The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Round-robin can distribute WebSocket connection starts evenly, but it does not keep the number of live connections—or the work they generate—equal across servers. Each accepted WebSocket stays on the backend that handled its HTTP upgrade, so connection lifetimes and per-connection activity can make load diverge over time. That is a scaling limitation, not evidence that round-robin cannot proxy WebSockets.
Why round-robin can look balanced at first and uneven later
In NGINX’s HTTP load-balancing setup, round-robin is the default when no other method is configured. It distributes incoming requests in turn; NGINX says the distribution is more or less equal when there are enough requests, the work is uniform, and requests finish quickly. Those assumptions fit short HTTP requests better than long-lived WebSockets. NGINX HTTP load balancing documentation
A WebSocket begins with an HTTP request to upgrade the connection. After the server accepts the upgrade, communication continues over one persistent, bidirectional connection. In the Application Load Balancer case documented by AWS, the target that returns HTTP 101 handles that WebSocket connection. Frames are not repeatedly reassigned among backends; they continue over the established connection to its selected target. AWS ALB target group attributes
Round-robin may give several servers the same number of new connections over an interval. But if some connections end quickly while others remain open, the live counts stop matching. And a count alone does not capture how busy each socket is: message rates, bandwidth, CPU use, and application work can vary. The cited documentation does not establish a connection-count threshold at which this imbalance becomes material.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Do WebSockets need sticky sessions?
An established WebSocket is already tied to the backend that accepted its upgrade. AWS describes WebSocket connections through an Application Load Balancer as inherently sticky; its cookie stickiness setting does not determine where frames on that established connection go. AWS ALB target group attributes
Cookie or IP-based affinity addresses a different question: whether separate requests from the same client should return to the same server. That can matter when application state lives on a particular backend, but it is not a requirement for the WebSocket connection itself to remain on its selected target. NGINX describes IP hashing as basic session persistence and notes that, with round-robin or least-connected balancing, subsequent client requests may go to different servers. NGINX HTTP load balancing documentation
For ingress-nginx, cookie affinity offers two modes with different scale-up behavior: balanced mode can redistribute some sessions as servers are added, while persistent mode avoids rebalancing sessions to new servers and prioritizes stickiness. ingress-nginx annotations documentation
Rank #2
- 【Flexible Port Configuration】1 2.5Gigabit WAN Port + 1 2.5Gigabit WAN/LAN Ports + 4 Gigabit WAN/LAN Port + 1 Gigabit SFP WAN/LAN Port + 1 USB 2.0 Port (Supports USB storage and LTE backup with LTE dongle) provide high-bandwidth aggregation connectivity.
- 【High-Performace Network Capacity】Maximum number of concurrent sessions – 500,000. Maximum number of clients – 1000+.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【Highly Secure VPN】Supports up to 100× LAN-to-LAN IPsec, 66× OpenVPN, 60× L2TP, and 60× PPTP VPN connections.
- 【5 Years Warranty】Backed by our 5-years warranty and free technical support from 6am to 6pm PST Monday to Fridays
Which balancing method fits WebSocket traffic?
Choose according to the signal that best represents capacity in your application. These methods make different trade-offs; none guarantees equal CPU, bandwidth, or application work per backend.
| Method | What it uses to choose a backend | Useful when | Important limitation |
|---|---|---|---|
| Round-robin | Order of incoming requests or connection starts | You want a simple distribution of new work | It does not react to current active WebSocket counts or per-socket work. NGINX documentation |
| Least-connected | Active connection count; NGINX assigns the next request to the server with the fewest active connections | Connection counts are a useful approximation of capacity | It balances counts, not different resource use or message rates per socket. NGINX documentation |
| IP hash or cookie affinity | Client IP or an affinity cookie | Separate application requests need a client-to-server mapping | Affinity can concentrate clients on particular servers and does not equalize their resource consumption. NGINX documentation |
| ingress-nginx cookie affinity: balanced | Cookie-based session affinity with balancing behavior during scale-up | Some redistribution as the deployment grows is acceptable | Some sessions may be redistributed to new servers. ingress-nginx annotations documentation |
| ingress-nginx cookie affinity: persistent | Cookie-based session affinity that avoids moving sessions to newly added servers | Keeping sessions on their selected servers matters more than rebalancing them during scale-up | New servers do not receive rebalanced existing sessions. ingress-nginx annotations documentation |
Least-connected is worth considering when active connection count tracks backend capacity reasonably well. It cannot account for the fact that one connection might be nearly idle while another generates substantial work. Compare candidate methods against observed resource use, how selection behaves as servers are added or removed, and your application’s need for session affinity. The cited documentation does not provide comparative benchmarks or a universal best method.
