The tunnel mode looks like the Direct Server Return mode, except that traffic between the load balancer and the server can be routed. The load balancer encapsulates the request in an IP tunnel to the server. The server recovers the client request from the load balancer, process it, and forwards the response directly to the client.

TCP Connection Overview

tcp connection diagram

The load balancer takes client requests and then encapsulates them into an IP tunnel to forward them to the server.

Data Flow

data flow diagram

The client traffic between the server and the load balancer is tunneled and can be routed between both of them.
The server will answer directly to the client.

Pros & Cons


  • backends from multiple data centers can be used

  • load-balancer network bandwidth is not a bottleneck anymore

  • total output bandwidth is the sum of each backend bandwidth


  • requires patched backend to be able to tunnel IP traffic

  • no layer 7 advanced features are available

When to Use This Architecture?

  • when the only way to reach backends is routing.

  • where no intelligence is required

  • when the output capacity of the load-balancer could be the bottleneck


Subscribe to our blog. Get the latest release updates, tutorials, and deep-dives from HAProxy experts.