Dynamic forwarding

1. Create an ALB Extensible Edition instance

1. Log on to the ALB console, select the China (Shanghai) region, and click Create ALB.

2. On the buy page, complete the following configuration and click Create Now.

   • Region: Select China (Shanghai).

   • Instance Network Type: Select Internet.

   • VPC and Zone: Select VPC1, select Shanghai Zone B and Shanghai Zone F, and then select VSW1 and VSW2. Enable Automatically Assign Public IP.

   • Protocol Version: Select IPv4.

   • Edition (Instance Fee): Select Extensible Edition.

3. On the Confirm Order page, confirm the instance configuration details and click Activate Now.

2. Create a service extension and add a dynamic forwarding component

1. In the Service Extensions console, click Create Service Extension. In the Service Extension Configuration section, enter an Extension name such as ext-dyn-fwd-plugin.

2. Extension Type defaults to Plug-in. For Component name, select Dynamic Forwarding from the drop-down list. Below Quick Configuration (Select to Auto-Fill Current Rule Parameters), click Common Headers to use the preset system template, and then click Create.

   • Extraction Source: The default value is Header, which means that the target IP address and port are extracted from the HTTP request headers.

   • Extraction Mode: The default value is Separated Mode, which means that the target IP address and port are located in two different fields and must be specified separately.

   • Target Host Source: The default value is X-Target-Host. The dynamic forwarding component reads the target IP address from this request header.

   • Target Port Source: The default value is X-Target-Port. The dynamic forwarding component reads the target port from this request header.

   • Default Port: The default value is 80. This is the fallback port used when no port is extracted from the request.

3. Prepare backend servers

1. Create an ECS instance with reference to the following configuration.

   • Region: Select China (Shanghai).

   • Network and Zone: Select VPC1 and VSW1, and select Specify Primary Private IP Address of Primary ENI. In this tutorial, VSW1 corresponds to the IP address range 172.16.10.0/24, and the primary private IP address of the primary ENI is specified as 172.16.10.100.

   • Image: Select Alibaba Cloud Linux 3.2104 LTS 64-bit.

2. In the ECS console, find the instance. In the Actions column, choose Network and Security Group > Manage Secondary Private IP Address. Click Increase, enter 172.16.10.101, and then click OK. Refer to Enable the operating system to recognize a secondary private IP address to configure the ECS instance to recognize the IP address. Connect to the ECS instance and run ip a. You can see that the ECS instance has recognized the secondary private IP address.

     2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
         link/ether 00:16:3e:xx:xx:xx brd ff:ff:ff:ff:ff:ff
         altname enp3s0
         inet 172.16.10.100/24 brd 172.16.10.255 scope global noprefixroute eth0
            valid_lft forever preferred_lft forever
         inet 172.16.10.101/24 brd 172.16.10.255 scope global secondary noprefixroute eth0
            valid_lft forever preferred_lft forever
         inet6 fe80::xxxx:xxff:fexx:xxxx/64 scope link
            valid_lft forever preferred_lft forever   

3. On the backend ECS instance, install Nginx and deploy an echo service that listens on port 80 and port 81. For any request, it returns the actual target IP:Port that the request reaches, which is used to verify the landing point of dynamic forwarding.

   # 1. Install nginx
   sudo dnf install -y nginx
   
   # 2. Write the echo configuration
   sudo tee /etc/nginx/conf.d/echo.conf >/dev/null <<'EOF'
   server {
       listen 80 default_server;
       listen 81 default_server;
       server_name _;
       location / {
           default_type text/plain;
           return 200 "served: $server_addr:$server_port\n";
       }
   }
   EOF
   
   # 3. Remove the default_server flag from the default site to avoid conflicts
   sudo sed -i 's/ default_server//g' /etc/nginx/nginx.conf
   
   # 4. Validate the configuration, enable autostart, and start the service
   sudo nginx -t
   sudo systemctl enable nginx
   sudo systemctl restart nginx
   
   # 5. Test locally
   curl 172.16.10.100:80
   curl 172.16.10.100:81
   curl 172.16.10.101:80
   curl 172.16.10.101:81

4. Create an IP Address Range server group

Dynamic forwarding determines forwarding targets based on request content. Without constraints, crafted requests could redirect traffic to unauthorized addresses, creating SSRF risks. Configure an IP Address Range server group as a mandatory security boundary: only requests whose target IP address and port match an allowed entry are forwarded. All other requests return HTTP 403.

1. In the Server Groups console, click Create Server Group.

2. Configure the following parameters and click Create:

   • Server Group Type: Select IP Address Range.

   • Server Group Name: Enter a custom name such as sgp-dyn-fwd.

   • Backend Protocol: The default is HTTP.