Rank #3
- 【Flexible Port Configuration】1 Gigabit SFP WAN Port + 1 Gigabit WAN Port + 2 Gigabit WAN/LAN Ports plus1 Gigabit LAN Port. Up to four WAN ports optimize bandwidth usage through one device.
- 【Increased Network Capacity】Maximum number of associated client devices – 150,000. Maximum number of clients – Up to 700.
- 【Integrated into Omada SDN】Omada’s Software Defined Networking (SDN) platform integrates network devices including gateways, access points & switches with multiple control options offered – Omada Hardware controller, Omada Software Controller or Omada cloud-based controller(Contact TP-Link for Cloud-Based Controller Plan Details). Standalone mode also applies.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【SDN Compatibility】For SDN usage, make sure your devices/controllers are either equipped with or can be upgraded to SDN version. SDN controllers work only with SDN Gateways, Access Points & Switches. Non-SDN controllers work only with non-SDN APs. For devices that are compatible with SDN firmware, please visit TP-Link website.
Why do WebSocket connections close after 60 seconds?
A timeout can close a connection even when the balancing algorithm is otherwise working. The ingress-nginx documentation lists 60 seconds as the default for both proxy-read-timeout and proxy-send-timeout, and says values above one hour are more adequate for WebSockets. Those are ingress-nginx-specific proxy settings, not general defaults for every NGINX product or load balancer. ingress-nginx miscellaneous documentation
Check the deployed ingress-nginx release and the full network path before changing a value: an intermediary load balancer or proxy may impose its own timeout. If ingress-nginx is exposed through a Kubernetes LoadBalancer service, its documentation says the protocol between that load balancer and NGINX should be TCP. Raising a timeout affects connection lifetime; it does not make round-robin account for active connection load. ingress-nginx miscellaneous documentation
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat to check when WebSocket load is uneven
Separate connection-distribution problems from timeout failures and from genuine differences in work per socket. Inspect backend-level metrics alongside upgrade and connection lifecycle data:
- Active WebSocket connections per backend, including how the counts change over time.
- Connection lifetime distributions and close reasons, to see whether servers differ because their sockets stay open for different lengths of time.
- Upgrade success and failures, including whether clients reach the expected backend path.
- Proxy read and send timeout settings at ingress-nginx and every intermediary in the network path.
- Backend CPU, memory, and network use, since equal socket counts do not prove equal resource demand.
- Backend draining and termination behavior when instances are removed or deployments change.
These checks help identify whether the issue is uneven active counts, uneven work per connection, or connections being closed along the proxy path. The documentation cited here does not prescribe a complete monitoring checklist or quantify when a particular imbalance becomes a scaling problem.
Quick Recap
Best Value
- Multi-WAN Business Continuity: Connect up to 5 ISPs with automatic failover and load balancing — if one connection drops, traffic instantly reroutes to keep your business, remote office, or home lab online
- OpenWRT-Ready Enterprise Control: Full OpenWRT support unlocks VLAN segmentation, advanced firewall rules, custom QoS policies, and community-developed packages for professional-grade network management
- Complete VPN Gateway Suite: WireGuard, OpenVPN, IPsec, PPTP, and L2TP server and client built in; create site-to-site tunnels, host remote access, or route specific VLANs through encrypted VPN connections
- Professional Security Stack: SPI firewall, DoS attack prevention, IP/MAC binding, domain filtering, and DMZ hosting protect your network perimeter while keeping critical services accessible
- Flexible Deployment & Monitoring: Web GUI or Cudy App cloud management with TR-069 support; built-in diagnostic tools (Ping, Traceroute, NSLookup, system logs) for rapid troubleshooting anytime
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
