iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Install HAProxy on Ubuntu 22.04 with sudo apt update followed by sudo apt install haproxy. Configure /etc/haproxy/haproxy.cfg, validate the file, restart the service, and enable it at boot. The example below turns an Ubuntu server into an HTTP reverse proxy and round-robin load balancer for two web servers.
What you install and what HAProxy does
HAProxy is a high-performance load-balancing reverse proxy. A client connects to HAProxy on the Ubuntu host, and HAProxy forwards the request to one of the servers defined in a backend. This lets you expose one public address while distributing traffic across multiple application or web servers.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall
Ubuntu 22.04, also called Jammy Jellyfish, provides HAProxy through its normal community package repositories. Ubuntu’s Jammy security archive listed package version 2.4.30-0ubuntu0.22.04.2 at the time of the package-index observation; that identifier can change when Ubuntu publishes later security revisions. Installing with APT is therefore preferable to copying a version-specific package command.
This procedure covers the free distribution package and an HTTP listener on port 80. It does not configure TLS termination, a statistics page, PROXY protocol, stick tables, or application-specific HTTP health endpoints. Those features require additional design and configuration beyond the minimal reverse-proxy setup shown here.
#1 Best Overall
- Professional 10Gbps Wired Routing – Route10 is a high-performance 10 Gigabit wired router designed for advanced home, business, and enterprise networks; it does not broadcast Wi-Fi, and wireless coverage requires pairing with one or multiple Wi-Fi access points such as ceiling, wall, or outdoor access points for full network coverage.
- Quad-Core Qualcomm Network Accelerator for High Throughput – Powered by a high-performance quad-core Qualcomm processor with hardware-accelerated networking, the Route10 delivers fast packet processing, low latency, and consistent multi-gigabit performance for routing, firewall rules, VPN traffic, VLAN segmentation, and high-bandwidth network workloads without bottlenecks.
- Integrated PoE+ Output to Power Network Devices – Select Ethernet ports provide Power over Ethernet Plus (PoE+) support, allowing the router to power compatible access points, network devices, or edge hardware directly through the Ethernet cable, reducing the need for additional power adapters or injectors.
- Enterprise-Grade Routing, Firewall, and Network Control – Supports advanced routing features including VLAN tagging, QoS traffic prioritization, NAT port forwarding, firewall rules, DHCP services, and professional network segmentation for secure, reliable, and scalable wired network deployments.
- Real-Time Network Monitoring and Traffic Visibility – Provides live network statistics and real-time monitoring of bandwidth usage, connected devices, WAN and LAN traffic, and system performance, allowing network administrators to quickly identify issues, optimize traffic flow, and maintain stable, high-performance wired networks.
Prerequisites before installation
- An Ubuntu 22.04 host with a user allowed to run
sudo. - Network access to Ubuntu’s package repositories so APT can download the package and its dependencies.
- At least one reachable backend server. The example uses
10.0.0.11:80and10.0.0.12:80; replace them with addresses and ports that exist in your network. - Permission to open the frontend port. The example binds port 80 on every local interface, so no other process may already own that port.
- Firewall rules that allow client traffic to the HAProxy listener and HAProxy traffic from the proxy host to each backend.
Confirm the operating-system release if the host may have been upgraded or rebuilt:
cat /etc/os-releaseLook for VERSION_ID="22.04". If the host is a different Ubuntu release, use that release’s package and service documentation instead of assuming the Jammy instructions are identical.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Install HAProxy from Ubuntu’s repository
- Refresh the local package metadata:
sudo apt updateapt update downloads current repository indexes; it does not itself install or upgrade HAProxy.
- Install the package:
sudo apt install haproxyAccept the dependency plan when APT asks for confirmation. Ubuntu’s package entry describes haproxy as a load-balancing reverse proxy.
- Check the installed binary and package metadata:
haproxy -v
apt policy haproxyThe exact version shown by these commands depends on the current Jammy updates enabled on your host. Do not treat the observed 2.4.30-0ubuntu0.22.04.2 value as a permanent pin.
Understand the service and configuration file
The main configuration file is /etc/haproxy/haproxy.cfg. Ubuntu’s systemd unit starts HAProxy with that path and orders startup after network-online.target, which gives the network initialization a chance to complete before HAProxy starts. The unit is installed in the multi-user.target boot stage.
After installation, inspect the service state:
sudo systemctl status haproxyThe status output tells you whether the service is running and includes recent messages if startup failed. A newly installed service may be inactive until you provide a valid configuration and start it.
Enable automatic startup for future boots:
sudo systemctl enable haproxyEnabling a service and starting it are separate operations. enable creates the boot-time relationship; start or restart runs the process immediately.
