Load balancing

From securityrouter.org, an OpenBSD-based firewall
Revision as of 15:50, 1 February 2012 by Anders (talk | contribs)
Jump to: navigation, search

The load balancer can dynamically redirect and route traffic. It can operate as

  • Load balancer
  • Application layer gateway
  • SSL accelerator
  • Transparent proxy
  • Internet failover

Currently, no graphical interface in the web administration exists. In the meantime, please use the plain-text configuration editor.

HTTPS (SSL) acceleration

This very simple example provides an HTTPS accelerator. If you are using the 64-bit version (amd64) on a router with AES-NI instructions, you can expect gigabit performance. Below is a more or less complete example, using the router exclusively as a layer 7 load balancer, utilizing only one Ethernet interface.

interface em0 {
	route default
load-balancer {
	table <servers> { }
	relay "webservers" {
		listen on port 443 ssl
		forward to <servers> port 80 mode loadbalance check tcp
system {
	http-server {
		port 4433
	authentication {
		root-password "extremelyhardpassword"
		user "admin" {
			password "veryhardpassword"
	dns {

Then, upload the certificate and private key. Currently, these are not in the configuration file. Instead, enable root access (already enabled by the above example) and upload the file using for example sep according to the skeleton files guidelines. You can also try out the load balancer by using the web administration's self-signed certificate, by issuing the following commands when logged in as root:

# cp /etc/ssl/server.crt /etc/ssl/
# cp /etc/ssl/private/server.key /etc/ssl/private/

Internet failover

The load balancer can be used to select one of several default routers (gateways) which is useful for outbound internet failover when more sophisticated protocols such as BGP is unavailable. Below is an incomplete example of such a a configuration.

load-balancer {
	table <gateways> { ip ttl 1, ip ttl 1 }
		router "internetfailover" {
			forward to <gateways> check icmp