Load balancing in Layer 4 vs Layer 7 with HAPROXY Examples

💻 More software engineering videos • Software Engineering b...
Load balancing is process of balancing incoming requests to multiple machines, processes or services. In this video we will explain two types of load balancers, layer 4 and layer 7.
Chapters
0:00 Intro
6:00 L4 Load balancer
9:10 L4 Load Balancer Pros and Cons
16:18 Example L4 Load Balancer with HAPROXY
22:30 L7 Load Balancer
27:00 L7 Pros and Cons
31:00 Example L7 Load Balancer with HAPROXY
37:00 Summary
Layer 4 (4/3)
Take content forwards it based on basic rules, it knows ip and port and perhaps latency of the target service.
Layer 4 - haproxy, NLB
Pros
- great for simple packet-level load balancing
- Fast and efficient doesn’t look at the data
- More secure as it cant really look at your packets. So if it was compromised no one can look
- Uses NAT
- One connection between client and server NATed
Cons
- Cant do smart load balancing based on the content, such as switch request based on requested media type
- Cant do microservices with this type
- Has to be sticky as it is a stateful protocol (all segments)
Layer 7 (Nginx , haproxy)
This type of proxy actually looks at the content and have more context, it knows you are visiting the /users resources so it may forward it to a different server. Essential and Great for microservices , it knows the content is video:image etc..
it can also cache.. we cant really do caching on layer 4 because we have no clue whats in the packets.
But expensive because it has to decrypt and look and compute
Layer 4 - haproxy, nlb
- great for simple packet-level load balancing
- fast and efficient doesn’t look at the data
- More secure as it cant really look at your packets. So id it was compromised no one can look
- Uses NAT
- One connection between client and server NATed
Layer 7 - examples nginx
- Smart routing based on the url (microservices) flexible
- Provide caching
- Expensive need to decrypt
- Secuirty, you have to share your certificate with the load balancers. Id compromised attacker has access to all your data.
- Proxy creates multiple connection (client to proxy/proxy to server)
Image thumbnails www.haproxy.com
Support me on PayPal bit.ly/33ENps4
Become A Patron / hnasr
Stay Awesome!
Hussein

[@hnasr]

Learn the fundamentals of the backend, scaling and load balancing with my Introduction to NGINX udemy course nginx.husseinnasser.com

[@bahaaeldeen4699]

this playlist just keep getting better and better honestly it may be the greatest channel in the tech field

[@hnasr]

Glad you enjoy it! Thanks Bahaa

[@anamulkabir1014]

"More we repeat more we learn!" that's the way to teach - thank you so much Nasser, you are the best!

[@siddharthshukla9832]

dude, i simply love the way you articulate. It is like listening to a story. I tried to look up some other videos on this topic. But frankly speaking, the difference between Layer 4 and 7 was never explained so easily. Hats off to you Hussein

[@amitbist2k2]

Great, I am a unix sysadmin and you helped me understand some old stuff making it easier. Those good old days!

[@aarthydesikan9939]

Very well explained, thanks so much! Your way of explaining with an intent to capture audience attention but the same time not compromising the technical details is very nice.

[@robertluong3024]

I randomly came here from your NAT video just for fun. I didn't expect to leave with a clear understanding of this. You're awesome.

[@SinghGaurav9]

Hey man, thanks for the video, it was informative. Your funny style made it even more interesting.

[@iammjpops]

I dont know if I would have understood L4 and L7 R-Proxy better... THANKS A LOT! Bow to you!

[@aniekutmfonekere740]

the best channel ever with real-world application of tech

[@SunilRana-tm8lm]

Hi Hussein! I recently came across your channel and now I wish I had found this earlier. Thanks for the amazing informatic videos.

[@richardmaduka4747]

Your content is gold.

[@eraldkeshi3645]

HI Hussein ! I'm so happy to have found a channel with such a great content. I have noticed that besides the videos, your slides are also very clear and concise. It would be really helpful if you could also share a link to them ! Keep up the good work

[@hnasr]

Glad you like them! thanks Erlad!

[@rishabhjain5459]

Thanks for making our life easy and also for making your videos a lot more entertaining. :D

[@wangsonny8694]

thanks for this great video, helps a lot for preparing system design interviews!

[@jeetendrashinde2855]

An excellent demostration of difference between the 2 Load balancers, good job Hussein !!