   • Use Existing Service Extension and select the service extension ext-dyn-fwd-plugin.

3. After Server Group Created, click Add Backend Servers. In the Add IP Address Segment dialog box, enter IP Address Range172.16.10.0/24 and Port Range80-81, and then click OK.

5. Create a listener

1. In the ALB console, click the target instance ID to go to the Instance Details page. On the Listener tab, click Create Listener.

2. In the Configure Listener step, set Listener Protocol to HTTPS and Listener Port to 443, and then click Next.

3. In the Configure SSL Certificate step, select a server certificate that matches your custom domain name, and then click Next.

4. In the Select Server Group step, select the IP Address Range type and the server group sgp-dyn-fwd, and then click Next.

   Note

   This tutorial uses the default forwarding rule to forward traffic to the IP Address Range server group. To add capabilities such as authentication or rate limiting, create additional forwarding rules under the listener and associate them with the corresponding service extensions.

5. In the Configuration Review step, confirm the configuration and click Submit.

6. Configure DNS resolution

Point your custom domain name to the DNS name of the ALB instance by using a CNAME record. Clients access ALB through your custom domain name.

This tutorial uses Alibaba Cloud DNS as an example. For domain names not registered with Alibaba Cloud, you must first add the domain to the DNS console.

1. In the ALB console, copy the Domain Name of the target instance.

2. Log on to the DNS console. In the Actions column of the target domain, click Settings. On the Settings page, click Add Record.

3. Add a CNAME record with the following information and click OK:

   • Record Type: Select CNAME.

   • Hostname: Enter a domain prefix such as test. For example, if your root domain is example.com, the domain for accessing ALB is test.example.com.

   • Query Source and TTL: Keep the default values.

   • Record Value: Enter the DNS name of the ALB instance.

4. In the Change Resource Record Confirmation dialog box, confirm the resolution information and click OK.

7. Verify the configuration

A request must meet the following conditions to receive a successful response:

• The dynamic forwarding component can extract the target IP address and port from the request (if no port is explicitly specified, the Default Port is used as fallback).

• The combination of the IP address and port falls within the allowed range of the IP Address Range server group.

• A backend service is listening on the IP address and port and returns a response.

curl -v \
  -H "X-Target-Host: 172.16.10.100" \
  -H "X-Target-Port: 80" \
  https://test.example.com/echo

curl -v \
  -H "X-Target-Host: 172.16.10.101" \
  -H "X-Target-Port: 80" \
  https://test.example.com/echo

curl -v \
  -H "X-Target-Host: 172.16.10.100" \
  -H "X-Target-Port: 81" \
  https://test.example.com/echo

curl -v \
  -H "X-Target-Host: 172.16.10.101" \
  https://test.example.com/echo

curl -v \
  https://test.example.com/echo

curl -v \
  -H "X-Target-Host: 10.99.99.99" \
  -H "X-Target-Port: 80" \
  https://test.example.com/echo

curl -v \
  -H "X-Target-Host: 172.16.10.100" \
  -H "X-Target-Port: 12345" \
  https://test.example.com/echo

Billing

• ALB Extensible Edition: Currently in public preview. Users can try it for free. The EIP bound to the ALB Extensible Edition instance has its own billing rules, and fees are charged by EIP.

• ECS instances: For details, see ECS billing overview. If you create an ECS instance for testing purposes, we recommend that you create a low-specification pay-as-you-go instance and release it promptly.

• Domain name and public DNS resolution fees: In addition to domain name fees from your domain provider, configuring public DNS resolution on Alibaba Cloud incurs public authoritative DNS resolution fees.

• Certificate fees: Purchasing or uploading a certificate to Alibaba Cloud incurs server certificate fees.

Limits

• The backend protocol for dynamic forwarding currently supports only HTTP.

• IP Address Range server groups do not support adding address ranges such as 22.0.0.0/8, 33.0.0.0/8, 100.0.0.0/8, or 127.0.0.0/8.

• A single IP Address Range server group supports a maximum of 200 IP range entries by default (each entry is a combination of an IP range and a port range).

Regions that support ALB Extensible Edition

Best practices

• Order multiple target address extraction configurations properly: When multiple target address extraction configurations are specified, the system matches them in order from smallest to largest sequence number. The first match takes effect. Place the most frequently matched and most restrictive configurations first.

• Keep the allowed target range narrow: While ensuring business availability, restrict IP address ranges and port ranges to only the backends that your business actually requires. Avoid configuring overly broad ranges.

• Use forwarding rules flexibly: IP Address Range server groups can serve as forwarding targets in forwarding rules. Combine them with forwarding conditions, service extensions, and forwarding actions for complex traffic orchestration needs.

FAQ