Load balancing in Layer 4 vs Layer 7 with HAPROXY Examples

💻 More software engineering videos • Software Engineering b...
Load balancing is process of balancing incoming requests to multiple machines, processes or services. In this video we will explain two types of load balancers, layer 4 and layer 7.
Chapters
0:00 Intro
6:00 L4 Load balancer
9:10 L4 Load Balancer Pros and Cons
16:18 Example L4 Load Balancer with HAPROXY
22:30 L7 Load Balancer
27:00 L7 Pros and Cons
31:00 Example L7 Load Balancer with HAPROXY
37:00 Summary
Layer 4 (4/3)
Take content forwards it based on basic rules, it knows ip and port and perhaps latency of the target service.
Layer 4 - haproxy, NLB
Pros
- great for simple packet-level load balancing
- Fast and efficient doesn’t look at the data
- More secure as it cant really look at your packets. So if it was compromised no one can look
- Uses NAT
- One connection between client and server NATed
Cons
- Cant do smart load balancing based on the content, such as switch request based on requested media type
- Cant do microservices with this type
- Has to be sticky as it is a stateful protocol (all segments)
Layer 7 (Nginx , haproxy)
This type of proxy actually looks at the content and have more context, it knows you are visiting the /users resources so it may forward it to a different server. Essential and Great for microservices , it knows the content is video:image etc..
it can also cache.. we cant really do caching on layer 4 because we have no clue whats in the packets.
But expensive because it has to decrypt and look and compute
Layer 4 - haproxy, nlb
- great for simple packet-level load balancing
- fast and efficient doesn’t look at the data
- More secure as it cant really look at your packets. So id it was compromised no one can look
- Uses NAT
- One connection between client and server NATed
Layer 7 - examples nginx
- Smart routing based on the url (microservices) flexible
- Provide caching
- Expensive need to decrypt
- Secuirty, you have to share your certificate with the load balancers. Id compromised attacker has access to all your data.
- Proxy creates multiple connection (client to proxy/proxy to server)
Image thumbnails www.haproxy.com
Support me on PayPal bit.ly/33ENps4
Become A Patron / hnasr
Stay Awesome!
Hussein

[@hnasr]

Learn the fundamentals of the backend, scaling and load balancing with my Introduction to NGINX udemy course nginx.husseinnasser.com

[@bahaaeldeen4699]

this playlist just keep getting better and better honestly it may be the greatest channel in the tech field

[@hnasr]

Glad you enjoy it! Thanks Bahaa

[@anamulkabir1014]

"More we repeat more we learn!" that's the way to teach - thank you so much Nasser, you are the best!

[@siddharthshukla9832]

dude, i simply love the way you articulate. It is like listening to a story. I tried to look up some other videos on this topic. But frankly speaking, the difference between Layer 4 and 7 was never explained so easily. Hats off to you Hussein

[@robertluong3024]

I randomly came here from your NAT video just for fun. I didn't expect to leave with a clear understanding of this. You're awesome.

[@amitbist2k2]

Great, I am a unix sysadmin and you helped me understand some old stuff making it easier. Those good old days!

[@arunsatyarth9097]

29:50 "I dont want the load balancer to look at my data." Sir, the fact that you dont have a million subscribers is a crime on humanity.

[@esra_erimez]

Agreed

[@chiefolk]

I think the data here is URL u just entered in the browser which gives IP address so doesn't make sense if you don't want to see them this URL for privacy reasons

[@aniekutmfonekere740]

the best channel ever with real-world application of tech

[@aarthydesikan9939]

Very well explained, thanks so much! Your way of explaining with an intent to capture audience attention but the same time not compromising the technical details is very nice.

[@iammjpops]

I dont know if I would have understood L4 and L7 R-Proxy better... THANKS A LOT! Bow to you!

[@ujemvi]

He killed me with the "pew pew pew" at the round robin demonstration

[@SunilRana-tm8lm]

Hi Hussein! I recently came across your channel and now I wish I had found this earlier. Thanks for the amazing informatic videos.

