I tried distributing IPv4/IPv6 using the new "IpAddressType" feature in NLB listener rules
This page has been translated by machine translation. View original
Introduction
The IpAddressType field has been added to SourceIpConfig in NLB listener rules. This is announced in the AWS CLI v2.35.24 ChangeLog.
2.35.24
- api-change:
elbv2: This release adds support for theIpAddressTypefield onSourceIpConfig, enabling Network Load Balancer listener rules to match traffic based on whether the source IP is IPv4 or IPv6.
The ALB source-ip condition specifies the source using CIDR. In contrast, dual-stack NLBs allow you to specify whether the source is IPv4 or IPv6 using IpAddressType as a condition. This feature is exclusive to dual-stack NLBs.
Validation Configuration
Internet (dual-stack client)
│
▼
NLB (dualstack, TCP:80)
├─ Rule: source-ip / IpAddressType=ipv6 → TG-IPv6 (ALB:8080)
└─ Default action → TG-Default (ALB:8081)
│ │
└──────────────────┬─────────────────────┘
▼
ALB (internal, dualstack)
├─ Listener :8080 → fixed-response "IPv6 rule matched!"
└─ Listener :8081 → fixed-response "Default rule - IPv4"
Since NLB listener rules only support forward actions, the backend ALB is configured to return fixed-response on separate ports.
Resource Creation and Rule Configuration
A dual-stack internet-facing NLB (TCP:80 listener) and a backend internal ALB were created. The ALB returns fixed-response on ports 8080/8081. Each was registered to a target group, and TG-Default was set as the default action for the NLB listener.
A rule with an IPv6 source condition is created as follows.
aws elbv2 create-rule \
--listener-arn <NLB_LISTENER_ARN> \
--priority 10 \
--conditions '[{"Field":"source-ip","SourceIpConfig":{"IpAddressType":"ipv6"}}]' \
--actions '[{"Type":"forward","TargetGroupArn":"<TG_IPV6_ARN>"}]'
Behavior Verification
After creating the rule, access was made from a dual-stack client using both IPv6 and IPv4.
$ curl -6 http://<NLB_DNS_NAME>
IPv6 rule matched!
$ curl -4 http://<NLB_DNS_NAME>
Default rule - IPv4
IPv6 access matched the IpAddressType=ipv6 rule and was forwarded to TG-IPv6. Each was executed 3 times, and the same response was confirmed in all cases.
| Access | Representative Response | Results over 3 attempts |
|---|---|---|
IPv6 (curl -6) |
IPv6 rule matched! |
3/3 IPv6 rule matched! |
IPv4 (curl -4) |
Default rule - IPv4 |
3/3 Default rule - IPv4 |
| IPv6 after rule deletion | Default rule - IPv4 |
3/3 Default rule - IPv4 after 90 seconds (propagation took approximately 60–90 seconds in this verification) |
Verifying IpAddressType Support on ALB
An attempt was made to create a rule with the same IpAddressType=ipv6 condition on an ALB listener.
An error occurred (ValidationError) when calling the CreateRule operation:
IpAddressType is not supported for application load balancer
The request was rejected with a ValidationError. IP version determination using IpAddressType is a feature exclusive to NLBs.
Summary
By combining a single additional rule with IpAddressType=ipv6 and a default action, IPv4/IPv6 routing can be achieved without enumerating CIDRs. For configurations that previously required separate NLBs or destinations for IPv4 and IPv6 traffic, there is now the possibility of consolidating into a single dual-stack NLB.
