---
title: How to configure AWS Network Load Balancer (NLB) for use with HA
slug: install-10x/how-to-configure-aws-network-load-balancer-nlb-for-use-with-ha
docTags: 
createdAt: 2025-12-15T15:52:31.235Z
---

A TCP Forwarding Load Balancer needs to forward traffic on port 6443, 443, and 8800 to all the master and worker nodes and traffic on 443 and 8800 to the worker nodes.

In AWS the proper way to do it is to split out into different "target groups" separate pools of nodes organized by their port.

# Sample configuration

1. Create three target groups
   1. kube-api-tg
      1. TCP, 6443, Instance
      2. targets: all master node instances, 6443
   2. dashboard-tg
      1. TCP, 8800, Instance
      2. targets: all master and worker node instances, 6443
   3. swimlane-tg
      1. TCP, 443, Instance
      2. targets: all master and worker node instances, 443
2. Follow steps to Create a Network Load Balancer
   1. Add listener
      1. Port 6443 : forward to kube-api-tg target group
      2. Port 8800: forward to dashboard-tg target group
      3. Port 443: forward to swimlane-tg target group
   2. Security group
      1. Allow Inbound TCP traffic to port 6443, 8800, 443

**Troubleshooting**

- When using NLB on AWS all hosts in the target group are routed to by default if none of them are healthy. It may be worth dropping all instances from the NLB except for the first master out of the 6443 target group. Then try to run the install script again. If all goes, well, the next master can be added to the target group.
- Use the instance type for the Target group = IP instead of Instance
- For more information see https\://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-troubleshooting.htm