iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Install HAProxy on a Linux VPS, expose an HTTP or HTTPS frontend, and send requests to a private backend pool. In HTTP mode, HAProxy can inspect and modify requests, run URL-based health checks, remove failed servers from rotation, and terminate TLS before forwarding traffic. This guide uses Ubuntu Server commands and shows a two-server pool, HTTPS termination, optional encrypted backend connections, firewall rules, validation, and the fixes for common 503 errors.
What HAProxy does in a VPS load-balancing setup
Clients connect to one public VPS address. HAProxy listens on that address, chooses an eligible application server, and proxies the request. The public listener is called a frontend; the destination group is a backend. A backend can contain two or more servers, each identified by an address, port, and optional weight or persistence setting.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →HAProxy can run in TCP mode, where connections are opaque, or HTTP mode, where it can inspect and alter HTTP messages. HTTP mode is the useful choice for ordinary web traffic when you need HTTP health checks, redirects, forwarded headers, host-based routing, or TLS termination.
Health checks ensure that only healthy servers remain in the balancing rotation. If every server fails its check, HAProxy has nowhere to forward a request and normally returns HTTP 503 Service Unavailable. That response describes the pool’s current eligibility, not necessarily a failure of the HAProxy process itself.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Prerequisites and network plan
Use a currently supported Linux distribution on a VPS with a public address, or a private network that is reachable by your clients. The examples target Ubuntu Server because its current LTS documentation uses it for internet-facing scale-out workloads; package versions and service defaults vary by distribution and repository.
- Administrative SSH access to the VPS.
- DNS for the service hostname pointing to the VPS address.
- At least two HTTP-capable backend servers, with their application ports known.
- A health URL on each backend, ideally a lightweight endpoint that does not depend on a database or another fragile service.
- Permission to change the VPS firewall and the cloud provider’s firewall or security group.
- A plan for certificate issuance and renewal if the public listener will use HTTPS.
Keep backend services on private addresses when possible. Restrict their firewall rules so they accept application traffic only from the load-balancer VPS or its private network. Do not expose backend ports publicly merely because HAProxy needs to reach them.
Recommended Free Tools
Install HAProxy and prepare the VPS
- Install the distribution package. On Ubuntu, update package metadata and install HAProxy:
sudo apt update
sudo apt install haproxy
haproxy -vThe final command prints the installed build. Exact HAProxy features, defaults, and certificate handling can differ between distribution releases, so keep that version in mind when applying configuration examples.
- Check for port conflicts. Before enabling HAProxy, identify any service already listening on TCP port 80 or 443. Stop it, move it, or choose a different listener; two processes cannot bind the same address and port.
- Back up the vendor configuration. The conventional file is
/etc/haproxy/haproxy.cfg. Save a copy before editing so you can restore a known-good configuration. - Preserve SSH before enabling the firewall. Ubuntu’s default firewall frontend is
ufw. Allow your administrative SSH path first, then allow only the public listener ports you will actually use:
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseIf you will serve only HTTPS, you can omit the 80/tcp rule after confirming that no HTTP redirect or ACME HTTP-01 challenge requires it. The VPS firewall is only one layer: verify that the provider’s network firewall or security group also permits inbound TCP 80 and/or 443. Host-level rules cannot compensate for a blocked provider rule.
Build a minimal HTTP load balancer
Replace the example addresses, ports, and health path with values that exist in your environment. This configuration listens on port 80 and sends requests to two application servers on port 8080.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
global
log /dev/log local0
log /dev/log local1 notice
user haproxy
group haproxy
daemon
stats socket /run/haproxy/admin.sock mode 660 level admin
defaults
log global
mode http
option httplog
option dontlognull
timeout connect 5s
timeout client 30s
timeout server 30s
frontend http_in
bind :80
mode http
default_backend web_pool
backend web_pool
mode http
balance roundrobin
option httpchk GET /health
http-check expect status 200
server web1 10.0.0.11:8080 check
server web2 10.0.0.12:8080 checkHow each section works
- global sets process-wide logging, the unprivileged runtime user and group, daemon mode, and an administrative UNIX socket. The socket can later expose runtime state to authorized operators; protect its file permissions.
- defaults applies HTTP mode, log formatting, and connection timeouts to following sections. A five-second connect timeout limits how long HAProxy waits to establish a backend connection; 30-second client and server timeouts prevent inactive connections from remaining indefinitely.
