Load Balancer pools: real servers and health checks
Respuesta rápida
A pool is the group of VMs that share traffic from a listener. Add a pool on the Pools tab, then Add real server (a VPS on a firewall-attached network, or a typed IPv4). Health checks decide which members receive traffic. Recommended order: pool → real server → listener.
A pool is the group of VMs that share this traffic. The listener sends each new connection to one real server in that pool. Traffic has nowhere to go until the pool has at least one member.
Open the load balancer, then the Pools tab.
Add a pool
Select Add pool.
- Name — unique on this load balancer (for example
web). - Algorithm — how the next connection is chosen among healthy members:
- Round robin — cycle through members in turn.
- Least connections — send the next connection to whoever currently has the fewest.
- Source IP hash — the same client IP keeps landing on the same member.
- Stickiness — extra pinning on top of the algorithm: No stickiness, Source IP, or Cookie (HTTP/HTTPS). Cookie stickiness is for HTTP and HTTPS listeners only.
You can change algorithm, stickiness, PROXY protocol, and health later with Edit pool.
Add a real server
Select Add real server. Members must be IPv4 addresses on a network attached to this firewall, and those guests must use the firewall as default gateway.
Source is either:
- VPS — pick a VPS from the list. Portal stores the guest IPv4 and updates it when the guest reports a new DHCP address. If the NIC has a static assigned IP, that address wins and will not follow DHCP — type the IP instead.
- IPv4 address — a pin. It never follows the VPS. Use this for a fixed LAN address.
Then set Port (1–65535), the port the application listens on.
A typed IPv4 is never refreshed from a VM. For a VPS member, Refresh re-reads that NIC on demand.
Health checks
On Edit pool, the Health panel controls whether a member receives traffic.
| Mode | What it does |
|---|---|
| Probe only | Members go Up or Down from the last probe only |
| Probe and visitor errors | Members can also go Down from live request failures. The probe still brings them back |
| Do not probe | Enabled members always get traffic. Health shows No check |
When a probe runs:
- Protocol — TCP or HTTP. Tick TLS if the probe should connect with TLS even when the listener is not HTTPS.
- Destination port — empty uses the real server’s own port.
- Interval (2–300 s), Timeout (1–60 s), Retries (1–10), Up after (1–10 successful probes).
- For HTTP: optional Domain (Host header), Path (default
/), optional body Response text, and Status codes (for example200or2??).
Health on the Pools tab refreshes about every five seconds while the page is open.
Drain, weight, and PROXY
On each member row:
- Drain stops new connections; existing ones can finish. Enable puts the member back in rotation.
- Edit changes address, port, and Weight (1–256, default 1). Higher weight takes a larger share under round robin and least connections.
- Delete removes the member.
On the pool itself, Send PROXY protocol to members is off by default. Turn it on only if the application expects that header. Members already see the visitor’s real IP address, not the firewall’s; PROXY is an extra header, not the only way to preserve the client IP.
Delete a pool only after any listener that still uses it has been pointed at another pool.