<p>So I have a setup like this: </p>

<p>AWS NLB (forwards) --> Istio --> Nginx pod</p>

<p>Now, I'm trying to implement rate limiting at Istio layer. I followed <a href="https://raw.githubusercontent.com/istio/istio/release-1.3/samples/bookinfo/policy/mixer-rule-productpage-ratelimit.yaml" rel="nofollow noreferrer">this</a> link. However, I can still request the API more than what I configured. Looking more into it, I logged X-Forwarded-For header in the nginx, and it's empty. </p>

<p>So, how do I get the client IP in Istio when I'm using NLB? NLB forwards the client IP, but how? In header? </p>

<p>EDITS:</p>

<p>Istio Version: 1.2.5</p>

<p>istio-ingressgateway is configured as type NodePort. </p>

<p>According to AWS <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html" rel="nofollow noreferrer">documentation</a> about Network Load Balancer:</p>
<blockquote>
<p>A Network Load Balancer functions at the fourth layer of the Open Systems Interconnection (OSI) model. It can handle millions of requests per second. After the load balancer receives a connection request, it selects a target from the target group for the default rule. It attempts to open a TCP connection to the selected target on the port specified in the listener configuration.</p>
</blockquote>
<p>...</p>
<blockquote>
<p>When you create a target group, you specify its target type, which determines whether you register targets by instance ID or IP address. If you register targets by instance ID, the source IP addresses of the clients are preserved and provided to your applications. If you register targets by IP address, the source IP addresses are the private IP addresses of the load balancer nodes.</p>
</blockquote>
<hr />
<p>There are two ways of preserving client IP address when using NLB:</p>
<p><strong>1.: NLB preserves client IP address in source address
when registering targets by instance ID.</strong></p>
<p>So client IP address are only available in specific NLB configuration. You can read more about Target Groups in aws <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html" rel="nofollow noreferrer">documentation</a>.</p>
<hr />
<p><strong>2.: Proxy Protocol headers.</strong></p>
<p>It is possible to use to send additional data such as the source IP address in header. Even if You specify targets by IP addresses.</p>
<p>You can follow aws <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#proxy-protocol" rel="nofollow noreferrer">documentation</a> for guide and examples how to configure proxy protocol.</p>
<blockquote>
<p><strong>To enable Proxy Protocol using the console</strong></p>
<ol>
<li><p>Open the Amazon EC2 console at  <a href="https://console.aws.amazon.com/ec2/" rel="nofollow noreferrer">https://console.aws.amazon.com/ec2/</a>.</p>
</li>
<li><p>On the navigation pane, under  <strong>LOAD BALANCING</strong>, choose  <strong>Target Groups</strong>.</p>
</li>
<li><p>Select the target group.</p>
</li>
<li><p>Choose  <strong>Description</strong>,  <strong>Edit attributes</strong>.</p>
</li>
<li><p>Select  <strong>Enable proxy protocol v2</strong>, and then choose  <strong>Save</strong>.</p>
</li>
</ol>
</blockquote>