[@tikz.-3738]

Was just looking for websockets ended up watching 7hrs in a row ur awesome and ur just the teacher I wanted no 5min videos tho it was quite hard to click on those 40min videos once I did it didn't felt like I was watching something for 40mins well it's just interest and great content quality but dude heads off to u thanks for all this awesome knowledge at once place

[@hnasr]

❤️❤️ that is awesome 👏 thank you for your kind words and glad you enjoyed the content 🙏🙏

[@tikz.-3738]

@@hnasr still counting, after learning from all the linked and suggested videos I'm finally seeing the first video of websockets for which I initially came 😂 came for websockets became network engineer and more aware back-end engineer ur awesome dude I have no words for the content quality and availability

[@richardmaduka4747]

Your content is gold.

[@sebschrader]

Most load balancers (and especially HAProxy and nginx!) still use two different TCP connections in L4 mode with potentially different timeouts, window sizes etc. There are load balancers that simply forward packets (e.g. Linux ipvs) and only have a single end-to-end TCP connection between the client and the backend, but these are more uncommon.

[@JuanManuelMunozBetancur]

Hi, could you please share any documentation to verify this information

[@davidlira8853]

this helped me have a better understanding of the difference between a Layer 4 Load Balancer and a Layer 7 Load Balancer. Now I understand that an ingress is a Layer 7 Load Balancer

[@fireystella]

Ur content is super great! And ur narration 😂 just when I’m losing my attention you say something funny and then I’m paying attention again 😆😆 many thanks!

[@eraldkeshi3645]

HI Hussein ! I'm so happy to have found a channel with such a great content. I have noticed that besides the videos, your slides are also very clear and concise. It would be really helpful if you could also share a link to them ! Keep up the good work

[@hnasr]

Glad you like them! thanks Erlad!

[@jeetendrashinde2855]

An excellent demostration of difference between the 2 Load balancers, good job Hussein !!

[@hnasr]

Thanks Jeetendra!! appreciate it

[@xavierk99]

A great explanation with a lot of energy. Love it!

[@r3jk8]

Thumbs up for the clear explanation of this topic and also for the super funny comment “that’s what she said.” 14:11

[@SinghGaurav9]

Hey man, thanks for the video, it was informative. Your funny style made it even more interesting.

[@rishabhjain5459]

Thanks for making our life easy and also for making your videos a lot more entertaining. :D

[@Iliasbhal]

BTW, you are clearly the best teacher on youtube. I think you can teach anything actually ;). You are making learning so much joyful.

[@hnasr]

Iliasbhal aww 😊 thank you so much I am glad you enjoy the content

[@sirbumblefuck]

I like your teaching style.

[@hnasr]

Rahul Pandey thanks Rahul!

[@COOL-rt5ex]

Good to see configuration in the video

[@smartstack]

very crisp & informative

[@GlenMillard]

"..that's what she said!!!..." Ha - someone is a Micheal Scott fan!!

[@hnasr]

You think? kzbin.info/www/bejne/nIeugaV6p6qqiqs

[@pajeetsingh]

TLDR?

[@davidlira8853]

that cracked me up lol

[@ezekielchoke2580]

What you're describing around the 30 minute mark - sharing the pool of connections - is exactly what nginx does. It's sometimes called multiplexing. In our case, this causes an issue, since the application behind the LB needs to recognize the client and attempts to set a very long cookie, which the client truncates.

[@Obsi995]

guys not only is he extremely helpful but he also loves The Office :'( amazing

[@hnasr]

If you are an office fan You will like this http/2 video kzbin.info/www/bejne/nIeugaV6p6qqiqs

[@subhamprasad1373]

thank you, for your hard work. you are such an amazing person, sharing all this wonderful knowledge.

[@MI5500]

This guy will be a great dad 😂😁

[@goatslayer5957]

The man the legend!

[@wangsonny8694]

thanks for this great video, helps a lot for preparing system design interviews!

[@icbm7]

was the page not changing at 21:37 was because of the browser cache?

[@user-fy2mc7ip3f]

How does the layer 7 LB know which client to respond to, when it receives the response from server? In layer 4, it is done by maintaining a NAT, and it is the same TCP connection.

[@iQatif]

شكرا ابو علي

[@hnasr]

العفو

[@ArdhenduShekhar-sw4uy]

HE PUT A THAT'S WHAT SHE SAID JOKE IN THERE. ABSOLUTE LEGEND.