[@hnasr]

Thanks Jeetendra!! appreciate it

[@ujemvi]

He killed me with the "pew pew pew" at the round robin demonstration

[@arunsatyarth9097]

29:50 "I dont want the load balancer to look at my data." Sir, the fact that you dont have a million subscribers is a crime on humanity.

[@esra_erimez]

Agreed

[@dhikshith_reddy]

I think the data here is URL u just entered in the browser which gives IP address so doesn't make sense if you don't want to see them this URL for privacy reasons

[@subhamprasad1373]

thank you, for your hard work. you are such an amazing person, sharing all this wonderful knowledge.

[@fireystella]

Ur content is super great! And ur narration 😂 just when I’m losing my attention you say something funny and then I’m paying attention again 😆😆 many thanks!

[@Iliasbhal]

BTW, you are clearly the best teacher on youtube. I think you can teach anything actually ;). You are making learning so much joyful.

[@hnasr]

Iliasbhal aww 😊 thank you so much I am glad you enjoy the content

[@recepinanc3351]

Thank you for the great post!

[@xavierk99]

A great explanation with a lot of energy. Love it!

[@girishnl]

Great video. great content, very well explained. thank you for your effort :-)

[@AhmedMohamed-xs5ij]

This tutorial is great

[@smartstack]

very crisp & informative

[@mamyname]

Keep up the good Tutorials.. thanks for sharing :)

[@hnasr]

Glad you like them!

[@ChrisAthanas]

Great explanation

[@davidlira8853]

this helped me have a better understanding of the difference between a Layer 4 Load Balancer and a Layer 7 Load Balancer. Now I understand that an ingress is a Layer 7 Load Balancer

[@Mayank0391]

Again a very nice video. A detailed tutorial video of haproxy would be great.

[@hnasr]

Thanks 😊 haproxy tutorial is requested a lot! Ill need to make it soon. Have so much other videos on my backlog

[@tikz.-3738]

Was just looking for websockets ended up watching 7hrs in a row ur awesome and ur just the teacher I wanted no 5min videos tho it was quite hard to click on those 40min videos once I did it didn't felt like I was watching something for 40mins well it's just interest and great content quality but dude heads off to u thanks for all this awesome knowledge at once place

[@hnasr]

❤️❤️ that is awesome 👏 thank you for your kind words and glad you enjoyed the content 🙏🙏

[@tikz.-3738]

@@hnasr still counting, after learning from all the linked and suggested videos I'm finally seeing the first video of websockets for which I initially came 😂 came for websockets became network engineer and more aware back-end engineer ur awesome dude I have no words for the content quality and availability

[@BoyzaLetlojane]

Enjoyed this video. Learning made fun!! :)

[@hnasr]

Thanks George! Glad it was

[@joesephbattle7834]

Kristen n charles

[@pkcc9381]

U are AWESOME. U made this video even though this is not most voted topic in ur last survey.

[@hnasr]

PK CC you guys are awesome! Of course I will make videos on topic you guys interested in. Ill just adjust priorities. Hope you enjoy it and thanks for commenting ! Stay awesome 😎

[@RandomShowerThoughts]

This was a hell of video!

[@LawZist]

Great stuff!

[@nafasm]

Great video.Thank You

[@hnasr]

Thanks Nafas!

[@deeptshukla5141]

Great placement of that's what she said! Great tutorial @Hussein

[@Rahul79821]

I like your teaching style.

[@hnasr]

Rahul Pandey thanks Rahul!

[@manasdalai3934]

Loved it. Great content.

[@hnasr]

Glad you enjoyed it!

[@r3jk8]

Thumbs up for the clear explanation of this topic and also for the super funny comment “that’s what she said.” 14:11

[@bobbycyy2462]

wonderful video!

[@sebschrader]

Most load balancers (and especially HAProxy and nginx!) still use two different TCP connections in L4 mode with potentially different timeouts, window sizes etc. There are load balancers that simply forward packets (e.g. Linux ipvs) and only have a single end-to-end TCP connection between the client and the backend, but these are more uncommon.

[@JuanManuelMunozBetancur]

Hi, could you please share any documentation to verify this information

[@DevOpsEnver]

MashAllah you are so good and professional in your area.

