Load Balancing on OpenBSD Handbook

Build Redundant Load-Balanced Gateways

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis #

Configure two IPv4 gateways with shared addresses on the client and backend networks. Start with one active gateway and one standby. After routing and failover work, add CARP IP balancing if both gateways need to carry traffic.

CARP IP balancing distributes traffic across gateways based on the source and destination IP addresses. It leaves the destination server unchanged. To select servers from a backend pool, use NAT or DSR . To route by HTTP hostname or path, use relayd proxying .

Load Balance Services with NAT or DSR

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis #

Use relayd(8) to check backend health and configure PF to distribute service connections across healthy servers. Begin with destination NAT, where replies cross the frontend, then change to direct server return (DSR), where replies bypass it.

The examples use IPv4 and a TCP web service so responses are easy to identify. PF forwards packets between the client and the selected server without terminating TLS or inspecting their HTTP requests. HTTP health checks are separate connections made by relayd.

Build an HA HTTPS Load Balancer

Mon, 01 Jan 0001 00:00:00 +0000

Synopsis #

Configure two OpenBSD frontends to terminate HTTPS and distribute requests to healthy application servers. CARP moves the shared service IP to the standby if the active frontend fails. Unlike PF NAT or DSR , relayd accepts the client connection and opens a separate connection to the backend.

The example uses TLS from the client to relayd and plain HTTP on an isolated backend network. If the backend network is not trusted, protect it or configure TLS between relayd and the backends. Client TLS protects only the connection to relayd.