# 500 error while Running pomerium-helm on eks behind NLB
**URL:** https://discuss.pomerium.com/t/500-error-while-running-pomerium-helm-on-eks-behind-nlb/105
**Category:** Support
**Created:** [April 20, 2022, 4:56pm UTC](https://discuss.pomerium.com/t/500-error-while-running-pomerium-helm-on-eks-behind-nlb/105 "2022-04-20T16:56:37Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@sgk](https://discuss.pomerium.com/u/sgk)
#### Post date: [April 20, 2022, 4:56pm UTC](https://discuss.pomerium.com/t/500-error-while-running-pomerium-helm-on-eks-behind-nlb/105/1 "2022-04-20T16:56:37Z")
## What happened?
After creating a tunnel using
```auto
$ pomerium-cli tcp worker1-iap.orgdomain.io:22
listening on 127.0.0.1:34523
error serving local connection: invalid http response code: 500
```
from a second terminal, while sshing its throwing 500
```auto
$ssh suser@localhost -p 34523
```
This is the corresponding log from pomerium-proxy pod
```auto
{"level":"info","service":"envoy","upstream-cluster":"","method":"CONNECT","authority":"worker1-iap.orgdomain.io:22","path":"","user-agent":"Go-http-client/1.1","referer":"","forwarded-for":"10.0.0.198","request-id":"ff1f4271-7603-457e-b70f-458dd749d2a3","duration":0.352889,"size":0,"response-code":500,"response-code-details":"ext_authz_error","time":"2022-04-20T16:39:12Z","message":"http-request"}
```
## What did you expect to happen?
it to open auth page on browser and redirect after login
## How’d it happen?
I am running pomerium-helm without TLS on eks and exposing it via NLB.
TLS termination happens at NLB and it forwards to http port of service.
## What’s your environment like?
- Pomerium version (retrieve with `pomerium --version`):
image: pomerium/pomerium:v0.17.1
- Server Operating System/Architecture/Cloud:
helm.sh/chart: pomerium-31.1.3
## What’s your config.yaml?
```auto
config:
rootDomain: Orgdomain.io
address: :80
insecure: true
grpc_address: :80
insecure_server: true
insecureProxy: true
ingressController: false
shared_secret: XXXXXXXXXXXXXXXXXXXXXX=
cookie_secret: XXXXXXXXXXXXXXXXXXXX=
routes:
- from: tcp+https://worker1-iap.orgdomain.io:22
to: tcp://10.0.105.253:22
allowed_domains:
- orgdomain.io
- from: tcp+https://worker2-iap.orgdomain.io:22
to: tcp://10.0.105.252:22
allowed_domains:
- orgdomain.io
```
## What did you see in the logs?
```logs
{"level":"info","service":"envoy","upstream-cluster":"","method":"CONNECT","authority":"worker1-iap.orgdomain.io:22","path":"","user-agent":"Go-http-client/1.1","referer":"","forwarded-for":"10.0.0.198","request-id":"ff1f4271-7603-457e-b70f-458dd749d2a3","duration":0.352889,"size":0,"response-code":500,"response-code-details":"ext_authz_error","time":"2022-04-20T16:39:12Z","message":"http-request"}
```
Could someone help me to understand what is happening here?
---
### Author:  [@denis](https://discuss.pomerium.com/u/denis)
#### Post date: [April 21, 2022, 2:51pm UTC](https://discuss.pomerium.com/t/500-error-while-running-pomerium-helm-on-eks-behind-nlb/105/2 "2022-04-21T14:51:49Z")
- do you have IdP set up?
- do any of the HTTP-only routes work ?
- there must be an additional info from `authorize` service elaborating the reason for rejection
---
### Author:  [@sgk](https://discuss.pomerium.com/u/sgk)
#### Post date: [April 22, 2022, 7:16am UTC](https://discuss.pomerium.com/t/500-error-while-running-pomerium-helm-on-eks-behind-nlb/105/3 "2022-04-22T07:16:33Z")
Yes I’ve configured google IdP,
authenticate endpoint is tested to work by exposing as ingress endpoint
not getting any log on authorize side while this errors out on proxy side
---
### Author:  [@denis](https://discuss.pomerium.com/u/denis)
#### Post date: [April 25, 2022, 7:05pm UTC](https://discuss.pomerium.com/t/500-error-while-running-pomerium-helm-on-eks-behind-nlb/105/4 "2022-04-25T19:05:34Z")
do any of the HTTP-only routes work?
---
### Author:  [@sgk](https://discuss.pomerium.com/u/sgk)
#### Post date: [May 4, 2022, 5:32am UTC](https://discuss.pomerium.com/t/500-error-while-running-pomerium-helm-on-eks-behind-nlb/105/5 "2022-05-04T05:32:52Z")
yes, the exposed authenticate endpoint worked fine
---
### Author:  [@denis](https://discuss.pomerium.com/u/denis)
#### Post date: [May 6, 2022, 9:27pm UTC](https://discuss.pomerium.com/t/500-error-while-running-pomerium-helm-on-eks-behind-nlb/105/6 "2022-05-06T21:27:22Z")
1. there must be a corresponding error in `authorize` pod with further details
2. Normally you should have your browser open, note there is a `browser-cmd` option if there’s an issue with your default browser opening command.
3. is your certificate chain trusted on the machine you’re running `pomerium-cli`? try `disable-tls-verification` option.