[@ezekielchoke2580]

What you're describing around the 30 minute mark - sharing the pool of connections - is exactly what nginx does. It's sometimes called multiplexing. In our case, this causes an issue, since the application behind the LB needs to recognize the client and attempts to set a very long cookie, which the client truncates.

[@rajeshkishore7119]

great explanation

[@hnasr]

Glad you liked it

[@edenr1988]

Awesome tutorials, I've learned a lot from them about networking thanks !! :) you seems to know a lot about networking so I have one question (maybe not 100% related to this video, it's also related to previous videos that you released) - I have the following use case, I want to redirect traffic to my local private network from a public cloud provider VM and I was thinking whether I should use iptables tcp forwarding (after seeing your other tutorial) or for example nginx / haproxy ws tunnel. Do you happen to know what's the pros and cons of these approaches ? what would be most reliable in terms of latency and security ? should I be just fine with iptables TCP forwarding ? or should I go with ws tunnel (The next step would be to build client / server app to automate the update of my private NAT IP address on that server so I can keep getting traffic from that "cloud static ip", I would also make it open source with MIT once I get into implemention) I've tested the iptables tcp proxy from your other tutorial and it did in fact worked, I could recieve traffic and respond from a cloud instance that was transfering the tcp packet to my local network. I've never tried ws tunnel thought and would like to know your opinion. To be more specific I have a Kubernetes Ingress on my local network (Layer 7 Loadbalancer) that the traffic would be transfered to it using portforwarding on my router. So from the cloud instance all I need is the static ip address basically (and the point of it is that I would be able to use more resources by only creating one single instance for probably $5 a month), I just want to transfer the client to my private cluster on my private network, the rest would be handled on my local private network.

[@mohamedjasim3916]

Just amazing ....

[@COOL-rt5ex]

Good to see configuration in the video

[@dr99tm23]

thank you a lot.

[@pablohernandez4305]

Great video

[@iQatif]

شكرا ابو علي

[@hnasr]

العفو

[@dangaines405]

Great content!

[@hnasr]

Thanks Dan!

[@pajeetsingh]

Good one.

[@mr.roulette7537]

Thanks Sir!!

[@mohamedshlibik6190]

Great stuff indeed

[@narularitesh]

Hi Hussein, your method of explanation is amazing, simple and logical. You are right bang on it. Amazing. I am really impressed, because I have always been confused with LBs. I have a few doubts (and probably some ideas for content enhancement based on my doubts), is there a way I can connect with you. Any support is helpful. Thanks.

[@parasarora5869]

yeeahhh...!! This was fun .. :) .. great video sir !

[@briansaunders4745]

Can you create a video about the Denial of Service features of a load balancer, and talk about how an ADC is the same or like a load balancer? Very cool delivery and the humor is appreciated and very good!

[@hnasr]

Thanks Brian, I talked about DOS here kzbin.info/www/bejne/anqapYONbdSZaMk

[@negiworldnegi]

awesome!

[@anicetdidi7957]

Great! :) funny and clear

[@hnasr]

😊 thanks !

[@underlecht]

most interctive videoooooo

[@hingusanjay]

Great tutorial. One question, if load balancer algo it round robin, then it was sticking to 4444 or 5555 only without you killing one of the server?

[@la4123]

I'm wondering abaut that either. It's so weird.

[@Obsi995]

guys not only is he extremely helpful but he also loves The Office :'( amazing

[@hnasr]

If you are an office fan You will like this http/2 video kzbin.info/www/bejne/nIeugaV6p6qqiqs

[@tusharh4723]

Hi Hussein, great content. Thanks!! One question is in your example of layer 7 load balancing with Haproxy I did not see ssl certificate mentioned in configuration,then how Haproxy was able to work on layer7????

[@animatrix1851]

I have a small question, also thank you for answering my question on your other video!!! So essentially, my thinking is that you'd need to balance your load if one server is .. well being overloaded. So in this instance, if i do setup a load balancer that doesn't redirect me but actually funnels the data through itself. Then, what's preventing the load balancer from being overloaded itself ? It's handling all the tcp connections of both the servers in your example right ? Sure, it's not doing cpu work but there's some I/O throttling that'll happen eventually right ? I'm just confused here because if that's the case would you put a load balancer to that load balancer, there's still going to be a single point of failure if the balancer dies/overloads. Correct me if i'm assuming that I/O load could be high, maybe funneling bytes isn't that tiring and the load balancer could do it no problem. (or) maybe the tcp connection splits away after the initial hit and the data doesn't go through the balancer anymore ? I'd love for you to answer this since i've not been able to wrap my head around this part.

