A company hosts a highly available, scalable, and resilient application on Amazon EC2 instances that are part of an Auto Scaling group. A network engineer is planning to integrate IPv6 support with…

While subnets need IPv6 addresses and EC2 instances need IPv6 addresses, the problem implies traffic is reaching the NLB, and the lack of *routing* is the more fundamental issue for reachability to the backend from the NLB, rather than just address assignment.

The route tables for the NLB subnets are primarily for traffic destined *to* the NLB or from the NLB *out* of its subnet; if the NLB is receiving IPv6 queries, its subnet routing is likely already functional for ingress, and the issue is with traffic *from* the NLB *to* the backend.

Even if the NLB is dual-stack and receives IPv6 traffic, for that traffic to be forwarded and reach the backend EC2 instances, the route tables associated with the subnets where those EC2 instances reside must contain appropriate IPv6 routes (e.g., a default route to the local gateway or an IPv6 CIDR for intra-VPC routing). Without these routes, the IPv6 traffic cannot egress the subnet to the instances.

The problem states 'IPv6 application queries are not reaching the backend servers,' implying the NLB itself might be reachable. While security groups on the NLB are important, the immediate cause for traffic *not reaching the backend instances* after the NLB receives it is often a routing issue at the target's subnet, rather than the NLB's own security group.