We have PROXY protocol support enabled on our ELB but we seem to be occasionally getting non-PROXY TCP connections to the EC2 instance behind the ELB. The instance's Security Group only allows incoming connections from the ELB.
Is it possible for ELB to initiate non-PROXY connections to the EC2 instance in certain circumstances when PROXY protocol support is enabled? When doing health checks, for example? This one really baffles us.
From reading this post in the AWS forums, it looks like the answer to your question is "Yes, it is possible to get non-PROXY TCP connections, via health checks, to your backend instances."
If your ELB health checks are done via HTTP, then the PROXY protocol will not be used. Looks like there are many folks who would wish for consistent use of the PROXY protocol from ELBs, for HTTP as well as TCP health checks, but so far, no reports of AWS adding this.