[@chandanapericharla]

Your concerns are totally valid. If there are too many concurrent connections, it can throttle the load balancer itself bringing down the overall availability of the system. Hence, heavy traffic applications like Google and Facebook opt for distributed load balancing where the load balancer is not a single server. Google offers one such service called GCLB-Google cloud load balancer. You can find some info on it here:landing.google.com/sre/workbook/chapters/managing-load/

[@vjmathew6962]

may be you would have found your answer, if not, see keepalived video of Hussein. You will get an idea Edit : keywords VIP ( virtual ip ), VRRP

[@goatslayer5957]

The man the legend!

[@m3hdim3hdi]

الله يرحم والديك

[@hnasr]

ووالديك مهدي.. تسلم عزيزي

[@GlenMillard]

"..that's what she said!!!..." Ha - someone is a Micheal Scott fan!!

[@hnasr]

You think? kzbin.info/www/bejne/nIeugaV6p6qqiqs

[@pajeetsingh]

TLDR?

[@davidlira8853]

that cracked me up lol

[@abdelrahmanabdelfattah1092]

Thanks for this great video, I have a question, what is the difference between using an SSL certificate on layer 4 load balancer vs using it on layer 7 load balancer?

[@hnasr]

Fantastic question. Layer 7 load balancer must terminate TLS while Layer 4 load balancer doesn’t have to. L4 LB can terminate TLS means serve the certificate from the LB, which means it can decrypt and look at the content. It can also decides to Passthrough the TLS. Hello all the way to the backend which means it is end to end encryption and cert is served from Backend

[@filippomachi2314]

Thanks Hussein, I really enjoyed this video and I was able to understand a lot of things. But I have a question, I am exploring the possibility to use Server Sent Events, in this case I can only use layer 7 load balancer, am I wrong? Thanks again!

[@hnasr]

Filippo Machi Thanks Filippo! Man i just love these questions because they make me think 💭 Ok so short answer is you can use a layer 4 load balancer with SSE and websockets much easier and reliable than a layer 7 load balancer. Not saying you cannot do it with L7LB But you need to find a load balancer that actually supports that. Here is why: layer 4 load balancer will NAT the tcp connection to final destination server and exchange packets in a single connection. So the server can send information to the load balancer and load balancer will simply NAT things to the client. So if i make an HTTP GET request to a L4 LB, first i try to establish a tcp connection with LB, LB will actually build a table and change the packet ip address destination to one of the backend servers, and forward the packet, and then simply acts like a gateway(kinda like how your router works) and now one your tcp connection is established you are tethered to one server .. so any http request on the same tcp will ALWAYS go to the same backend server.. unless you establish a new session. That is why SSE and websockets work normally since they are stateful like that.. However with layer 7 LB as we explained in the video, the client connects to the load balancer first so thats one tcp connection and the load balancer will establish another tcp connection to the backend server. So if I make a simple HTTP request to the layer 7 load balancer, my final destination as a client is the load balancer, The load balancer will then block my request (synchronously) and make the request to one of the backend servers, get the result, unblock me and return the result. So in this case most load balancers are really waiting for a request from clients ... but what happen if all of a sudden the server started to send something to the load balancer? (Server side events) what does that mean? How does the layer 7 load balancer know what client to forward the request to ? Smart load balancers might actually build a table and start mapping ip addresses to client ports. Other load balancers might make the backend server respond to the client directly So you see how complex it is to do layer 7, you can use layer 4 LB, The only thing is you will get a sticky load balancer to a single server per client session. i need to do more research and videos on this topic very interesting.. Hope that helps!

[@filippomachi2314]

@@hnasr thanks a lot for answering my question, let me know if you perform further research or video regarding this topic :)

[@sairam-lj6zu]

Great video Hussein. I have a doubt, how layer 4 proxy will forward the packet to the server, without replacing the Destination server ip address in the ip packet ?

[@hnasr]

Good question! One implementation is to keep a table of what sourceIP goes to what Destination IP so it can map it. This is called NAT (network address translation) check out the NAT video I did How Network Address Translation is used on Layer 4 Load Balancing and Port forwarding

[@hichamlotfi4277]

you are the best

[@blablabla050484]

Great explaination, and Very Cool Cursor movements. what kind is it ?