[@pajeetsingh]

How does actual forwarding works? Create new socket between RP and Server? There has to be at least two open socket invoked in client to backend, is not it? It is just the RP makes it look like one TCP connection.

[@DYamanoha]

Yeah I was a bit confused about the '1 tcp connection' pro that was called out for Layer 4 LBs. The only way this could work is if you had 2 sockets for each logical connection. One for the client connection, and one for the back-end server connection. As soon as the proxy accepts a client connection it must store that socket along with a new socket connection to which ever back-end server was chosen. Bytes just get copied between the receive and send buffers of the socket pairs. All this ip swapping is automatically done through the socket API abstraction. The same would have to happen for layer 7 LBs. Afaik, the only difference is that Layer7 LBs deserialize the http protocol. One huge benefit is per. http request routing, which can help even out load across your backends.

[@briansaunders4745]

Can you create a video about the Denial of Service features of a load balancer, and talk about how an ADC is the same or like a load balancer? Very cool delivery and the humor is appreciated and very good!

[@hnasr]

Thanks Brian, I talked about DOS here kzbin.info/www/bejne/anqapYONbdSZaMk

[@pkcc9381]

U are AWESOME. U made this video even though this is not most voted topic in ur last survey.

[@hnasr]

PK CC you guys are awesome! Of course I will make videos on topic you guys interested in. Ill just adjust priorities. Hope you enjoy it and thanks for commenting ! Stay awesome 😎

[@DevOpsEnver]

MashAllah you are so good and professional in your area.

[@animatrix1851]

I have a small question, also thank you for answering my question on your other video!!! So essentially, my thinking is that you'd need to balance your load if one server is .. well being overloaded. So in this instance, if i do setup a load balancer that doesn't redirect me but actually funnels the data through itself. Then, what's preventing the load balancer from being overloaded itself ? It's handling all the tcp connections of both the servers in your example right ? Sure, it's not doing cpu work but there's some I/O throttling that'll happen eventually right ? I'm just confused here because if that's the case would you put a load balancer to that load balancer, there's still going to be a single point of failure if the balancer dies/overloads. Correct me if i'm assuming that I/O load could be high, maybe funneling bytes isn't that tiring and the load balancer could do it no problem. (or) maybe the tcp connection splits away after the initial hit and the data doesn't go through the balancer anymore ? I'd love for you to answer this since i've not been able to wrap my head around this part.

[@chandanapericharla]

Your concerns are totally valid. If there are too many concurrent connections, it can throttle the load balancer itself bringing down the overall availability of the system. Hence, heavy traffic applications like Google and Facebook opt for distributed load balancing where the load balancer is not a single server. Google offers one such service called GCLB-Google cloud load balancer. You can find some info on it here:landing.google.com/sre/workbook/chapters/managing-load/

[@vjmathew6962]

may be you would have found your answer, if not, see keepalived video of Hussein. You will get an idea Edit : keywords VIP ( virtual ip ), VRRP

[@RNCode1234]

@hnasr If Layer 4 load balancer heavily relies on IP Address which is Layer 3. Why do we still call it Layer 4 load balancer? We could call it Layer 3 load balancer. Isn't it?

[@abdelrhmanahmed1378]

in layer 4 ,we have one connection between the client and the load balancer and the server ? how is that happening , what about the acks > and what happen if the packet is lost between one node and the other ?

[@antoniorap8825]

Hey, thank for this helpfull and amazing tutorial and explaination. sorry for my bad english. I have a question, the backend IP can be found / detected by anyone ?? its there a possibility to hide a tcp connection using netcat to the load balancer proxy, and connecting to the backend, with sniffing maybe no? thank for people who respond and help !

[@dr99tm23]

thank you a lot.

[@coolzsatyen1]

Great Explanation, however you said you love to repeat, then you do not follow DRY principles :)... Keep posting such great videos. Appreciate !!

[@BoyzaLetlojane]

Enjoyed this video. Learning made fun!! :)

[@hnasr]

Thanks George! Glad it was

[@joesephbattle7834]

Kristen n charles

[@jianxiongng1979]

I had a Nginx behind the HAProxy, how can I pass the authentication of Nginx back to Nginx server through the HAProxy?

