Reputation
233
Top tag
Next privilege 250 Rep.
View close votes
Badges
3 7
Newest
 Yearling
Impact
~38k people reached

  • 0 posts edited
  • 0 helpful flags
  • 13 votes cast
Apr
11
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
The X-Forwarded-For header is very useful. But this doesn't get at the root of the problem. Both the BigIP and TrafficServer have SSL termination at the load balancer level. Based on my current benchmarks, SSL termination is my bottleneck. If I can get an F5 BigIP (and I might be able to), then it may be fast enough. However, that doesn't answer the theoretical problem (which I still think is interesting). My goal is to allow an SSL farm and still have the original client IP passed along to the app servers. This guarantees (theoretically) that SSL will never be the bottleneck.
Apr
11
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
This is looking like the best option. Unfortunately (for me) the more I read about LVS the less it seems I know about networking!
Apr
10
answered Setting nginx as a reverse proxy help
Apr
10
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
I am wondering if HAProxy's "usesrc clientip" option might be the best solution. However, it looks like that depends on TPROXY. I'm running RHEL 5.5, which has kernel 2.6.18. TPROXY isn't included until 2.6.28. I'd rather not have to recompile the kernel, but I guess we'll see.
Apr
10
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
Yes. As I mentioned in the original post, this is exactly how I have STunnel setup. The problem with this approach is that request is being decrypted on the load balancer. That creates a bottleneck because you can't just add more load balancers (while maintaining HA) like you can add more app servers. That is the reason for a load balancer before decrypting SSL.
Apr
10
asked OpenSource (Layer 4) Load Balancer that can pass through original client IP?