Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NGINX open sources TCP load balancing

hg.nginx.org

Post reply on HN
Print view View original

91–100 of 121 posts

Re: NGINX open sources TCP load balancing

#91

Post by jhgg »

mkhpalm wrote: post #87
phildougherty wrote: post #80

Earlier quoted context omitted.

CloudFlare is build on top of OpenResty which is basically stock nginx with ngx_lua and a bunch of other modules built in. I would argue that if you want it to be, nginx can be much better at DDoS mitigation. You can use the modules limit_conn and limit_req to control how many connection individual IPs can make to your server for basic control.

You can add various things on top of nginx... but you can use stock haproxy to limit the number of connections by source IP.

This can also be achieved in nginx fairly easy:

http://nginx.org/en/docs/http/ngx_http_limit_conn_module.htm...

Re: NGINX open sources TCP load balancing

#92

Post by jzelinskie »

cbsmith wrote: post #27

I didn't see anything about proxy protocol support, which is kind of nice with TCP load balancing... http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt

I agree. nginx already supports forwarding from proxy protocol[0] via the http_realip module; time to go full circle.

[0]: http://nginx.org/en/docs/http/ngx_http_realip_module.html

Re: NGINX open sources TCP load balancing

#93

Post by cbsmith »

jzelinskie wrote: post #92
cbsmith wrote: post #27

I didn't see anything about proxy protocol support, which is kind of nice with TCP load balancing... http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt

I agree. nginx already supports forwarding from proxy protocol[0] via the http_realip module; time to go full circle. [0]: http://nginx.org/en/docs/http/ngx_http_realip_module.html

I've had problems getting that module to work properly with AWS ELB (though I'd kind of assumed the problem was with ELB), so I'm not sure how solid the support is even for that. It'd be nice to test it against nginx itself as a baseline.

Re: NGINX open sources TCP load balancing

#94

Post by cbsmith »

derefr wrote: post #73
amenod wrote: post #47

Earlier quoted context omitted.

Not sure about that... HAproxy is a proven technology (very reliable and a joy to use at that) in this field while Nginx is a newcomer and needs to establish its credibility first. I personally wouldn't use such technology for load balancer until it is properly battle-tested. Also, I can't see much of an advantage over (proven) HAproxy - am I missing something? As for supporting a single product, I don't see the poin…

> As for supporting a single product, I don't see the point of that. It's not about configuration; it's about security. Fewer products in your stack means fewer things to patch. Rather than updating nginx some times and haproxy other times, you just update nginx across all your machines (both web servers and load balancers), and you're done. This also gives you more time with which to vet any given nginx update.

> It's not about configuration; it's about security. Fewer products in your stack means fewer things to patch.

Kind of the reverse of the defense-in-depth principle eh? ;-)

Re: NGINX open sources TCP load balancing

#95

Post by cbsmith »

shuzchen wrote: post #52
amenod wrote: post #47

Earlier quoted context omitted.

Not sure about that... HAproxy is a proven technology (very reliable and a joy to use at that) in this field while Nginx is a newcomer and needs to establish its credibility first. I personally wouldn't use such technology for load balancer until it is properly battle-tested. Also, I can't see much of an advantage over (proven) HAproxy - am I missing something? As for supporting a single product, I don't see the poin…

For anyone already using nginx in their stack, I don't think these things (being a newcomer, or needing credibility) are a very big concern. Some people are already used to using nginx as a load balancer for HTTP traffic (this new feature adds load balancing for any TCP traffic) so those users won't have much gap to cover. Also this feature was in the nginx+ version, which presumably means it has already been battle-…

There is a world of difference between layer-3/4 style load balancers and layer-7 load balancers. If you want to do it right, you often employ both.

Re: NGINX open sources TCP load balancing

#97

Post by derefr »

cbsmith wrote: post #94
derefr wrote: post #73

Earlier quoted context omitted.

> As for supporting a single product, I don't see the point of that. It's not about configuration; it's about security. Fewer products in your stack means fewer things to patch. Rather than updating nginx some times and haproxy other times, you just update nginx across all your machines (both web servers and load balancers), and you're done. This also gives you more time with which to vet any given nginx update.

> It's not about configuration; it's about security. Fewer products in your stack means fewer things to patch. Kind of the reverse of the defense-in-depth principle eh? ;-)

Defense-in-depth doesn't work very well for infrastructure software packages: many projects share the same libraries with the same vulnerabilities (e.g. OpenSSL) but still have to be updated with independent package updates.

A shared-library vulnerability means both Nginx and HAProxy get broken in their own ways, which is worse, I think, than just having your whole stack rely on one or the other, and having that one break—it's more similar to having two independent vulnerabilities arise simultaneously.

Re: NGINX open sources TCP load balancing

#98

Post by mostafah »

fasteo wrote: post #14

Many installations would go from haproxy->nginx to nginx->nginx. Having to support a single product will make many devops happy. In the same tense, haproxy is adding Lua support[1], which has been available in nginx - using openresty[2] - since 2011, and nginx core is doing the same with Javascript[2]. Interesting times aroung haproxy and nginx. [1] http://blog.haproxy.com/2015/03/12/haproxy-1-6-dev1-and-lua/ [2] htt…

Awesome news for nginx users. But why should the first reaction should be about criticizing the other option? Some HAProxy users may or may not switch to this new product in the coming years. I probably won’t. Even today there is a big overlap between what HAProxy, nginx, and some other tools do and yet everybody works with what they prefer. Adding another feature that until now HAProxy had and nginx didn’t have doesn’t mean a dramatic time for this “competition” (even if such a thing exists).

Re: NGINX open sources TCP load balancing

#100

Post by ejanus »

jsmthrowaway wrote: post #67
jvehent wrote: post #41

Earlier quoted context omitted.

Surely you must have misread the docs, it's pretty damn powerful.

I ran 1.4 in production at a 8,000+ QPS social network, have been on a team who submitted patches to Tarreau that are now in HAproxy, and very intentionally put Openresty behind it for HTTP after months of tweaking a very fragile HAproxy configuration with several applications hanging off our property's domain name. I also architected and built a LBaaS product at a well-known hosting provider using HAproxy. I didn't…

I am about getting involved with a startup and I would like you to explain "Standard Frontend Deployment, B" a bit in detail. And What is ELB?
Post reply on HN