Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've recently been looking at getting some new load balancers for our environment as we are expecting to double our client base in the next 12 months.

Currently we have 400 public IPS serving 800 clusters ( 2 clusters / IP due to ports ) on Coyote Point Balancers, and distributing connections to 3 web servers serving about 6GBytes outgoing, 2Gbytes in per day. If we double, this would be about 800 IPs, possibly 1600 clusters, and about 6 servers per cluster ( for a total of 9600 so called "real servers" using Barracuda's lingo ).

Due to the amount of clusters, most solutions I've looked at ( Coyote, Barracuda, ) seem to be unsure whether they'll be able to handle our planned growth, mostly due to health checks performed on the servers ... which makes total sense when you think of it.

So the fine folk at recommended that we may be better off offload the 400-800 public IPs, which we require for SSL eCommerce solutions, over to a forward facing router. From that point on, the router could do some mangling to route EXT_IP:443 to INT_IP:INT_PORT which would then allow us to reduce the Load Balancer configuration to 1 or 2 clusters, thus resolving the health check problem.

Does this idea make sense to yall ? Or would you have other recommendations to make ?

Secondly, what router would you recommend for such an undertaking ? I'd be looking at something that has some form of failover mechanism built in.

On a totally unrelated note, I've got to admit that I'm extremely pleased with the responses I got from Their responses to my inquiries were surprisingly helpful ( i.e. I didn't feel as if I was taking to a sales guy trying to push something ). ( No I don't work for them, and sadly nor are they sending me free gear ).

share|improve this question
up vote 2 down vote accepted

I have done virtually the same using vyatta.

I have done the same also using pfsense - however vyatta may be a bit more mature for support reasons.

The cost is very low compared to the other options ... pm me for details

share|improve this answer
Very cool alternative actually, it's really quite a shame however that there doesn't seem to be more info / reviews / comments on it online. How do you find their support department ? How flexible do you find these devices and is everything configurable via the GUI... does it require linux knowledge ? I'm a linux admin in a mac house, and so anything that requires linux knowledge, doesn't fly well with the higher ups sigh. – jonathanserafini Feb 20 '11 at 1:19 and Their cli is very close to the one from Cisco (just without the cost) Their forums are very active as well. @churchmedic via twitter if you need some realtime help getting started. We have used them to do some amazing things with the Web Empowered Church application we run (typo3 websites) we also use them for a bunch of routing into our WISP (CountryConnections) From 300 feet in the air - to gigE connections serving some really cool stuff all over the place - Their OpenSource is worth its weight in gold - and their paid support isnt bad either – Glenn Kelley Feb 20 '11 at 4:01
Hehe, wasn't so much looking for their marketting site / blurbs as I was for real reviews ;) – jonathanserafini Feb 20 '11 at 13:17
here ya there - a few simple web searches will yield some results I am sure. If you browse their forums - you can see those who are using and getting help as well. I have used pfsense for many different projects - based out of Kentucky Chris Buechler has a good application to work with - both vyatta & pfsense have a gui - In regards of linux vs non-linux - Your company needs to decide- expense or use your experience reach out to me if you want some extra details off list be happy to help – Glenn Kelley Feb 20 '11 at 22:02
I certainly agree with you there, I believe the problem partly stems from the fact that they had difficulty finding someone to fill the position to begin with, and don't want to depend too heavily on a single person .. anyhow, the offer is greatly appreciated, and I may take you up on it in the future ! Thanks. – jonathanserafini Feb 20 '11 at 23:04

I'd suggest Cisco ACE/ASA's, Foundry (now Brocade) ServerIron's and Zeus ZXTMs (which are spendy but damn fast and capable.

All of these can do what you need but none are free.

share|improve this answer
Well thank you for the feedback. Those all seem to be load balancers of their own, and at this point I'm mostly looking to see what I could find router wise. Either way I will keep these in mind for later, though these do seem fairly pricey. – jonathanserafini Feb 19 '11 at 22:53

I've got a somewhat similar setup, where I have most of a /22 block of IPs defined on an F5 BigIP box, with a one-to-one mapping of external ip to a internal port number on each of my backend machines.

In my case, the ports were all part of the same Apache instance -- I defined health checks only for the base port. If it wasn't up, none of the others would be either, so it would fail the whole backend node out of the rotation.

You could use a front-end router as you describe to do this NAT work, but you would still need to define clusters for each intermediate host:port combination -- with the current state of SNI support in clients, when doing SSL you need certificate mapped to a port. Typically the port is 443 so you do IP-per-site, but with the intermediate layer of router/LB, you can freely move the ports around, you just still need to have several hundred of them.

share|improve this answer
Well the idea witch using the router would have meant that you'd be doing the EXT_IP:443 > INT_IP:INT_PORT forwarding in the router's firewall as opposed to needing to do that on the load balancer. – jonathanserafini Feb 20 '11 at 13:16

We use both Vyatta (as a BGP router) and pfSense (firewall/NAT/VPN) and starting next week appliances (load balancing). :-)

Isn't the problem here that you need a highly available system with failover for thousands of IPs and SSL certificates? Vyatta and pfSense (etc) will just do the port-forwarding, but you need the SSL "transport" applied, too - no? If Coyote/ can't do it you might need to either fork over lots of money for one of the more expensive vendors (assuming they can...) or (better?) "build your own".

Use keepalived to move the IPs back and forth between a small number of boxes and then have for example nginx work as an SSL proxy forwarding the requests back to your load balancer (on any port appropriate). It can even set/enforce certain headers, so maybe your load balancer configuration can stay really simple and you just check for those headers on your backend.

share|improve this answer
Well in all honesty, our software stack is freaking heavy, and I've started working with our devs to optimize this. At this point, SSL overhead is nothing compared to the load a single visitor generates so I've no issues having the web server handle that part of it. – jonathanserafini Mar 3 '11 at 1:38
Personally, I would have gone with if it had been my call, sadly it wasn't. – jonathanserafini Mar 3 '11 at 1:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.