The site stays up
ToutWAF shares the requests between your servers according to the weight of each one, and stops sending requests to a server that fails. Visitors never notice the switch.
Load balancing
Several servers behind one site: ToutWAF shares the requests, stops using a server that fails, and lets you update without cutting a single request. The details are here, with what is free and what needs a licence.
What it is for
A site rarely needs just one server. With a group of servers behind ToutWAF, a failure, an update or a traffic peak stops being an incident.
Update without cutting anything
Put a server in maintenance: it receives no new request, the ones in progress finish normally, and it takes its load back gradually.
Release with confidence
Send a share of the requests to the servers of the new version (canary), switch everything at once (blue/green), and go back by setting the share to 0 %.
Route by the kind of request
Send /api, a host name, a header, a method, a country or an A/B test share to its own group of servers.
Protect your servers
Time limits, safe retries and a circuit breaker: ToutWAF stops sending traffic to a server that fails too often, tries it again later, and answers fast instead of keeping visitors waiting.
Several ToutWAF nodes
Take a node out of the rotation without cutting a request, and check what your DNS really answers.
How ToutWAF picks a server
Each site has a list of servers (origins), each with a weight from 1 to 1000. For every request, ToutWAF keeps only the servers that are available, then applies the algorithm you chose.
Available servers only
A server is a candidate unless it is in maintenance, marked down by the active check, set aside by the passive check, or behind an open circuit breaker.
Backup servers last
A backup server is used only when no main server is available.
A lone server is never cut off
A site with a single main server is never marked down by the checks: its requests always go to it, unless it is in maintenance or its breaker is open.
Seven ways to share the requests
The weighted round robin, the default, is free. The other algorithms are chosen per site in the console, with the “Load balancing algorithm” setting.
- Weighted round robin (default) — Proportions are exact over a full cycle, servers are interleaved, and a server that fails and returns takes its share back without a burst.Free
- Least connections — The server with the fewest requests in progress compared with its weight.Pro and above
- IP hash — The same address always reaches the same server (in IPv6, the /64 prefix).Pro and above
- Consistent hash — You choose the key: address, URL path, a header or a cookie. When a server fails only its keys move, and they come back with it.Pro and above
- Random — Random draw, weighted by the weights.Pro and above
- Two choices — Two servers drawn at random (weighted): the less loaded one wins.Pro and above
- Fastest — Two servers drawn at random (weighted): the winner has the lowest recent response time (which follows peaks) times requests in progress, relative to weight. A server with no measure yet is tried.Pro and above
“Fastest” follows the response time measured by the node; it does not measure the distance between the visitor and the node. Weights go from 1 to 1000: a server of weight 3 receives three times more requests than a server of weight 1.
Health checks and retries
Active check
Pro and above
ToutWAF asks each server: a path such as /health, or a plain TCP connection; GET or HEAD; the response codes you expect; the number of failures before “out of service” and of successes before it returns; an optional Host header. A server that comes back is used again automatically.
Passive check
Free
Live requests that fail (connection error, timeout, 502, 503, 504, or a response slower than a limit you set) take the server out of the rotation for a while.
Safe retries
Free
A request that fails is replayed on another server, but only when it is safe: a POST that may have reached a server is never replayed, nor is a large streamed upload.
Circuit breaker
FreePro and above
On by default for everybody. When a server fails too often within a time window, ToutWAF sets it aside, answers fast instead of keeping visitors waiting, then lets a single test request decide whether it comes back. By default: a 30-second window, at least 20 requests, half of them failing, 15 seconds aside. These values can be tuned (licence).
Keep a visitor on the same server
Pro and above
Name a cookie and ToutWAF pins each visitor to the server that served them first. The cookie holds an opaque identifier of the server, never its address; it is HttpOnly, SameSite=Lax and Secure over HTTPS. You choose its lifetime, or it ends with the browser.
- If the server fails or goes into maintenance, the visitor is sent to another server and receives a new cookie.
- Without a cookie: IP hash, or consistent hash on an existing header or cookie, also keeps a visitor in place, on every node.
Maintenance without cutting a request
Pro and above
From the console, put a server (or a whole node) in maintenance. Nothing is cut: visitors are served by the others.
Start the maintenance
No new request is sent to the server any more, even to visitors carrying the persistence cookie.
Requests in progress finish
Downloads, event streams and WebSocket connections run to completion; the console shows how many remain.
Work on the server
The console tells you when nothing is left in progress.
Gradual return
Back in service, the server receives a growing share of its weight over the number of seconds you set (slow start), instead of everything at once.
The last server in service cannot be put in maintenance: add another one first.
Canary and blue/green releases
Pro and above
Give the servers of the new version a group name (for example green), then choose that group and its share of the requests, from 0 to 100 %. The share counts requests, whatever the number of servers in each group.
- Canary: start with a small share and raise it as you gain confidence.
- Blue/green: 100 % switches everything at once, 0 % goes back.
- With a hashing algorithm, a visitor stays on the same side while the share does not change, and raising the share never sends them back.
- If every server of a group is down, the other group serves everything: no request is lost.
Route pools: a group of servers per kind of request
Free
A route sends the requests that match it to a pool of its own. It can match a path, a host name, a header, a method, the country of the visitor or an A/B test share.