Create a minimal HTTP reverse proxy and load balancer
Back up the distribution file before editing it so you can restore the previous state if a change introduces a syntax or routing problem:
sudo cp /etc/haproxy/haproxy.cfg /etc/haproxy/haproxy.cfg.bakOpen the file with an editor:
sudo nano /etc/haproxy/haproxy.cfgAdd or adapt a configuration with this frontend/backend pattern:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Compatible management via CloudKey, Official UniFi Hosting, or UniFi Network Server running version 8.3.32 or newer
- Ensures continuous connection through Shadow Mode High Availability featuring automatic failover (VRRP)
- Delivers 12.5 Gbps routing performance equipped with IDS/IPS capabilities
- Offers license-free, real-time decryption and inspection of encrypted traffic using NeXT AI Inspection*
- Features 25G SFP28, 10G SFP+, and 2.5 GbE RJ45 ports where two interfaces can be reconfigured as WAN connections
frontend http
bind *:80
mode http
default_backend web-backend
backend web-backend
balance roundrobin
server web1 10.0.0.11:80 check
server web2 10.0.0.12:80 checkReplace both example addresses with reachable backend addresses. Keep the indentation clear; HAProxy configuration is organized by sections and directives, and a typo in a directive or address can prevent the service from starting.
How the frontend works
frontend http names the client-facing section. The name is an internal label, so you may choose another descriptive name.
bind *:80 listens on TCP port 80 on all local interfaces. Use a specific local address instead of * when the host has several interfaces and the service must be exposed on only one of them. If another web server already listens on port 80, HAProxy cannot bind the port until you stop that process, move it, or choose a different listener.
mode http tells HAProxy to process the connection as HTTP. The example is consequently an HTTP reverse proxy, not a generic TCP pass-through.
default_backend web-backend sends requests that arrive at this frontend to the backend section named web-backend. The section name must match exactly.
How the backend distributes requests
backend web-backend defines the destination pool. balance roundrobin selects the available servers in turn, distributing successive requests across the pool. This is a traffic-distribution policy, not a guarantee that every client request will alternate perfectly: unavailable servers are excluded, and connection patterns can affect what you observe.
Each server line has a name, an address, a port, and the optional health-check keyword:
web1andweb2are HAProxy’s labels for the destinations.10.0.0.11:80and10.0.0.12:80identify the destination address and port.checkenables an active health check for that server.
You can start with one server while testing. Keeping the same backend structure makes it easy to add another line later:
backend web-backend
balance roundrobin
server web1 10.0.0.11:80 checkDo not list an address that the HAProxy host cannot route to. A syntactically valid address can still produce an unusable backend if a security group, firewall, route, or service listener blocks it.
Validate the configuration before applying it
Always check the file before restarting the service. The HAProxy binary can parse the configuration without replacing the currently running process:
Rank #3
- Hardwired Router
- Titan Networx
- High performance router
- managed switch
- integrated router
sudo haproxy -c -f /etc/haproxy/haproxy.cfgA successful check reports that the configuration is valid. If the command reports an error, note the file and line number, correct that directive, and run the check again. Do not restart repeatedly with an unvalidated file; a failed restart can leave the proxy unavailable.
Once validation succeeds, apply the configuration:
sudo systemctl restart haproxy
sudo systemctl status haproxyThe status command should show an active running service. If it does not, read the unit’s recent journal entries:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo journalctl -u haproxy --no-pager -n 50After you have confirmed a successful restart, make sure the service is enabled for boot:
sudo systemctl enable haproxyUse health checks so failed servers leave rotation
The check keyword causes HAProxy to test each backend server actively. HAProxy’s health-check documentation describes a basic TCP-layer check as an attempt to connect to a server, or to send it an HTTP request, at regular intervals. A basic TCP check succeeds when the server answers the connection handshake.
When a check fails, HAProxy removes that server from the load-balancing rotation until checks show that it has recovered. This prevents new traffic from being sent to a destination that is not accepting connections. Health checks do not repair the application, validate business logic, or prove that an HTTP response contains the right content; they establish that the configured connection-level check is succeeding.
For the configuration above, check is appropriate when the web services listen on TCP port 80 and a successful connection is a useful availability signal. If an application needs a particular URL, status code, host header, or authentication sequence to be tested, configure an application-aware check deliberately rather than assuming the basic check covers it.
Test the listener and backend path
Test from a client that can reach the Ubuntu host:
curl -i http://PROXY_ADDRESS/Replace PROXY_ADDRESS with the proxy host’s DNS name or IP address. The response should come from one of the configured backend services. Make each backend return an identifiable test page, such as a hostname, if you need to see which server answered.
Perform these checks when the response is not what you expect:
- Confirm that HAProxy is active with
sudo systemctl status haproxy. - Confirm that the client is using the address and port in the
binddirective. - From the HAProxy host, verify that each backend address and port is reachable through the network and permitted by intermediate firewalls.
- Check that the backend service is actually listening on the address and port configured in its
serverline. - Review the service journal for bind errors, configuration errors, or repeated health-check failures.
Common installation and configuration failures
APT cannot find or download the package
Run sudo apt update again and inspect the repository errors it prints. A missing package index, a disabled Ubuntu repository, DNS failure, or an unreachable mirror must be fixed before apt install haproxy can succeed. Avoid downloading an unrelated package build simply because its version number looks newer; the normal Jammy repository keeps dependencies and security updates aligned with the operating system.
