This mode is sometimes called reverse-proxy.

The load-balancer is in the middle of all transactions between the user and the server.
It maintains two separated TCP connections:

• One with the user: the load-balancer acts as a server. It takes requests and forward responses
• One with the server: the load-balancer acts as a user: it forward requests and get responses

This mode is the less intrusive in an architecture: nothing to change on any server or router.

TCP connection overview

The diagram shows clearly the two TCP connections maintained by the load-balancer.

Data flow

As a consequence of the proxy mode, the server gets a connection from the load-balancer IP address and the server can only get the client IP address at the application level.
IE: HTTP X-Forwarded-For header.

Pros and cons

Pros

• not intrusive
• more secure: server aren’t reached directly
• allows protocol inspection and validation
• can load-balance services even if both client and server are in the same subnet

Cons

• backend servers only see one IP address: the one from the LB
• “slower” than layer 4 load-balancing (we speak about micro-seconds)

When use this mode?

• when you need application layer intelligence (content switching, etc…)
• in order to protect an application
• when the application does not care about the user IP (or can use the X-Forwarded-For header)

Links

• HAProxy Technologies
• Aloha load balancer: HAProxy based LB appliance
• HAPEE: HAProxy Enterprise Edition