[@hnasr]

Rico Agung Firmansyah Thanks 🙏 I use google slides

[@martazagrajek6008]

Great video. Have you already done the one about haproxy?

[@hnasr]

Marta Zagrajek thanks! Not yet, didnt make a dedicated haproxy video, its on the list of videos to make I made one about nginx though. Next up is websockets 🕸

[@martazagrajek6008]

@@hnasr I will keep waiting ;)

[@CODINC]

Hussein what is the use of load balancer if i can use reverse proxy because reverse proxy is a load balancer? Is it any efficient?

[@adilamanat8117]

Great content! I have a question if in 7 layer architecture load balancer use 2nd tcp connection how does it response back to client does it make connection keep alive during that process or what?

[@hnasr]

Good question! LB starts and establishes a connection B1 to backend1 and B2 to backend2 Client establishes connection C1 with LB. Client sends a request on C1, LB receive it, looks at the content, perhaps changes it and then send the request on B1. LB wait for B1 to respond, once it gets back the result, it sends back the result to client. all this the client is synchronously waiting.. Client sends another request on C1, LB receive it, looks at the content, perhaps changes it and then send the request on B2 (because of round robin algorithm) .. same thing hope this helps

[@coolzsatyen1]

Great Explanation, however you said you love to repeat, then you do not follow DRY principles :)... Keep posting such great videos. Appreciate !!

[@MI5500]

This guy will be a great dad 😂😁

[@msk9414]

Hello Nasser, I have question regarding the function of layer 3 when layer 4 load balancing is used.I know layer 3 is responsible for establishing session when using layer 7 LB , but as per the video If I am using layer 4 LB then layer 4 is establishing the session which takes over layer 3 responsibility.Are layer 7,6,5 skipped when using layer 4 LB ?

[@jexxiewoo8390]

Thanks for the content! Just sometimes the screen got chopped off 35:58

[@hnasr]

Jexxie Woo thanks 🙏 I did notice that after i posted the video. Thankfully nothing in the chopped screen is important. Appreciate your comment ! And ill make sure to avoid that in the future.

[@ranjithamarkachari8217]

nice

[@brurytangkere4874]

Hi, is there example if the HAProxy Loadbalancer using redis db as a session

[@gmanon1181]

Excellent! I wonder if it's possible to combine somehow a load balancer in the transport layer with a load balancer in the application layer to deal with the disadvantages of one another. It sounds like the logical way to go. True or False?

[@hnasr]

gmanon thanks! Yes some proxies actually take advantage of both L7 and L4 example is websocket proxying.. (check out my video on that) first request is a layer 7 request to detect http upgrade and then it switches to layer 4 streaming

[@icbm7]

was the page not changing at 21:37 was because of the browser cache?

[@antoniorap8825]

Hey, thank for this helpfull and amazing tutorial and explaination. sorry for my bad english. I have a question, the backend IP can be found / detected by anyone ?? its there a possibility to hide a tcp connection using netcat to the load balancer proxy, and connecting to the backend, with sniffing maybe no? thank for people who respond and help !

[@MinhTran-vl4vz]

Could you make a tutorial about L7 - load balancer with „Envoy“ ? I do think it has a tremendous potential in this industry

[@hnasr]

Minh Tran thanks Minh for the suggestion I agree. L7 load balancing is complex topic that needs its own video. Envoy is a good candidate

[@AMANSINGH-gg8xz]

Hii, I just watched your video today, I have one doubt that if layer 4 load balancer uses one TCP connection how can we give a grantee to the client that the packet has been sent?

[@Midhunchowdary]

Wondering if microservices can run behind Layer 4 LB by running the services on different ports?

[@ArdhenduShekhar-sw4uy]

HE PUT A THAT'S WHAT SHE SAID JOKE IN THERE. ABSOLUTE LEGEND.

[@douglasmakey]

Hi Husein thanks so much for your videos, I am not sure If I understand completely why LBL4 has just one tcp connection. In LBL4 there is just one connection between client-lb, because the LB takes the packages and uses NAT to change the destination of that packages and it returns them to the network to be route to the right server? is that true?

