A TCP service behind a Network Load Balancer writes access logs showing every connection from the balancer's own node addresses. Host firewall rules on the backend instances filter by the real caller address and are now rejecting legitimate users. Which target group setting resolves both symptoms?
Show answer and explanation
Answer: B
Network Load Balancers work at layer 4, and when client IP preservation is not in effect for the target type, the backend sees the balancer node address instead of the caller. Enabling client IP preservation on the target group makes each backend see the original source address, which restores accurate logs and address-based firewall rules. The setting belongs to the target group, not the listener or the load balancer as a whole.
Why the other options are wrong
- A. Cross-zone load balancing spreads connections across availability zones and affects how traffic is distributed. It does not change which source address the backend instances observe.
- C. An NLB does not insert X-Forwarded-For headers, because that header belongs to HTTP traffic handled by Application Load Balancers. Raw TCP traffic carries no such header for the backend to read.
- D. Stickiness keeps repeat connections going to the same target, but it does not alter the source address a target receives. It does not fix the logging or firewall problem described.