- The servers of a pool have the same options as those of a site: weight, backup, group, maintenance.
- A route can choose its own algorithm; everything else (health checks, retries, circuit breaker, gradual rollout) is inherited from the site.
- Each route has its own persistence cookie: a visitor who moves from one pool to another keeps their session.
- A route can also redirect or answer directly.
- A list of routes that cannot be read is refused with an error message; the previous policy stays in place, instead of silently dropping routes.
Example of a route, in the site's “Routing rules” setting
JSON
[{"name": "api",
"match": {"path_prefix": "/api"},
"origins": [
"http://10.0.0.7:8080",
{"url": "http://10.0.0.8:8080", "weight": 3},
{"url": "http://10.0.0.9:8080", "backup": true}]}]Several ToutWAF nodes
FreePro and above
When several nodes protect the same sites, visitors reach them through a DNS name that lists their addresses, a virtual address (VRRP, for example keepalived) or a load balancer of your own. ToutWAF does not change your DNS and does not move addresses: it shows what is true and lets a node leave the rotation cleanly.
- The state of each node: in service, degraded (a site has no working server from that node), in maintenance, offline or disabled.
- The DNS records that match the nodes in service (a short TTL is proposed: 60 seconds), compared with what your DNS really answers: missing node, stale record, unknown address, or a Cloudflare-type proxy recognised.
- A node in maintenance answers 503 on its readiness check (/readyz), the one that keepalived or a balancer tests, asks its connections to move away (GOAWAY on HTTP/2, Connection: close on HTTP/1.1) and lets the requests in progress finish.
- Example keepalived files ship with the product (deploy folder).
Not yet tried in real conditionsNode maintenance is tested automatically, but the move of a real keepalived virtual address between two nodes has not yet been tried in real conditions.
What ToutWAF does not do: manage your DNS, move a virtual address, or share the load between nodes by itself. The number of nodes follows your plan (see pricing).
The connection to your servers
Free
The settings of the link between ToutWAF and your servers are free: no licence is needed.
- Connect and response time limits, keep-alive connections.
- HTTP/1.1, negotiated HTTP/2, or h2c to http:// servers (gRPC is detected automatically).
- TLS to the server is verified, with your own certificate authority, and a client certificate (mTLS) is presented to the server.
Cache, compression, rewrites, redirects, error pages and the real address of the visitor are part of traffic delivery too. See the details
In the console
Sites, your site, Servers tab: the list of servers with their live state, maintenance and settings. Fleet and licence, Balancing tab: the state of the nodes, the DNS records and their check.
https://waf.example.com:9443
Servers and load balancing
| State | Server | Group | Weight | Backup |
|---|---|---|---|---|
| In service | http://10.0.0.11:8080 | blue | 3 | - |
| In service | http://10.0.0.12:8080 | blue | 1 | - |
| In maintenance | http://10.0.0.13:8080 | green | 1 | - |
| Ramping up | http://10.0.0.14:8080 | green | 1 | - |
| In service | http://10.0.0.15:8080 | - | 1 | yes |
Progressive rollout
Group green receives the share of the requests you chose.
Illustration: the addresses are examples.
Use cases
A shop that must stay up
Two servers share the load; a third, a backup, takes over only if both fail.
Update in the middle of the day
One server goes into maintenance, requests in progress finish, then it comes back gently.
Try a new version
A small share of the requests goes to the servers of the canary group; you raise the share or go back to 0 %.
An API on its own servers
A route sends /api to a dedicated pool, with its own algorithm, without touching the rest of the site.
Keep logged-in visitors in place
A persistence cookie pins each visitor to their server while it is available.
Take a ToutWAF node out
The node goes into maintenance, its connections move away, your balancer or keepalived removes it, you work on it.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditionFree Included in every offer, including both free offers (Free and Free +)Pro and above Paid offers: visible in the console, locked without a licence. From Pro, unless Agency or Enterprise is shown
Not yet tried in real conditions Works in the product's tests, but has not yet been tried with the real service, system or equipment. The console shows the same note where you set the function up.
- Weighted round robin, backup servers, passive health checks, safe retries and a circuit breakerFree
- Route pools: send a path, host, header, method, country or A/B share to its own group of serversFree
- Timeouts, keep-alive and HTTP/1.1, HTTP/2 or h2c towards the origin; TLS to the origin with your own CAFree
- Several protection nodes: proposed DNS records for the nodes in service and a check of what your DNS answers; keepalived files for a virtual address; ToutWAF manages no DNS Not yet tried in real conditionsFree
- Other algorithms: least connections, IP hash, consistent hash, random, two choices, fastestPro and above
- Session persistence by cookie, address or headerPro and above
- Active health checks and fine tuning of the circuit breakerPro and above
- Maintenance of a server or a node without cutting a single request (drain)Pro and above
- Canary and blue/green rollouts by share of requests, and slow startPro and above
Going back to the default of an advanced option is always possible. What happens when a paid licence ends is described in the pricing FAQ: 48 hours of grace, 48 hours of read-only, then WAF protection is switched off until renewal.
Pricing Read the documentation
Put a shield in front of your applications today
Install it on your own server, or get in touch to talk about licences.