[@hnasr]

Douglas Mendez Correct, think about your WIFI router , if you connect to google from your mobile phone (on wifi) it is a single TCP connection between you and Google .( not a tcp connection between you and router and between the router and google) despite the router actually making the connection on your behalf because it has the public ip address. Your router uses NAT. A layer 4 load balancer that uses NAT function the same way.

[@krishnakrmahto97]

@@hnasr Just curious, i might not be making any sense also. So, Routers do not work at layer 4 so they actually don't concern with TCP. But does a client communicate with Layer 4 LB (HAProxy) without a layer 4 protocol? If it uses TCP, then there should be a TCP connection between the client and the LB? Apologies if i am completely going off.

[@andrewmayer78]

Hey been watching all your videos. Great stuff. Is there a place we can donate to support you? I had a question - It's my understanding that the client makes a TCP connection with the server itself, not the load balancer and that the TCP connection stays open (side-question, when does it know to close?). So, let's say I make a GET request for index.html, it goes through the load balancer, the load balancer connects me to Server 1. I get back the index.html, and in that file there is a Javascript in a tag, so I make an additional request for that JS file under the same TCP connection. How does the load balancer in the second request know which server I have a TCP connection with? Does the load balancer keep a dictionary of this information? Thanks!

[@hnasr]

Great question Andrew! Let's address your assumption first : "It's my understanding that the client makes a TCP connection with the server itself, not the load balancer and that the TCP connection stays open (side-question, when does it know to close?)" That is only true if the load balancer is a Layer 4 load balancer which acts as a gateway and merely "forwards" packets to the final server destination by essentially doing a NAT (IP translation). So yeah it is a single TCP connection in this case between the client and the backend server through the layer 4 load balancer. As to your question when does it know to close the connection, there is a timeout that is set in the load balancer after which it will terminate the connection after a certain time of idleness. Now to your second part of question "So, let's say I make a GET request for index.html, it goes through the load balancer, the load balancer connects me to Server 1. I get back the index.html, and in that file there is a Javascript in a tag, so I make an additional request for that JS file under the same TCP connection. How does the load balancer in the second request know which server I have a TCP connection with? Does the load balancer keep a dictionary of this information?" Little bit complicated in today's modern architecture, so I'm gonna simplify it first. So lets first assume you are using a client or a browser that uses a single TCP connection instead (most browsers uses 6 TCP connections which complicates your question).. so lets assume the client browser is old fashion and uses one tcp connection, with that assumption lets move forward.. The first time you make a GET request your destination is the load balancer, The client connects to the load balancer IP address which as we explain in 6:30 takes that destination IP address and swaps it up with one of backend servers based on some sort algorithm, once it picks a server that is it. The connection is sticky since it is one TCP connection from the client to the backend server lets call that server, server A. Then you might do TLS if necessary through the same TCP connection always going to server A, then as you said you make a GET request to the load balancer, the LB receives it swaps destination IP to server A because the load balancer now have a table that says client is connected to server A through this unique connection, so your backend server A receives your GET request, processes it get you the Index.html and sends it back to the load balancer which in itself swaps its destination ip address (which is the load balancer ) with the client ip address and forwards the request to client .. which the client then processes the HTML as you said finds that it needs to process the SRC and makes a request to pull the test.JS file which goes through the same exact process through the same TCP connection to server A.. Now .. with modern architecture browsers have 6 TCP connections usually like chrome and it will send multiple requests through these TCP connections in parallel and thats ok because HTTP is stateless so your javascript file might come from Server B but your index.html might come from server A.. It becomes even more complicated with HTTP/2 because the server actually pre-processes the index.html and finds out that you will eventually need the test.js file or whatever and it will send you (pushes you) both files at once using multiplexing.. if the load balancer is a layer 7 load balancer then you will get 2 tcp connections between you as a client and load balancer and between the load balancer and the server .. which gives you truly stateless non-sticky requests but you suffer from some limitation as I talk about in the video .. sorry for the long answer! and thanks for your support, donate button in the description of the video.. just you guys watching and commenting and asking these excellent questions is enough for me really! Stay awesome hope that helps .

[@ShueFig]

Had this question myself, saw an article (medium.com/martinomburajr/distributed-computing-tcp-vs-http-s-load-balancing-7b3e9efc6167) that might be relevant!

