Synopsis #
OpenBSD can distribute IP traffic across gateways (L3), balance TCP/UDP services using addresses and ports (L4), or proxy HTTP requests using hostnames, paths, and headers (L7). Use the table to choose a design, then follow its guide to configure a redundant pair.
Choose a Forwarding Design #
| Layer and guide | Choose it when | Main tradeoff |
|---|---|---|
| L3: Gateway sharing | Traffic should be distributed across two gateways. | Selects a gateway, not a server from a backend pool. |
| L4: NAT | A TCP/UDP service needs a pool of healthy servers. | Requests and replies both pass through the frontend. |
| L4: DSR | Replies should bypass the frontend, such as for large downloads. | Backends need the service IP and a separate return path. |
| L7: HTTP/HTTPS proxy | Requests need routing by HTTP hostname or path, header changes, or TLS termination. | The proxy handles separate client and backend connections. Clients must reconnect if it fails. |
NAT and DSR can forward TLS unchanged to the backend. The HTTPS proxy example terminates TLS at relayd so it can inspect HTTP.
Follow a Request #
CARP IP balancing uses the source and destination IP addresses to select a gateway. The gateway forwards the packet to its original destination.