- frontend http_in binds TCP port 80 and selects
web_poolfor every request. - backend web_pool uses round-robin distribution. The health check sends
GET /healthand considers only an HTTP 200 response healthy. Eachserverline names a backend, gives its address and port, and enables active checking withcheck.
A health endpoint should be fast and deterministic. If the application has no dedicated endpoint, choose a lightweight URL that reliably returns success without requiring a database query, external API, or other dependency that could mark an otherwise capable web process down.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose a distribution strategy
Round-robin is a sensible baseline when servers have similar capacity and requests have roughly similar cost. Change the algorithm when your workload violates those assumptions.
| Strategy | Use it when | Important limitation |
|---|---|---|
roundrobin |
Backends are comparable and request cost is reasonably even. | A slow request can occupy one server longer than another. |
leastconn |
Requests have uneven duration and active connection count is a useful load signal. | Connection count is not a complete measure of CPU, memory, or application work. |
| Weights | One server has more or less capacity than its peers. | Weights express relative capacity; they do not fix an unhealthy application. |
| Source persistence | A client should tend to return to the same backend. | It can produce uneven distribution and is not a substitute for shared application state. |
Stateless applications can usually rebalance freely. Applications that keep sessions in local memory need shared sessions, a durable shared store, or deliberate stickiness. Decide this before production traffic; changing algorithms cannot recover a session that exists only on a different server.
Configure HTTPS termination at HAProxy
With TLS termination, the client encrypts traffic to HAProxy. HAProxy presents the public certificate, decrypts HTTP, and forwards the request to the backend. Obtain and renew the certificate through your chosen ACME or certificate workflow, then place a PEM bundle where the installed HAProxy version expects it. The file must contain the certificate and private key in the format required by that version, and its permissions must allow HAProxy to read it without exposing the key to unrelated users.
frontend https_in
bind :443 ssl crt /etc/haproxy/certs/example.com.pem alpn h2,http/1.1
mode http
http-request set-header X-Forwarded-Proto https
default_backend web_pool
frontend http_redirect
bind :80
mode http
http-request redirect scheme https code 301The alpn list negotiates HTTP/2 or HTTP/1.1 with clients. The forwarded-protocol header tells an application that the original request was HTTPS, which prevents incorrect absolute links or redirect loops when the backend connection itself is plain HTTP.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Certificate renewal and port 80 challenges
Reload HAProxy after a renewed certificate so the process reads the new file. If your ACME method uses an HTTP-01 challenge, do not redirect every port-80 request blindly unless the ACME client can still answer the challenge. Route the challenge path to the ACME client, or use a certificate method that does not require the public HTTP listener.
Encrypt the HAProxy-to-backend connection
Client-side HTTPS and backend-side HTTPS are separate decisions. TLS can terminate at HAProxy while the internal hop remains HTTP, or HAProxy can establish a second encrypted connection to each backend. Use backend TLS when the private network is not fully trusted, policy requires encryption in transit, or backend services enforce HTTPS.
backend secure_pool
mode http
balance roundrobin
option httpchk GET /health
http-check connect ssl sni str(example.internal)
http-check send meth GET uri /health ver HTTP/1.1 hdr Host example.internal
http-check expect status 200
server app1 10.0.0.21:443 ssl verify required ca-file /etc/haproxy/ca/internal-ca.pem sni str(example.internal) check
server app2 10.0.0.22:443 ssl verify required ca-file /etc/haproxy/ca/internal-ca.pem sni str(example.internal) checkThe ssl keyword encrypts each server connection. verify required makes HAProxy validate the backend certificate against the supplied CA file. SNI and the HTTP Host header select the correct virtual host on name-based HTTPS services. If a backend uses a self-signed or privately issued certificate, install the correct internal CA and ensure its certificate name matches the SNI and hostname policy.
verify none can be useful for a deliberate, short-lived diagnostic, but it disables certificate validation and should not be the production setting.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Validate, start, and reload safely
Never replace a running configuration without a syntax check. Use this sequence after editing the file:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
sudo haproxy -c -f /etc/haproxy/haproxy.cfg
sudo systemctl enable --now haproxy
sudo systemctl reload haproxy
sudo systemctl status haproxy --no-pager
sudo journalctl -u haproxy -n 100 --no-pagerThe first command parses the complete file and reports errors without changing the running service. On a first deployment, enable --now enables startup at boot and starts the service. On later changes, reload rather than stop/start so existing connections can drain according to the service’s reload behavior.
