Create and configure a Load Balancer

A Load Balancer is a tool used to sort incoming requests across your Virtual Machines to improve your infrastructure's fault tolerance.

Step 1. Initiate Load Balancer creation

Go to your project, navigate to the "Load Balancers" in the "Networking" section and click Create Load Balancer. 

The new page opens. Perform the remaining steps there. 

Step 2. Set the region

Select a region for balancing.

You can balance traffic only within a single data center.

Step 3. Set computing configuration

Select a suitable computing configuration for your Load Balancer: GiB and vCPU. We create all Load Balancers in high availability mode with active-standby instances. Upon failure of the active instance, the standby one will seamlessly take over the load-balancing functions.

Step 4. Configure network

Select a network, public or private, and enable additional features:

• Reserved IP and IPv6 dual-stack for the public network.
• Floating IP, reserved IP and IPv6 dual-stack for the private network.

Step 5. Configure listeners

Listener

Add listeners that will check for connection requests using the protocol and port that you specify. You can add multiple listeners to a Load Balancer.

To configure a listener:

1. In the Listeners section, click Add listener.

2. Enter the listener’s name.

3. Select the required protocol: TCP, UDP, HTTP, Terminated HTTPS, and Prometheus. You can configure multiple TLS certificates for Terminated HTTPS and Prometheus.

4. Specify a port that the Load Balancer will listen on for incoming traffic. You can keep a default port for some protocols or specify the needed port from 1 to 65535.

5. (Optional) To identify the origin of the user's IP address connecting to a web server via a load balancer, enable the Add headers X-Forwarded-For, X-Forwarded-Port, X-Forwarded-Proto to requests toggle.

6. If you select Terminated HTTPS and Prometheus protocols, you can configure TLS certificates. Follow instructions from our dedicated guide.

7. Set the connection limit - a maximum number of simultaneous connections that can be handled by this listener.

8. (Optional) Add allowed CIDR ranges to define which IP addresses can access your content. All IP addresses that don’t belong to the specified range will be denied access.

To ensure correct operation and avoid misconfigurations, the IP version of Allowed CIDRs must match the IP version of the Load Balancer's Virtual IPs (VIPs).

Basic Rules:

• VIPs with both IPv4 and IPv6 support CIDRs of both versions.

  VIPs: 62.112.222.52 (IPv4), 2a03:90c0:4d6:1::2e8 (IPv6)

  Allowed CIDRs: 10.0.0.0/8, fe00::/7

• VIPs with only IPv4 allow only IPv4 CIDRs
• VIPs with only IPv6 allow only IPv6 CIDRs

If the provided CIDRs do not match the VIP's IP version, the API will return a validation error.

9. (Optional) For HTTP-based listeners, you can configure basic user authentication to protect your resource from unauthorized access. Click Add users to enable the authentication:

• Enter username: specify a username.

• Password: specify a password or choose the Encrypted password option to store password as a hash. Check out create an encrypted password for instructions.

A password must contain at least one lowercase character, one uppercase character, at least one number, and a special character. The maximum password length is 128 symbols.

10. Click Create Listener.

Pool

Configure a pool—a list of VMs to which the listener will redirect incoming traffic. Click Add new pool in the "Listeners" block to start configuring.

1. Specify the pool name.

2. Select the balancing algorithm:          

• Round robin—requests are distributed across servers within a cluster one by one: the first request is sent to the first server, the second request is sent to the second server, and so on in a circle. 
• Least Connection—new requests are sent to a server with the fewest active connections. 
• Source IP—a client's IP address is used to determine which server receives the request.

 

3. A protocol will be automatically selected based on the listener's settings: the HTTP listener can communicate with servers via the HTTP protocol.

4. Select App Cookie and fill in the "Cookie" field. A special module creates a cookie and then uses it to forward requests to the same server.  

Virtual Machine

Click Add Instance to add Virtual Machines that will participate in the traffic distribution for the configured listener.

1. Select Custom IP, Virtual Machine, or Bare Metal and appropriate configurations.

2. Specify its port and weight in the distribution. 

Health Сheck

1. Select the protocol for checking: TCP, Ping, HTTP and appropriate configurations. 

2. Specify сheck interval (sec)—time between sent requests.

3. Specify response time (sec)—the time to wait for a response from a server.

4. Specify unhealthy threshold—the number of failed requests after which traffic will no longer be sent to the Virtual Machine.

5. Specify healthy thresholds—the number of successful requests after which the Virtual Machine will be considered ready to receive traffic.

Timeouts

Specify client data, member connect and member data timeouts in msec.

Step 6. Enter the name

Enter a name for the Load Balancer. It will be displayed in the Customer Portal.

Step 7. (Optional) Enable Logging

The Logging service will be activated to store your logs. To learn how it works and how to configure it, refer to the article about Logging.

Step 8. (Optional) Add tags

Create tags for your load balancer by entering "Key" and "Valu."

Step 9. Finalize creation

Check the settings and click Create Load Balancer on the right.

Step 10. Configure firewall

Configure firewalls for Virtual Machines in the pool according to the separate guide.

Make sure their ports are open for the Load Balancer traffic:

• If a Load Balancer and Virtual Machines are in a public network, set a rule to receive and transmit traffic to the balancer's IP address (specified in the menu) in firewalls settings of the VM.
• If a Load Balancer and Virtual Machines are in a private subnetwork, set a rule to receive and transmit traffic to the entire private subnetwork or to the balancer's IP address (specified in the menu).
• If a Load Balancer is in a public network and Virtual Machine are in a private subnetwork, set a rule to receive and transmit traffic to the entire private subnetwork or to the balancer's internal IP address (send a request to the technical support).

In the Load Balancers section, open the created balancer and click Create or Edit a custom security group (this is the firewall) and edit it: configure the rules for inbound and outbound traffic.