Firewall – load-balancing difference between DNS and IP – forwarding vs redirecting

firewallfortigate

I have come across a situation that I cannot understand. We have a Fortigate firewall that we have enabled to do load-balancing across two back-end Apache web servers. A DNS name is then mapped to the virtual IP on the Load Balancer.

As expected, when you browse to the DNS name/URL (e.g. www.something.com), the Load Balancer serves up a page from one of the back-end Apache web servers. The URL in the browser stays www.something.com. From what I understand, the Load Balancer in this case is simply forwarding packets between the browser and Apache while always staying in-path.

However, if I browse to the IP address that the DNS is mapped to, then the Load Balancer returns a HTTP 302 Found, with the Location header set to the DNS URL of one of the Apaches. The URL in the browser changes to the back-end server DNS.

Why is the Load Balancer redirecting when queried via IP, but correctly forwarding in-path when queried via DNS name.

Best Answer

I haven't used a Fortigate FW for load balancing, so I will answer some of the questions more generally.

First, as to your problem, the load balancer is doing exactly as it is supposed to do and I think your servers may not be configured correctly to respond to a request on their IP address. If you were to test this behind the load balancing, you could set the domain name in a local client's hosts file, behind the firewall with the server and access it both with domain name and internal IP. You will probably get the same result you are seeing now.

My guess is that you have virtual hosting turned on (to support multiple domains on a single server) and the "default" is not serving the same pages as your domain. You are getting a web page back from the server in both cases. If you need help with configuring your web server, you may want to try on ServerFault.

Second, to get into a bit more detail. A load balancer typically operates at L7 for at least HTTP and HTTPS clusters. This means that they don't just look at the IP address and forward it, nor do they "redirect" the page.

When they receive a request, they actually parse the request and forward it to a server after processing the request. There are many things that they can do at this point, such as rewriting the headers in both directions, potentially adding cookies (for persistence) into the data going back to the client, terminating SSL sessions, matching based on the URL, etc.

I recommend you spend some time fully reading the vendor documents to get a better understanding of how load balancing works (with Fortigate you can read both theirs and Coyote Point - another load balancing company Fortigate acquired). Understanding what it is doing will help you in cases like this and will allow you to unlock capabilities that you didn't realize existed.