title: How to preserve client source IP for whitelisting with an AWS NLB to ALB Terraform Terragrunt setup in China
body: <p>I am trying to run a NLB &gt; ALB with Lambda configuration according to this documentation <a href="https://aws.amazon.com/blogs/networking-and-content-delivery/using-aws-lambda-to-enable-static-ip-addresses-for-application-load-balancers/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/networking-and-content-delivery/using-aws-lambda-to-enable-static-ip-addresses-for-application-load-balancers/</a></p>
  <p>I guess my complication is similar to this one <a href="https://stackoverflow.com/questions/51862275/aws-nlb-to-alb-ip-whitelisting">AWS NLB to ALB IP Whitelisting</a></p>
  <p>This setup without whitelisting works so far but I need to whitelist IPs somewhere in this configuration.</p>
  <p>The NLB is somewhat bound ( by the Lambda function ) <strong>to a target group with the IP type</strong> which drops the client source ip for any whitelisting approach on the ALB.</p>
  <p>Curling with a X-Forwarded-For <code>curl --header &quot;X-Forwarded-For: IP.xx.xx</code> is dropped.</p>
  <p>As of September 27th, 2021 AWS added support for a more lean configuration utilizing a NLB with a target group that can target the ALB directly (look at the top update <a href="https://aws.amazon.com/blogs/networking-and-content-delivery/using-aws-lambda-to-enable-static-ip-addresses-for-application-load-balancers/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/networking-and-content-delivery/using-aws-lambda-to-enable-static-ip-addresses-for-application-load-balancers/</a> or the actual implementation of this new feature <a href="https://stackoverflow.com/questions/69501830/how-to-register-alb-as-target-for-a-targetgroup-via-terraform/69841992#69841992">How to register alb as target for a targetgroup via terraform</a>)</p>
  <ul>
  <li>Apparently it seems that (their new feature) ALB target groups do not work in AWS China. they work flawlessly in other regions.</li>
  <li>The Nginx-ingress or AWS-load-balancer ingress controllers are not suited for this?</li>
  <li>Global Accelerator (which could support some WL techniques) does not work in AWS China.</li>
  <li>A separate (but in the same VPC) Nginx instance seems not to work properly being an unhealthy instance target for a layer 4 network-load-balancer.</li>
  </ul>
  <p>Does anyone has an idea how to pull Whitelisting off with the given setup?</p>