AWS Application Load Balancer (ALB)
An AWS Application Load Balancer (ALB) can be used as a reverse proxy in front of Helmut4. The ALB provides a single access point for clients, handles HTTP and HTTPS traffic, terminates SSL/TLS, and forwards valid requests to the Helmut4 backend system.
This guide describes the recommended ALB settings for correct communication with Helmut4.
Example Architecture
A typical setup looks like this:
Client
↓
DNS name, for example helmut.example.com
↓
AWS Application Load Balancer
↓
HTTPS listener :443
↓
Listener rule
↓
Target group
↓
Helmut4 backendThe ALB should be configured with:
Load Balancer Configuration
Create an Application Load Balancer.
Recommended settings:
Scheme
Use Internal if Helmut4 is only accessed from inside AWS, through VPN, or through private company networks.
Use Internet-facing only if Helmut4 must be reachable from the public internet.
DNS Name
The ALB receives its own AWS DNS name. In most environments, users should not access this DNS name directly.
Instead, create a dedicated DNS record, for example:
and point it to the ALB DNS name.
The DNS name used by clients must match the SSL/TLS certificate configured on the HTTPS listener.
Listener Configuration
The ALB should provide two listeners:
HTTP Listener
The HTTP listener should redirect all incoming traffic to HTTPS.
Recommended settings:
This ensures that clients always communicate with Helmut4 over HTTPS.
Example behavior:
HTTPS Listener
The HTTPS listener handles encrypted client traffic and forwards valid requests to the Helmut4 target group.
Recommended settings:
The certificate is usually provided through AWS Certificate Manager (ACM).
Example:
HTTPS Listener Rules
Configure a listener rule that forwards Helmut4 traffic to the Helmut4 target group.
Recommended rule:
This ensures that only requests for the configured Helmut4 DNS name are forwarded to the Helmut4 backend.
A default rule can be used to return a fixed response if no condition matches.
Example default response:
This is useful to prevent unrelated hostnames or direct ALB requests from being forwarded to Helmut4.
Target Group Configuration
Create a target group for the Helmut4 backend.
Recommended settings:
Use the protocol and port that match your Helmut4 environment.
Example target:
If Helmut4 is running behind Traefik or another reverse proxy, make sure the target group points to the externally exposed HTTPS port of that proxy.
For example, if Traefik exposes HTTPS on a custom port, the target group must use that port instead of 443.
Health Check Configuration
Configure the target group health check to verify that Helmut4 is reachable.
Recommended settings:
The health check should return a successful HTTP response when the Helmut4 service is available.
If the target does not pass the health check, the ALB marks it as unhealthy and stops forwarding traffic to it.
SSL/TLS Handling
In this setup, SSL/TLS is terminated at the ALB.
This means:
The ALB presents the public certificate to the client. The backend connection from the ALB to Helmut4 also uses HTTPS when the target group protocol is set to HTTPS.
Make sure that the Helmut4 backend accepts HTTPS traffic on the configured target port.
Security Group Configuration
The ALB security group must allow incoming client traffic.
Recommended inbound rules for the ALB:
The Helmut4 target security group must allow traffic from the ALB security group.
Recommended inbound rule for the Helmut4 target:
If a custom backend port is used, replace 443 with the configured target port.
Avoid exposing the Helmut4 target directly unless required by your architecture.
Important Port Note
If Helmut4 and another reverse proxy, such as Traefik, are running on the same host as another load balancer or proxy, make sure there are no port conflicts. Please refer to Change HTTP/HTTPS Ports
For example, if another service already uses ports 80 and 443, the exposed ports of the Helmut4 Traefik container may need to be changed.
The ALB target group must then point to the adjusted external port.
Example:
Add this section after Load Balancer Configuration or before Listener Configuration:
Load Balancer Attributes
In addition to the listener and target group configuration, the following ALB attributes are important for Helmut4 communication.
Recommended settings:
Preserve Host Header
This setting should be enabled.
Helmut4 may rely on the original host name used by the client. Preserving the host header ensures that the backend receives the same host name that was used when accessing the ALB, for example:
Without this setting, the backend may receive a modified host header, which can cause incorrect redirects, URL generation issues, or communication problems.
Connection Idle Timeout
The connection idle timeout should be set high enough for long-running Helmut4 requests.
Recommended value:
This helps prevent the ALB from closing idle connections too early during longer operations.
HTTP Client Keepalive Duration
Recommended value:
This allows client connections to stay open and be reused, reducing connection overhead.
X-Forwarded-For Header
Recommended setting:
This allows Helmut4 or upstream services to identify the original client IP address. The ALB appends the client IP to the X-Forwarded-For header before forwarding the request to the backend.
HTTP/2
Recommended setting:
HTTP/2 can remain enabled on the ALB client side. The ALB handles the client connection and forwards the request to the configured Helmut4 target group.
Cross-Zone Load Balancing
Recommended setting:
This allows the ALB to distribute traffic across targets in different Availability Zones, depending on the configured target group and backend availability.
You can also add this compact note to the Summary section:
Optional: Fixed Response for Unmatched Requests
It is recommended to configure a default fixed response on the HTTPS listener for requests that do not match the Helmut4 host header.
Example:
This avoids forwarding unwanted traffic to Helmut4.
How the Setup Works
Clients connect to the Helmut4 DNS name:
The DNS record points to the AWS Application Load Balancer.
The ALB listens on ports 80 and 443.
Traffic on port 80 is redirected to HTTPS on port 443.
Traffic on port 443 is handled by the HTTPS listener. The listener checks the configured rules and forwards matching requests to the Helmut4 target group.
The target group sends the request to the configured Helmut4 backend target.
Summary
For a standard Helmut4 ALB setup, configure:
Replace all placeholder DNS names and ports, such as:
with the actual DNS names, IP addresses, and external ports used in your environment.
Last updated