The Load balancer tab publishes a service on a domain name, terminates HTTPS for it, and routes it to one or more workloads on the private network. It is built on Traefik and issues free Let's Encrypt certificates.
A route has two parts: a domain (the route) and the backends it sends traffic to.
1. Add a route (a domain)
Select Add route and set:
| Field | What it means |
|---|---|
| Domain | The hostname to serve, such as shop.example.com |
| Path prefix | Optional. Restrict the route to a path, such as /api |
| Terminate HTTPS | Issue a free Let's Encrypt certificate and serve on HTTPS. On by default |
With Terminate HTTPS on, the route is served on port 443 with an automatic certificate, and plain HTTP on port 80 is redirected to it. With it off, the route is served as plain HTTP on port 80.
Point the domain here first
Create an A record for the domain pointing at the firewall's public address, shown on the Overview tab. The certificate is issued only once the domain resolves to the firewall, so set the DNS before you expect HTTPS to work.
2. Add backends
A route needs at least one backend, the workload it sends traffic to. Select the route and Add backend:
- If the workload is a LayerOne application on a network the firewall also serves, pick it from the Application list. The firewall resolves its current private address for you and keeps up when the app moves.
- Otherwise choose Enter an address instead and give the Address on one of the firewall's private networks, the Port, and the Scheme (HTTP or HTTPS).
Add more than one backend to a route to spread traffic across them in a round-robin pool.