NGINX config restrictions
NGINXaaS for AWS enforces additional restrictions on NGINX configurations to support its managed network interfaces. These restrictions are validated when you upload a configuration; configurations that violate any restriction are rejected before they are applied.
For general listen address and port restrictions that apply to all NGINXaaS deployments, see Listener restrictions.
NGINXaaS for AWS requires using an IPv6 address on listener ports configured for UDP or QUIC protocols. For example, a UDP listener can be configured as listen [::]:53 udp;. If a port configured for UDP or QUIC does not include an IPv6 listening address, the NGINX configuration cannot be applied to an AWS deployment.
Configuring the NGINX deployment to listen on IPv6 does not restrict or otherwise impact the IP address type used for incoming client traffic or upstream traffic. NGINXaaS ensures that IPv4 and IPv6 client traffic is always supported to the frontend service, and you can configure upstream traffic to use IPv4, IPv6, or both based on your application’s needs.
All listen directives for a given port (across every server block in the configuration) must have a consistent proxy_protocol setting. Enabling proxy_protocol on some listeners for a port while leaving it disabled on others is not supported.
All listen directives for the same port must use the same address family:
- Merging within a single server block: When a server block contains both an IPv4 listener and an IPv6 listener on the same port, NGINXaaS collapses them into a single port entry that carries both address families. That entry includes IPv6, so the NLB listener for that port is created as an IPv6 target group.
- Cross-server-block mixing is not allowed: If port N is referenced with an IPv6 address in one server block, every other server block that references port N must also use IPv6. An IPv4-only listener for the same port in a different server block is not supported.
A configuration can define at most 50 unique listen ports across the entire configuration. Configurations with more than 50 unique listen ports are not supported.