[@brianpayne3468]

Can you do a log-format in using logging (rsyslog) in HAProxy. I like to troubleshoot an HAProxy issue where it is dropping connections in rare occasions. Something to do with a sticky-bit in HAProxy timing out. The HAProxy is used as a Load Balancer ( reversed proxy) and runs as a container. Only connect using HTTPS in the Load Balancer using ports 80, 443, and 7999. From the logs, I like to see why and where it is dropping the connection. I would like to see the log info on the time duration of the connection. I am currently using 3.2.14 version of HAProxy. Thanks!

[@fujinclado4918]

Good explanation, one question not regarding video how you making these wonderful thumbnails? What the tool?

[@hnasr]

Thanks Fujin for your message! I use canva because I suck at photoshop haha hope that helps

[@fujinclado4918]

Thanks man.

[@shazadrojan2387]

quick question about Layer 4 using https - port 443 and SSL termination. If I am only using https-port 443 it is necessary to terminate SSL on the LB or can i just do this in IIS bindings?

[@hnasr]

It depends on your backend if the backend supports TLS then IIS should really do a TLS Passthrough not termination (since you said its layer 4 LB) the certificate being served will be the backend not the LB If the backend doesn’t support TLS then it the LB will do a TLS termination and serves its certificate instead. The traffic on the backend will be unencrypted might not be desirable

[@netman87]

Is there way to make haproxy keep connection alive? i mean with internal http2 we should be able to have multible streams in single connection and in this example it looks like it gets new connection everytime? atleast from haproxy to nodes

[@hnasr]

You can set the timeouts as needed check out the video here kzbin.info/www/bejne/p4rRcmV6e6p4gtk

[@Hellmiauz]

so in terms of uplink and bandwidth usage. If backend 1 and 2 have a 1Gbps port, Haproxy server needs a 2Gbps port to be able to transfer at full capacity? And bandwidth, if server 1 and 2 consumed say 1TB each in a day, Haproxy will consume 2TB on same period?

[@hnasr]

A very interesting insights lets unpack it the backend network interface of HAProxy must live in the same network as backend servers. Probably I am imagining a network switch between them. One port going from HAP to the switch, and from the switch to each backend server. So now the numbers. If we assumed defaults 1 Gbps for all ports. Than haproxy can upload and download 1 Gb per second (~128 MB each second). so if two clients concurrently requested to fetch a resource that is 128MB In size, from HAP, the first request goes to backend 1 the second goes to backend 2. But it will take HAProxies two full seconds to download this resource from each server (assuming no caching) So yes! a 2Gbps uplink:dnlink HAProxy will download the two resources concurrently in 1 second (50%) faster. And to answer your final question, yes if server 1 and 2 uploaded 1 TB each, then HAProxy will have “downloaded” 2TB. Thanks! Let me know if I missed something

[@CoolBruce100]

Hussain - Thanks for the great content as always. I have one question on the L7 LB. As we are saying that we have 2 connections one between client - LB and one between LB - Backend server. Which certificate the backend server would provide (Obviously assuming that this is HTTPS too)? Would it be same as what LB provide to client or would it be a different certificate?

[@hnasr]

Himanshu Jain correct the client will be provided the LB certificate. That means you have to put the cert/private key in the LB.. some people don’t like this and use a layer 4 LB instead and serve the cert from the original backend I discuss this here kzbin.info/www/bejne/i3zZfGpsh9Okq9U

[@CoolBruce100]

@@hnasr Thanks for the quick reply. Just to be clear, my question is what certificate would be shared between LB and Backend server? Will it be different from what LB provides to client?

[@hnasr]

It depends on the domain name the cert is issued for.. could be the same could be different.

[@CoolBruce100]

@@hnasr Hmm. Right. Thanks for clearing this..🙂

[@sneharajit41]

I understand the concept of two flavors of load balancer but my question is since a load balancer is basically a software and processes the incoming request why both are not working in a single layer(layer 7)?

[@93kazem]

Would like to see how HA proxy works :) A bit more in depth maybe?

[@hnasr]

Qasim Albaqali hey Qasim, check out my in depth HAPROXY Video HAProxy Crash Course (TLS 1.3, HTTPS, HTTP/2 and more) kzbin.info/www/bejne/p4rRcmV6e6p4gtk

[@jianxiongng1979]

I had a Nginx behind the HAProxy, how can I pass the authentication of Nginx back to Nginx server through the HAProxy?