[@viswa9109]

From my understanding, one http request can potentially span multiple packets. if that is the case, how does layer 4 proxy take care of that. Like if it does a round robin or something else and sends the packets to different servers, wouldn't the packets be useless? How does the layer4 proxy handle this Edit: Ok so, I see that stickiness is employed. Just had to rewatch the video!

[@recepinanc3351]

Thank you for the great post!

[@Mayank0391]

Again a very nice video. A detailed tutorial video of haproxy would be great.

[@hnasr]

Thanks 😊 haproxy tutorial is requested a lot! Ill need to make it soon. Have so much other videos on my backlog

[@underlecht]

most interctive videoooooo

[@xinyuzhang]

Oh I bought your lecture on udemy, teacher

[@mamyname]

Keep up the good Tutorials.. thanks for sharing :)

[@hnasr]

Glad you like them!

[@rhul0017]

OK Hussein i have a doubt, since the segments are part of layer 4, then those units will definitely have IP included in that, Then we can use it to make the units sticky by forwarding the same segments with same IP to a server right,How is that a con, layer 4 can do that right, correct me if am wrong, i am just getting started, thanks

[@edenr1988]

Awesome tutorials, I've learned a lot from them about networking thanks !! :) you seems to know a lot about networking so I have one question (maybe not 100% related to this video, it's also related to previous videos that you released) - I have the following use case, I want to redirect traffic to my local private network from a public cloud provider VM and I was thinking whether I should use iptables tcp forwarding (after seeing your other tutorial) or for example nginx / haproxy ws tunnel. Do you happen to know what's the pros and cons of these approaches ? what would be most reliable in terms of latency and security ? should I be just fine with iptables TCP forwarding ? or should I go with ws tunnel (The next step would be to build client / server app to automate the update of my private NAT IP address on that server so I can keep getting traffic from that "cloud static ip", I would also make it open source with MIT once I get into implemention) I've tested the iptables tcp proxy from your other tutorial and it did in fact worked, I could recieve traffic and respond from a cloud instance that was transfering the tcp packet to my local network. I've never tried ws tunnel thought and would like to know your opinion. To be more specific I have a Kubernetes Ingress on my local network (Layer 7 Loadbalancer) that the traffic would be transfered to it using portforwarding on my router. So from the cloud instance all I need is the static ip address basically (and the point of it is that I would be able to use more resources by only creating one single instance for probably $5 a month), I just want to transfer the client to my private cluster on my private network, the rest would be handled on my local private network.

[@dangaines405]

Great content!

[@hnasr]

Thanks Dan!

[@ayalaginy1734]

i love you man

[@hnasr]

Ayala Giny ❤️❤️❤️

[@AhmedMohamed-xs5ij]

This tutorial is great

[@parasarora5869]

yeeahhh...!! This was fun .. :) .. great video sir !

[@brurytangkere4874]

Hi, is there example if the HAProxy Loadbalancer using redis db as a session

[@abdelrahmanabdelfattah1092]

Thanks for this great video, I have a question, what is the difference between using an SSL certificate on layer 4 load balancer vs using it on layer 7 load balancer?

[@hnasr]

Fantastic question. Layer 7 load balancer must terminate TLS while Layer 4 load balancer doesn’t have to. L4 LB can terminate TLS means serve the certificate from the LB, which means it can decrypt and look at the content. It can also decides to Passthrough the TLS. Hello all the way to the backend which means it is end to end encryption and cert is served from Backend

[@sneharajit41]

I understand the concept of two flavors of load balancer but my question is since a load balancer is basically a software and processes the incoming request why both are not working in a single layer(layer 7)?

[@pablohernandez4305]

Great video

[@deeptshukla5141]

Great placement of that's what she said! Great tutorial @Hussein

[@ChrisAthanas]

Great explanation

[@narularitesh]

Hi Hussein, your method of explanation is amazing, simple and logical. You are right bang on it. Amazing. I am really impressed, because I have always been confused with LBs. I have a few doubts (and probably some ideas for content enhancement based on my doubts), is there a way I can connect with you. Any support is helpful. Thanks.

