Web space · Load Balancer
Load Balancer for the machines you run yourself
Put a balancer in front of your compute units so that only the balancer faces the internet. It’s DDoS-filtered, starts at 40 Gbit/s and scales automatically, runs your own firewall rules, and gets a certificate for every website. Backends are unlimited. Set limits for a fixed price, or pay as you go.
- up to 400 where needed
- From 40 Gbit/s
- backend servers
- Unlimited
- with your own rules
- WAF
- a month
- from €1.10
What the balancer does
It hides your machine’s address, keeps a certificate on every website, blocks requests you don’t want, and sends visitors only to healthy backends. The rest is in the specifications below.
Exposure
Keep your machine’s address off the internet
A compute unit has a 1 Gbit/s uplink. A flood larger than that fills it, and every service on the machine is unreachable until mitigation catches up. With a Load Balancer in front, visitors and attackers only see the balancer. It runs on separate hardware with at least 40 Gbit/s of uplink and DDoS filtering in front of it.
- From 40 Gbit/s per balancer, on a whole QSFP+ port rather than one broken out into 4 × 10G
- Bandwidth scales automatically, to 200 or 400 Gbit/s where a location needs it
- DDoS filtering in front of every balancer, always on
- An attack on the public address never reaches your machine’s own uplink
uplink qsfp+ 40G base scaled to 200G here inbound 86.4 Gbit/s udp floodfiltered 84.5 Gbit/s dropped upstreamserved 1.9 Gbit/s to 3 websites backend 10.0.4.12 1G link at 14 %backend 10.0.4.13 1G link at 12 % ✓ origin unreachable from outside, 0 failed requests
Certificates and TLS
A certificate for every website, with a backup issuer
When you add a website, the balancer gets a certificate for it from Let’s Encrypt. If Let’s Encrypt is down or rate-limiting, ZeroSSL issues it instead. TLS ends on the balancer, which serves HTTP/3, HTTP/2, and HTTP/1.1 to visitors and passes the decrypted request, with its headers, to your backends.
- Issued and renewed for you, from Let’s Encrypt or ZeroSSL
- HTTP/3 over QUIC to every visitor whose browser supports it
- Short handshake peaks are free, because only the month’s 95th percentile counts
$ intrvll lb site add your-domain.de --backend 10.0.4.12:8080 acme letsencrypt order placedacme http-01 validatedcert issued renews itselffallback zerossl standing bylisten :443 h3 · h2 · http/1.1 ✓ live, with a certificate, in 6.2s
Web application firewall
A firewall that runs your own rules
Every balancer includes a web application firewall that runs the rules you write. Match on paths, methods, headers, and client addresses, and block requests before they reach a backend. The firewall is free. You pay €0.80 a month for each rule you add.
- Custom rules on paths, methods, headers, and client addresses
- €0.80 a rule a month, with the firewall itself free
- Rules take effect as soon as you save them
[[rule]]name = "admin-from-office-only"match = 'path ^= "/admin" and not ip in 198.51.100.0/24'action = "block" [[rule]]name = "no-scanners"match = 'header("user-agent") ~ "sqlmap|nikto"'action = "block" [[rule]]name = "api-writes-need-a-key"match = 'path ^= "/api" and method != "GET" and not header("x-api-key")'action = "block"
Health checks
Health checks on status, body, headers, and latency
An open port doesn’t mean the application works. The balancer checks each backend on a path you choose, against a status range, a string in the body, a header, and a response time. A backend leaves the rotation after the number of failures you set and returns after the number of passes you set. Changes to backends, rules, and checks take effect when you save them.
- No limit on backends: add as many machines as the site needs
- Status, body, header, and latency conditions in one check
- Changes apply immediately, with no reload window
[site."your-domain.de"]backends = ["10.0.4.12:8080", "10.0.4.13:8080"] [site."your-domain.de".health]path = "/health/ready"expect_status = "200-299"expect_body = "\"status\":\"ok\""max_latency = "250ms"interval = "5s"fall = 3 # out after 3 failuresrise = 2 # back after 2 passes
When to use it and when you don’t need it
Made for
A website on a compute unit
Made for
Several machines behind one address
Not needed for
Our own web space
From a machine to a protected address
- 01
Name the backends
The compute units, or the ports on one, that serve the site. Add as many as you like.
10.0.4.12:8080 · 10.0.4.13:8080 - 02
Add the website
The domain the balancer answers for. Its certificate is issued automatically.
your-domain.de - 03
Define the health check
A path, a status range, and the text the body should contain. Add any firewall rules the site needs.