HAProxy will not start after editing
Run the configuration check explicitly:
sudo haproxy -c -f /etc/haproxy/haproxy.cfgThen inspect sudo journalctl -u haproxy --no-pager -n 50. Typical causes include a misspelled directive, an incomplete section, an invalid address or port, or a listener conflict. Restore the backup only if you need to return quickly to the previous known-good file, then validate the restored file before restarting.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Port 80 is already in use
A second web server or another HAProxy instance may already own the socket. Identify and stop or reconfigure the conflicting service, or change the HAProxy bind port and ensure clients use that new port. Changing the port does not automatically change firewall rules or upstream documentation, so update those dependencies together.
The service is running but clients receive connection errors
Check that the client can reach the Ubuntu host, that the host firewall permits the listener, and that HAProxy is bound to the expected interface. A wildcard bind listens on all interfaces, while a specific bind address listens only on that address. Also verify that the client is not connecting to an old DNS address.
Clients receive a backend-unavailable response
When every server in a backend fails its health check, HAProxy has no eligible destination. Confirm the addresses and ports in the server lines, routes from the proxy to those networks, backend firewall policy, and the backend application’s listening state. If the application accepts only a particular local address, ensure the configured destination matches that address rather than an interface on which it does not listen.
Firewall and network design
The proxy needs two separate network permissions: inbound client traffic to the frontend listener and outbound traffic to each backend. Permit only the ports and source networks required by your design. Opening port 80 on the proxy does not make the backend services reachable; their own host firewalls and any cloud security groups must allow connections from the HAProxy host.
Recommended Free Tools
Keep backend addresses stable. If the destination address changes, update haproxy.cfg, run the configuration check, and restart HAProxy. A successful service restart confirms syntax, not that the new address is reachable, so test the route and health state after every backend change.
Enable, stop, restart, and inspect HAProxy
These systemd commands cover normal administration:
| Task | Command | Purpose |
|---|---|---|
| Start now | sudo systemctl start haproxy |
Launches the service without changing its boot setting. |
| Stop now | sudo systemctl stop haproxy |
Stops the listener and forwarding process. |
| Restart after a change | sudo systemctl restart haproxy |
Loads the edited configuration after validation. |
| Enable at boot | sudo systemctl enable haproxy |
Starts HAProxy through the installed multi-user systemd target on future boots. |
| Inspect state | sudo systemctl status haproxy |
Shows active state and recent unit messages. |
| Read recent logs | sudo journalctl -u haproxy --no-pager -n 50 |
Displays the latest service log entries. |
Use restart only after validation. If you need to change several directives, make the edits together, run one validation, and then perform one controlled restart.
Community package versus HAProxy Enterprise
Ubuntu’s haproxy package is the straightforward choice for a normal Jammy installation. HAProxy Enterprise follows a separate licensed distribution path and requires an enterprise key and separate repository setup. It is not installed by the two APT commands in this guide.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute| Characteristic | Ubuntu community package | HAProxy Enterprise |
|---|---|---|
| License and entitlement | Community distribution package supplied through Ubuntu repositories. | Requires a commercial license and enterprise key. |
| Repository channel | Installed with the standard Jammy APT flow. | Uses a separate enterprise repository path and setup. |
| Support | Uses Ubuntu’s normal package and community support channels. | Includes support entitlement associated with the enterprise subscription. |
| Enterprise modules | Provides the capabilities packaged by Ubuntu’s community build. | May include enterprise modules and distributions not supplied by the community package. |
| Jammy compatibility | Version and revisions follow Ubuntu’s Jammy archive. | Follow the enterprise repository’s stated Ubuntu 22.04 compatibility and update policy. |
Choose the enterprise path only when you have the required license, key, repository instructions, and support arrangement. Mixing repository instructions between the two distributions can produce an unsupported or inconsistent installation.
Keep the installation maintained
Ubuntu security updates can revise the HAProxy package without changing your configuration file’s purpose. Periodically refresh package metadata and apply available updates during a maintenance window:
sudo apt update
sudo apt upgradeAfter an HAProxy package update, check the service state and test the listener. If you alter the configuration during maintenance, run sudo haproxy -c -f /etc/haproxy/haproxy.cfg before restarting.
Retain a copy of the last known-good configuration and document each backend address, port, and firewall dependency. This makes it possible to recover quickly if a later edit introduces a startup or routing problem.
Quick Recap
Installation checklist
- The host reports Ubuntu 22.04.
sudo apt updatecompletes without repository errors.sudo apt install haproxycompletes successfully./etc/haproxy/haproxy.cfgcontains a frontend with the intended bind address and port.- The frontend’s
default_backendname matches an existing backend section. - Every backend server line uses a reachable address and port.
checkis present where active TCP health checks are appropriate.sudo haproxy -c -f /etc/haproxy/haproxy.cfgreports a valid configuration.sudo systemctl restart haproxysucceeds andsystemctl status haproxyshows the service running.sudo systemctl enable haproxyis set if the proxy must return after a reboot.- Client-to-proxy and proxy-to-backend firewall rules allow the required traffic.
- A real client request confirms that the listener forwards to a healthy backend.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
