Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently we have good ol' LVS running in the same subnet as our webservers. We use Piranha for automatic redundancy and take full advantage of the status check scripts to not only automatically detect when a server is down, but to curl a control page we have written so we can take servers off the cluster (and put them back on!) at our leisure. It's a neat and useful solution. We load balance http and https with no issue.

We are in the process of tightening up security and are going to put in proxies on a different subnet to forward to the web servers. Ideally we would like to proxy and load balance on the same box (cluster).

So essentially my requirements are:

  1. Must be able to reverse proxy
  2. Must be able to load balance (across subnets, so LVS is out).
  3. Must be able to modify the http headers so we can determine true client IP (X-Forwarded-For is okay but we'd prefer to add a custom tag, only Apache can do this that I've seen so far).
  4. Must have automatic redundancy with automatic failover
  5. Must support https (ideally all the way to the back end)
  6. Ideally have the ability to run a status check (send/expect) script to determine if the host is up or down.

I've found 1 solution that could involve Pound and Stunnel but I can't find a clear answer on whether Pound works in layer 3. How do you make Pound redundant?

The same for HAProxy, how do you make that redundant? I know there's a httpcheck module for that so that's good. Can you modify headers with HAProxy (other than X-Forwarded-For)?

So far all I can come up with is sticking our existing LVS cluster in front of a bunch of Apache servers run mod_proxy and mod_http and have a 1 to 1 mapping of proxy to web server. I'm all ears to other solutions though!

EDIT: I can't work out if HAProxy supports https without Stunnel now. If it does can it forward decrypt the https then send a https request to the back end or does it decrypt and forward off http?

share|improve this question
These requirements are making the solution unnecessarily complex. Is there not anyway you can put the backend web servers behind the load balancers? If the default gateway of the web servers is the load balancer, then you can setup fully transparent load balancing. The backends will see original client IP as the source - no need for HTTP header tricks. You can also do a simple Layer4 SSL load balancing using haproxy - no need for encrypt/decrypt. Redundancy between haproxy servers can be done using keepalived to move virtual IPs around. –  Wim Kerkhoff May 22 '12 at 3:11
Squid is also an option for doing HTTP header modifications. This would likely only work if Squid does the SSL offloading, with plaintext HTTP to the backend web servers. –  Wim Kerkhoff May 22 '12 at 3:12
Hi Wim, We need to keep the proxy on different network segment to the web servers, so I don't think we can use it as the default gateway (what technology would you use for this anyway out of interest?). So with the HAProxy Layer4 load balancing you mean just forwarding on the packet without inspection or alteration? –  Yoshiwaan May 22 '12 at 23:57
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.