Advanced Traffic Distribution: Building an L4/L7 Load Balancer with HAProxy

The Necessity of Horizontal Scaling

Vertical scaling by adding resources to a single KVM VPS has physical and economic limits. To handle massive concurrency and eliminate single points of failure, system architects deploy a fleet of identical backend servers behind a dedicated load balancer. Because the load balancer acts as the public entry point for your entire network, it is highly exposed. You must lock down this node immediately using our Securing Your Server methodology before routing any production traffic.

Layer 4 versus Layer 7 Routing

HAProxy operates in two primary modes. Layer 4 (TCP) routing is incredibly fast because it only inspects IP addresses and ports without reading the payload. It is ideal for routing database or raw socket traffic. Layer 7 (HTTP) routing requires slightly more CPU overhead but allows the load balancer to inspect HTTP headers. This enables advanced routing decisions based on URL paths, cookies, or SSL/TLS Server Name Indication (SNI) data, making it the standard for web application scaling.

Installing the HAProxy Daemon

To build the routing layer, connect to your dedicated load balancer instance via SSH. Update the package manager and install the core HAProxy daemon from the official repositories. The installation is lightweight and configures the daemon to start automatically on boot:

sudo apt update && sudo apt install haproxy -y

Defining the L7 HTTP Architecture

You must define how the traffic is received and where it is sent. Open the main configuration file in your text editor. You will create a frontend block to listen for incoming web traffic on port 80, and a backend block to distribute those requests across two isolated worker nodes using the round-robin scheduling algorithm:

sudo nano /etc/haproxy/haproxy.cfg

Append the following configuration block to the file, replacing the placeholder IP addresses with the internal network addresses of your worker nodes at CLOUD HIVE DC:

frontend http_front
    bind *:80
    default_backend web_workers

backend web_workers
    balance roundrobin
    server worker1 10.0.0.101:80 check
    server worker2 10.0.0.102:80 check

Verifying the Configuration State

Before applying routing changes to a live environment, you must always validate the syntax to prevent fatal routing loops or syntax errors that could crash the daemon. Execute the strict validation command. If the output confirms the configuration is valid, restart the service to apply the new architecture. Your infrastructure is now horizontally scalable and highly available.

sudo haproxy -c -f /etc/haproxy/haproxy.cfg
sudo systemctl restart haproxy