[@mr.roulette7537]

Thanks Sir!!

[@girishnl]

Great video. great content, very well explained. thank you for your effort :-)

[@manasdalai3934]

Loved it. Great content.

[@hnasr]

Glad you enjoyed it!

[@mohamedjasim3916]

Just amazing ....

[@pengdu7751]

great video and explanation. the flying red dot is a bit distracting

[@hnasr]

thanks and apologies for the red dot, I try to get better as I make more videos

[@pengdu7751]

@@hnasr but overall great work. keep'em coming. it's been so fun and informational watching your videos. right to the point with demos. I teach in college part time and I wish I could be as a good speaker as you.

[@hnasr]

Thank you Peng for your kind words. I find making videos help improve my skills. I still need lots of work, particularly getting to the point quicker

[@RandomShowerThoughts]

This was a hell of video!

[@hichamlotfi4277]

you are the best

[@fyrweorm]

I don't get it. What's the difference between an api gateway and a layer 7 load balancer?

[@rajeshkishore7119]

great explanation

[@hnasr]

Glad you liked it

[@msk9414]

Hello Nasser, I have question regarding the function of layer 3 when layer 4 load balancing is used.I know layer 3 is responsible for establishing session when using layer 7 LB , but as per the video If I am using layer 4 LB then layer 4 is establishing the session which takes over layer 3 responsibility.Are layer 7,6,5 skipped when using layer 4 LB ?

[@tusharh4723]

Hi Hussein, great content. Thanks!! One question is in your example of layer 7 load balancing with Haproxy I did not see ssl certificate mentioned in configuration,then how Haproxy was able to work on layer7????

[@sarwowibowo9318]

What if the load balancer is died? How to guarantee fault tolerant?

[@nafasm]

Great video.Thank You

[@hnasr]

Thanks Nafas!

[@hingusanjay]

Great tutorial. One question, if load balancer algo it round robin, then it was sticking to 4444 or 5555 only without you killing one of the server?

[@la4123]

I'm wondering abaut that either. It's so weird.

[@pajeetsingh]

Good one.

[@bobbycyy2462]

wonderful video!

[@anicetdidi7957]

Great! :) funny and clear

[@hnasr]

😊 thanks !

[@AMANSINGH-gg8xz]

Hii, I just watched your video today, I have one doubt that if layer 4 load balancer uses one TCP connection how can we give a grantee to the client that the packet has been sent?

[@Midhunchowdary]

Wondering if microservices can run behind Layer 4 LB by running the services on different ports?

[@brianpayne3468]

Can you do a log-format in using logging (rsyslog) in HAProxy. I like to troubleshoot an HAProxy issue where it is dropping connections in rare occasions. Something to do with a sticky-bit in HAProxy timing out. The HAProxy is used as a Load Balancer ( reversed proxy) and runs as a container. Only connect using HTTPS in the Load Balancer using ports 80, 443, and 7999. From the logs, I like to see why and where it is dropping the connection. I would like to see the log info on the time duration of the connection. I am currently using 3.2.14 version of HAProxy. Thanks!

[@mohamedshlibik6190]

Great stuff indeed

[@negiworldnegi]

awesome!

[@gguestdub3518]

But i dont want web, i want layer 4 i mean ping?? Tcp connection over powershell???? U understand??

[@krozaine]

Layer 4 Load Balancer Demo : How did HAProxy know 4444 is down? Was it the first failed request that told it or was it some heartbeat type of mechanism between HAProxy and the backend services? Also, I am curious about the "check" keyword mentioned in the cfg file.

[@hnasr]

Haproxy periodically does a health check against the backends and see if they are alive. And if they are not they remove it from the backend pool

[@filippomachi2314]

Thanks Hussein, I really enjoyed this video and I was able to understand a lot of things. But I have a question, I am exploring the possibility to use Server Sent Events, in this case I can only use layer 7 load balancer, am I wrong? Thanks again!

