Load balancers

​Overview

A Cloudflare load balancer is identified by the DNS hostname whose traffic you want to balance (www.example.comOpen external link, for example). The load balancer defines which origin server pools to use, the order in which they should be used, and how to geographically distribute traffic among pools.

​Important notes

​Load balancing and existing DNS records

Adding a Load Balancer does not create a DNS record or SSL certificate. To generate an SSL certificate, create a proxied DNS record for the Load Balancer. The Load Balancer record takes precedence over a DNS record for the same host name.

When you create a load balancer on Cloudflare, you can either:

• Use a unique hostname with no existing DNS record, or
• Use a hostname that has an existing DNS record, either as an A, AAAA, or CNAME record.

If a chosen hostname has an existing DNS record, the load balancer will supersede the DNS record if the DNS record is an A, AAAA, or canonical name (CNAME) record. It will not supersede other record types.

If the load balancer is disabled, preexisting DNS records will be served.

If there is no preexisting DNS record with the same name, disabling the load balancer will prevent clients from resolving the host, and requests will fail.

If a Load Balancer is manually disabled, traffic is not served to the associated origins or the fallback. If all pools in a Load Balancer are manually disabled, the fallback origin is used unless the fallback is also disabled. If the fallback is also disabled, the SOA record is served. Otherwise, if there is one pool in the Load Balancer and the pool is unhealthy, Cloudflare sends traffic to the fallback pool regardless of the fallback pool's health.

​HTTP keep-alive (persistent HTTP connection)

Cloudflare maintains keep-alive connections to improve performance and reduce cost of recurring TCP connects in the request transaction as Cloudflare proxies customer traffic from its edge network to the site's origin.

Ensure HTTP Keep-Alive connections are enabled on your origin. Cloudflare reuses open TCP connections for up to 15 minutes (900 seconds) after the last HTTP request. Origin web servers close TCP connections if too many are open. HTTP Keep-Alive helps avoid premature reset of connections for requests proxied by Cloudflare.

​Session cookies

When using HTTP cookies to track and bind user sessions to a specific server, configure Session Affinity to parse HTTP requests by cookie header. Doing so directs each request to the correct application server even when HTTP requests share the same TCP connection due to keep-alive.

For example, F5 BIG-IP load balancers set a session cookie at the beginning of a TCP connection (if none exists) and then ignore all cookies from subsequent HTTP requests on the same TCP connection. This tends to break session affinity because Cloudflare sends multiple HTTP sessions on the same TCP connection. Configuring the load balancer to parse HTTP requests by cookie headers avoids this issue.

​Railgun (wide area network optimization)

Railgun is a web proxy system built for Cloudflare, that allows dynamic content for a website to be cached while also allowing changes to the site to take effect almost instantly. Railgun is currently available to customers with a Business or Enterprise plan, or via one of Cloudflare’s Optimised Partners.

Railgun compresses web objects, even rapidly changing pages like news sites or personalized content. Using Railgun in conjunction with Cloudflare Load Balancing speeds up connections between Cloudflare datacenters and DNS origin servers so that uncacheable requests have minimal latency.

Set up a Railgun listener in front of the load balancer so that the load balancer can handle HTTP connections normally. Load balancing long-lived TLS connections between the sender and listener is very difficult.

Use the same load balancer settings as if Railgun were not in place — for example, HTTP keep-alive connections should be enabled and set to a 90-second timeout, since Railgun is working as an HTTP reverse proxy.

If Railgun is placed behind the load balancer, observe the following guidelines to avoid interruptions with site traffic:

1. Use the railgun-nat.conf configuration file to set the internal addresses of the hosts Railgun will be optimizing (localhost:8080, for example). This is important to avoid looping the request outbound to the internet and back to the load balancer only to be forwarded to the origin.
2. Ensure no firewall rules are in place that will interfere with traffic between the listener and the origin server.
3. Ensure port 2408 is open and passed through the load balancer so that it does not interfere with the TLS connection between the listener and sender.

​Properties

Cloudflare Load Balancer objects have the following properties:

[  "17b5962d775c646f3f9725cbc7a53df4",  "9290f38c5d07c2e2f4df57b1f61d4196",  "00920f38ce07c2e2f4df50b1f61d4194"]

{  "LAX": [    "de90f38ced07c2e2f4df50b1f61d4194",    "9290f38c5d07c2e2f4df57b1f61d4196"  ],  "LHR": [    "abd90f38ced07c2e2f4df50b1f61d4194",    "f9138c5d07c2e2f4df57b1f61d4196"  ],  "SJC": [    "00920f38ce07c2e2f4df50b1f61d4194"  ]}

{  "WNAM": [    "de90f38ced07c2e2f4df50b1f61d4194",    "9290f38c5d07c2e2f4df57b1f61d4196"  ],  "ENAM": [    "00920f38ce07c2e2f4df50b1f61d4194"  ]}

​Managing load balancers via the Cloudflare API

​Endpoint

The endpoint for managing load balancers is

zones/:identifier/load_balancers

​Commands

The Cloudflare API supports the following commands for load balancers. (Examples are given for the user-level endpoint but apply to the account-level endpoint as well.) For detailed instruction, see Cloudflare API v4: Load BalancersOpen external link.