GET /health/ready → 200 - 04
Point the DNS at us
The domain now resolves to the balancer, and you can remove your machine’s own address from DNS.
Set limits or pay as you go
Websites and firewall rules are billed either way. With limits, you set the handshake rate and traffic, and the price is fixed. With pay as you go, there are no limits and both are metered. Backends and certificates are always free.
What it serves
What passes through
Removes the limits. Handshakes and traffic are metered as they happen instead of capped at the values below.
Backends unlimitedCertificates includedHTTP/3Header passthroughDDoS filteringFrom 40 Gbit/s
Monthly estimate
- 1 website × €1.10€1.10
- Up to 10 handshakes/s€0.10
- Up to 100 GB traffic€0.15
- Backends and certificatesFree
€1.35/mo
Net. 19% VAT is added on the invoice. Changes are prorated to the day, with no minimum term.
Set it up in the consoleMore than 50 websites, 100 rules, 5,000 handshakes/s or 100 TB? Talk to us.
Limits and the 95th percentile
We measure the TLS handshake rate every five minutes and ignore the busiest 5% of the month, about 36 hours. With a limit set, those peaks don’t count against it. With pay as you go, you’re billed for the highest rate that’s left. Requests on connections that are already open aren’t handshakes and never count.
Full specifications
Everything the balancer includes. If a feature isn’t listed here, we don’t offer it.
Network
- Uplink
- From 40 Gbit/s per balancer
- Port
- QSFP+, not broken out
- Bandwidth
- Scaled automatically, to 200–400 Gbit/s by location
- Hardware
- Dedicated to balancing
Security
- DDoS filtering
- Always on
- WAF
- Custom rules
- TLS termination
- On the balancer
- Certificates
- Let’s Encrypt or ZeroSSL, renewed for you
Traffic
- Protocols
- HTTP/3 · HTTP/2 · HTTP/1.1
- Headers
- Passed through to the backends
- Backends
- Unlimited
- Health checks
- Path, status, body, header, latency
- Thresholds
- Fall and rise counts
- Reconfiguration
- Instant
Billing
- Websites
- €1.10 each, a month
- WAF rules
- €0.80 each, a month
- TLS handshakes
- €0.01 per handshake/s
- Traffic
- €1.50 per TB
- Pay as you go
- €5.00 a month, no limits
- Backends
- Free, unlimited
Common questions
Should I put my static site or ASP.NET Core app behind one?
No. Our static, dynamic, and ASP.NET Core hosting already runs behind these balancers, with the same filtering and uplinks. Another Load Balancer in front would add a second hop and bill the traffic twice without adding any protection. It’s for machines you run yourself.
Limits or pay as you go?
With the sliders, you set a handshake rate and a monthly traffic volume, and the balancer stays within them. The invoice matches the price you saw, and raising a limit takes effect immediately. Pay as you go is for traffic you can’t predict. For €5.00 a month, there are no limits, and handshakes and traffic are billed as they happen at the same rates.
What counts as a website?
A domain the balancer answers for, with its own certificate and its own set of backends. Two domains pointing at the same backends are two websites. One domain with ten backends is one website.
What is a TLS transaction, and how does the 95th percentile work?
A TLS transaction is a handshake: a browser opening a new encrypted connection. Requests on a connection that’s already open don’t count. We measure the handshake rate every five minutes and ignore the busiest 5% of those measurements, about 36 hours a month. With a limit set, those peaks don’t count against it. With pay as you go, you’re billed for the highest rate that’s left. Either way, a short peak like a launch day costs nothing extra.
How is the firewall billed?
€0.80 a month for each custom rule. The firewall is included in every balancer, so a balancer without rules pays nothing for it.
Why is there no limit on backends?
Because a backend doesn’t cost us anything that traffic and handshakes don’t already cover, so we don’t charge for backends or cap them.
What does “from 40 Gbit/s” mean?
Every balancer starts on a full 40 Gbit/s QSFP+ port, which is 40 times a compute unit’s own uplink. The network scales automatically, and some locations run their balancers at 200 or 400 Gbit/s. You don’t choose or pay for bandwidth. You pay for traffic and handshakes.
How fast do changes take effect?
Immediately. Adding or removing a backend, changing a health check, adding a firewall rule or a website, and raising a limit all take effect when you save. There’s no apply step and no reload window.
Not sure what it would cost?
Tell us what your machines serve and how much traffic they get, and we’ll give you a price before you set anything up.