IBM Cloud Docs
Exposing an application in your deployable architecture to the internet

Exposing an application in your deployable architecture to the internet

In this tutorial, you use a public IBM Cloud Application Load Balancer for VPC to allow access over the public internet to an app that runs on your VSI on VPC landing zone deployable architecture.

The load balancer can distribute traffic among multiple application server instances that are running in the VPC (in the workload VSIs). It forwards traffic only to instances that respond correctly to periodic health checks. For more information about load balancing, see the overview to Load balancers for VPC.

Before you begin

Create a load balancer

Create a public Application Load Balancer for VPC.

  1. In the IBM Cloud console, click the Menu icon Menu icon, and then click VPC Infrastructure > Load balancers.

  2. On the Load balancers page, click Create.

  3. Specify the settings for your load balancer:

    • Load balancer type: Application Load Balancer (ALB)

    • Location: Select the geography and region where you provisioned your VPC resources

    • Details:

      • Name: <your_prefix>-web-lb, where <your_prefix> is any string of lowercase alphanumeric characters and hyphens.
      • Resource group: Select or create a group. For example, <your_prefix>-workload-rg.
      • Virtual private cloud: Select your VPC.
      • Type: Public.
      • DNS type: Public.
      • Subnets: The VSI that is running your application. For example, <your_prefix>-workload-vsi-zone-1.
    • Backend pool:

      Click Create pool and specify the following information to create a back-end pool.

      • Name: <your_prefix>-backend-pool.
      • Pool protocol: HTTP
      • Session stickiness: Select whether all requests during a user's session are sent to the same instance.
      • Proxy Protocol: Disabled.
      • Method: Select how you want the load balancer to distribute traffic across the instances in the pool. If you don't have other requirements, select Round robin.
      • Health Check: - Health Port: 80 - Use the default settings for all other options.
  4. Click Create to create the back-end pool.

  5. Click Attach server in the Server instances column of the Back-end pools table.

  6. Select the VPC devices tab

    1. Add the VSI that is in the subnet the VSI that is running your application (for example, <your_prefix>-workload-vsi-zone-1).
    2. Select an instance. If an instance has multiple interfaces, make sure that you select the correct IP address.
    3. Specify port 80.

    You can assign multiple VSIs here if you want to distribute the load.

  7. In the Front-end listeners section, click Create listener.

    1. Set the listener port to 80. Use the default settings for all other options.
    2. Click Create to create the front-end listener.
  8. In the security groups section, clear all settings except the one labeled <your_prefix>-workload.

  9. After you finish creating pools and listeners, click Create load balancer.

Update security to allow external traffic

To allow access to your load balancer, complete the following steps:

  1. Click the Menu icon Menu icon, and then click VPC Infrastructure > Security groups.
  2. Find the <your_prefix>-workload security group that you want to attach your load balancer to.
  3. Add the following inbound rule to that security group:
    • Protocol: TCP
    • Port: Port Range:
      • Min: 80
      • Max: 80
    • Source Type: Any

To allow internet access to the load balancer, complete the following steps. For more information, see Creating a network ACL.

  1. Click the Menu icon Menu icon, and then click **VPC Infrastructure > Access control lists.
  2. Find the ACL named <your-prefix>-workload-acl.
  3. Create an inbound rule with the following settings:
    • Allow or deny: Allow
    • Protocol: TCP
    • Source:
      • Type: Any
      • Port: Any
    • Destination:
      • Type: IP or CIDR: 10.40.10.0/24
      • Port: Port range
        • Port min: 80
        • Port max: 80
    • Priority: Set to top
  4. Create an outbound rule with the following settings:
    • Allow or deny: Allow
    • Protocol: TCP
    • Source:
      • Type: IP or CIDR: 10.40.10.0/24
      • Port: Port range
        • Port min: 80
        • Port max: 80
    • Destination:
      • Type: Any
      • Port: Any
    • Priority: Set to top

It can take several minutes for your load balancer to finish provisioning. Wait until the status is Active in Load balancers for VPC in the console. You might need to refresh the page periodically.

Verify internet access to your server

Now that your load balancer is configured, verify that it routes traffic to your app.

  1. Retrieve the fully qualified domain name of your load balancer:
    1. Click the Menu icon Menu icon, and then click VPC Infrastructure > Load balancers.
    2. Select your load balancer.
    3. Copy the value of the Hostname.
  2. Paste the hostname in a browser and check whether your app responds.

You can also test connectivity by issuing the curl command curl http://<value of the Hostname>.

Solving connectivity issues

If you have connectivity issues through your load balancer, check out the troubleshooting topics in the VPN docs. For example, Why is traffic not reaching my back-end members?

Summary

You configured your VSI on VPC landing zone deployable architecture that hosts a web application to allow traffic from the public internet through the Application Load Balancer for VPC. Your app is now accessible from any browser on the public internet through the fully qualified domain name of the load balancer.

Next steps

Learn more about how you can further extend your deployable architecture.