[@hnasr]

Filippo Machi Thanks Filippo! Man i just love these questions because they make me think 💭 Ok so short answer is you can use a layer 4 load balancer with SSE and websockets much easier and reliable than a layer 7 load balancer. Not saying you cannot do it with L7LB But you need to find a load balancer that actually supports that. Here is why: layer 4 load balancer will NAT the tcp connection to final destination server and exchange packets in a single connection. So the server can send information to the load balancer and load balancer will simply NAT things to the client. So if i make an HTTP GET request to a L4 LB, first i try to establish a tcp connection with LB, LB will actually build a table and change the packet ip address destination to one of the backend servers, and forward the packet, and then simply acts like a gateway(kinda like how your router works) and now one your tcp connection is established you are tethered to one server .. so any http request on the same tcp will ALWAYS go to the same backend server.. unless you establish a new session. That is why SSE and websockets work normally since they are stateful like that.. However with layer 7 LB as we explained in the video, the client connects to the load balancer first so thats one tcp connection and the load balancer will establish another tcp connection to the backend server. So if I make a simple HTTP request to the layer 7 load balancer, my final destination as a client is the load balancer, The load balancer will then block my request (synchronously) and make the request to one of the backend servers, get the result, unblock me and return the result. So in this case most load balancers are really waiting for a request from clients ... but what happen if all of a sudden the server started to send something to the load balancer? (Server side events) what does that mean? How does the layer 7 load balancer know what client to forward the request to ? Smart load balancers might actually build a table and start mapping ip addresses to client ports. Other load balancers might make the backend server respond to the client directly So you see how complex it is to do layer 7, you can use layer 4 LB, The only thing is you will get a sticky load balancer to a single server per client session. i need to do more research and videos on this topic very interesting.. Hope that helps!

[@filippomachi2314]

@@hnasr thanks a lot for answering my question, let me know if you perform further research or video regarding this topic :)

[@blablabla050484]

Great explaination, and Very Cool Cursor movements. what kind is it ?

[@hnasr]

Rico Agung Firmansyah Thanks 🙏 I use google slides

[@netman87]

Is there way to make haproxy keep connection alive? i mean with internal http2 we should be able to have multible streams in single connection and in this example it looks like it gets new connection everytime? atleast from haproxy to nodes

[@hnasr]

You can set the timeouts as needed check out the video here kzbin.info/www/bejne/p4rRcmV6e6p4gtk

[@CODINC]

Hussein what is the use of load balancer if i can use reverse proxy because reverse proxy is a load balancer? Is it any efficient?

[@shazadrojan2387]

quick question about Layer 4 using https - port 443 and SSL termination. If I am only using https-port 443 it is necessary to terminate SSL on the LB or can i just do this in IIS bindings?

[@hnasr]

It depends on your backend if the backend supports TLS then IIS should really do a TLS Passthrough not termination (since you said its layer 4 LB) the certificate being served will be the backend not the LB If the backend doesn’t support TLS then it the LB will do a TLS termination and serves its certificate instead. The traffic on the backend will be unencrypted might not be desirable

[@Hellmiauz]

so in terms of uplink and bandwidth usage. If backend 1 and 2 have a 1Gbps port, Haproxy server needs a 2Gbps port to be able to transfer at full capacity? And bandwidth, if server 1 and 2 consumed say 1TB each in a day, Haproxy will consume 2TB on same period?

[@hnasr]

A very interesting insights lets unpack it the backend network interface of HAProxy must live in the same network as backend servers. Probably I am imagining a network switch between them. One port going from HAP to the switch, and from the switch to each backend server. So now the numbers. If we assumed defaults 1 Gbps for all ports. Than haproxy can upload and download 1 Gb per second (~128 MB each second). so if two clients concurrently requested to fetch a resource that is 128MB In size, from HAP, the first request goes to backend 1 the second goes to backend 2. But it will take HAProxies two full seconds to download this resource from each server (assuming no caching) So yes! a 2Gbps uplink:dnlink HAProxy will download the two resources concurrently in 1 second (50%) faster. And to answer your final question, yes if server 1 and 2 uploaded 1 TB each, then HAProxy will have “downloaded” 2TB. Thanks! Let me know if I missed something

[@navindudissanayake1669]

Why does a level 7 load balancer need 2 TCP connections compared to 1 on level 4?