group to associate with Server B—this is how the ELB knows where to send 444 port traffic:

• Head to your cloud console (I’m assuming AWS since you mentioned ELB) and navigate to EC2 > Target Groups.
• Click "Create target group", select "Instances" as the target type (adjust if Server B is a different resource like an IP), and name it something descriptive like TG-Server-B.
• Configure the protocol and port to match what Server B is listening on (e.g., if Server B uses port 3001, enter that here). Pick HTTP/HTTPS based on your service’s setup.
• Select the same VPC that your existing ELB and Server A are in, then click "Next".
• Find Server B in the list of available instances, check the box to register it, and finish creating the target group.

2. Add a 444 Port Listener to Your Existing ELB #

Next, we’ll add a new listener to the ELB to handle traffic on port 444:

• Go to EC2 > Load Balancers and select your existing ELB.
• Switch to the Listeners tab, then click "Add listener".
• Fill in the details:
  • Protocol: Choose HTTPS (since you’re using a subdomain with SSL, just like your 443 setup).
  • Port: Enter 444.
  • SSL certificate: Use the same wildcard certificate (*.test.com) you’re already using for xyz.test.com—this will cover the 444 port subdomain traffic too.
  • Default action: Select "Forward to" and pick the TG-Server-B target group you just created. Save the listener.

3. Update Security Group Rules (Critical!) #

Don’t skip this—incorrect security groups will block traffic:

• ELB Security Group: Add an inbound rule allowing HTTPS traffic on port 444 (from 0.0.0.0/0 if you want public access, or restrict to specific IP ranges if needed).
• Server B Security Group: Add an inbound rule allowing traffic on Server B’s target port (e.g., 3001) from your ELB’s security group. This ensures the ELB can communicate with Server B.

4. Verify the Setup #

Once everything’s configured, test it out to make sure it works:

• Visit https://xyz.test.com:444 in your browser or use curl -v https://xyz.test.com:444 to check if the request reaches Server B.
• Check the ELB’s access logs and the TG-Server-B target group’s health status—make sure Server B shows as "healthy" (this means the ELB can reach it successfully).

Quick Notes #

• If you’re using a Classic Load Balancer instead of an Application Load Balancer, the steps are similar but target group setup will be slightly different (you’ll associate Server B directly with the listener instead of using a target group).
• Double-check that Server B’s service is running on the correct port and that the target group’s health check path (e.g., /health) returns a 200 OK status—unhealthy targets won’t receive traffic.

内容的提问来源于stack exchange，提问作者Anshul Tripathi