Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to create an auto scaling, load balanced solution on EC2 behind a single IP address with IIS 7.5 as an app server(s).

I've got a pretty good working setup with haproxy (as a reverse proxy) with the single IP address assigned passing traffic through to ELB which passes traffic to the auto scaling IIS instances.

There are some issues with this setup:

  • Haproxy is a single point of failure - if it goes down I'd need to manually restart.
  • I'm concerned ELB will see a single IP address in front of it and therefore route all traffic to only one server and I'm not totally sure how to test this. I've heard rumours that this is the case but I'm not sure.
  • SSL traffic is proving fairly complex as I seem to need to pass it through in "mode tcp" on haproxy as the decryption is done on ELB and I don't think the standard IIS that Amazon fires up for us will bind to tcp traffic without me doing some manual config (so then I can't use autoscaling)

My question is - is this setup stupid/crazy - should I be looking to simply manage haproxy and IIS instances with no ELB involved? Are there any services that would help me do this (I only know of Rightscale - i think this would be achievable with their templates). We can't use a service like AppHarbor as we are serving some web sites.

On Linux this would be straightforward I know - but we can't change the web app platform.

Any advice would be much appreciated...

share|improve this question
Why do you want to use HAproxy in front of ELB? Sounds like ELB can do all you want to do with HAproxy. ELB will balance the load and handle the SSL traffic. IIS on the EC2 instances will just receive normal HTTP traffic. – Marco Miltenburg Apr 6 '13 at 15:48
Thanks Marco - we need a static IP address in front of the instance as users will be pointing their own DNS at this service so they need an IP address for an A record... – petenelson Apr 7 '13 at 8:18
When using cloud services like Amazon EC2 or Windows Azure you should not point your domain record to a single IP address with an A record but you should always use the provided aliases and point to them with a CNAME record. E.g.: CNAME This allows Amazon to dynamically change your IP address and route traffic in case of server failures or network problems. This is all part of the fault tolerance of cloud hosting. You won't need and in fact don't want HAproxy in front of ELB. – Marco Miltenburg Apr 7 '13 at 9:19
All valid (and useful) reasoning Marco - however we need users to be able to point the root domain at our service. This would only be achievable if they were using Route 53 I think - which we can't force them to use... I think really what you are saying is the ELB is not valid for our scenario and I should be doing this manually with haproxy instead.. – petenelson Apr 7 '13 at 10:19
This does not depend on using Route 53. Creating a CNAME record works with any DNS server / service and has the advantage that your client does not have to change anything in case of technical problems. Amazon will all handle this by internally changing the IP address for your alias (e.g. In fact, Amazon will probably even using round robing DNS to make it's ELB service even more fault tolerant. Really, you probably can't implement it better than Amazon has done. – Marco Miltenburg Apr 7 '13 at 22:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.