Test from the VPS and from a client
Test each backend directly from the load-balancer VPS before blaming HAProxy:
curl -i http://10.0.0.11:8080/health
curl -i http://10.0.0.12:8080/healthThen test the public hostname and both protocols as applicable:
curl -i http://example.com/
curl -Ik https://example.com/Direct tests prove that the application is listening and that the VPS can reach it. Public tests additionally exercise DNS, provider firewalls, UFW, listener binding, TLS certificate loading, and HAProxy routing.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot 503 responses and failed health checks
A 503 generally means no backend is currently eligible for the selected backend. Work through the failure in this order:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
| Symptom or cause | What to check | Correction |
|---|---|---|
| All servers are marked down | HAProxy logs, the health URL, and the expected status code. | Fix the endpoint, use the correct path, or change http-check expect to the application’s intentional success status. |
| Connection refused or timed out | Backend process state, listening address and port, route tables, UFW, provider firewall, and private-network ACLs. | Start the service, correct the address or port, or permit traffic from the load-balancer address. |
| Health URL works manually but fails through HAProxy | Host-header requirements, virtual-host routing, HTTP versus HTTPS, and SNI. | Send the required Host header and configure an SSL health check with matching SNI when the backend is HTTPS. |
| Only one backend is down | Compare its application logs and configuration with the healthy peer. | Repair that node or remove it intentionally until it passes the same check. |
| HTTPS listener does not start | Certificate path, PEM contents, file permissions, and port 443 conflicts. | Build the certificate/key bundle required by the installed HAProxy version, grant readable permissions, and resolve the bind conflict. |
| Requests reach the wrong application | DNS records, frontend bind address, default backend, and Host-based rules. | Correct DNS or routing rules and retest with the intended hostname. |
Inspect HAProxy’s service journal and the backend access logs together. The HAProxy log shows whether a check or connection failed; the backend log shows whether a request arrived and how the application handled it. Also verify that DNS resolves to the VPS you configured rather than an old address.
Design choices for production
TLS placement
Terminate TLS only at HAProxy when the internal network is controlled and the application does not require end-to-end encryption. Use TLS on both legs when internal traffic needs confidentiality or certificate-based identity. Use TCP pass-through instead when the backend must terminate TLS itself and HAProxy must not inspect HTTP; that sacrifices HTTP-layer routing and checks.
Failure detection
A TCP check proves that a port accepts connections. An HTTP check proves that a meaningful URL returns the expected status. Prefer the latter for web applications, but keep the endpoint independent of optional dependencies so a temporary database issue does not remove every node unnecessarily.
Exposure and access control
Expose only the listener ports publicly. Keep the HAProxy administrative socket and SSH restricted to administrators, and keep backend ports reachable only from HAProxy or the private application network. Apply the same policy in UFW and the cloud-provider firewall; either layer can block otherwise correct traffic.
Operational control
For a self-managed VPS, local configuration plus systemd gives direct control and transparent logs. A provider-managed load balancer can reduce operating work but moves configuration and failure handling into that provider. HAProxy Enterprise or a Data Plane API can add supported management workflows for organizations that need them; choose that path only when its operational controls justify the additional product and support requirements.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Deployment checklist
- DNS points the service hostname to the intended VPS address.
- No unrelated process owns TCP 80 or 443.
- UFW and the provider firewall allow the listener ports, while SSH remains restricted.
- Backends are reachable from the VPS over the intended private or protected network.
- Each backend health URL returns the status configured in
http-check expect. - The balancing method matches server capacity, request cost, and session behavior.
- The certificate PEM contains the required certificate and private key, with secure permissions.
- Backend TLS validation uses the correct CA and SNI when encryption is enabled.
haproxy -cpasses before every reload.- Service status, HAProxy logs, backend logs, and direct curl tests have all been checked after deployment.
Conclusion
A reliable HAProxy VPS deployment separates a public HTTP or HTTPS frontend from a monitored backend pool, protects the network boundaries, and validates every change before reload. Start with round-robin and HTTP health checks, add TLS termination and forwarded headers for public HTTPS, and enable verified backend TLS when the internal hop requires it. When a request returns 503, investigate backend eligibility, health-check responses, addressing, headers, certificates, and both firewall layers rather than assuming the proxy itself is unavailable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
