Multiple Origins & Load Balancing

You manage multiple origin servers under Console → WAF → [your domain] → Servers. Servers are grouped into upstream groups; HEIMWALL distributes traffic across the healthy servers in a group and fails over when one goes down.

Adding an origin

1. Open Console → WAF → [your domain] → Servers. Your default upstream group carries the Default badge.

2. Click + New Origin and fill in the form:

   • URL — http:// or https:// + host:port (e.g. http://10.0.0.5:8080)
   • Weight — 1–9, default 5. Higher weight receives more traffic.
   • Label — optional identifier (e.g. “frankfurt-1”)
   • Insecure — check to skip TLS validation if the origin uses a self-signed certificate.

3. Enable Health Check in the same modal (see below) and save.

4. Repeat for your second and third servers. The group list shows each server’s health: green (up), red (down), yellow (checking).

Load balancing mode

With 2+ servers in a group you can choose between three modes:

• Round-robin (default) — requests are distributed in turn, respecting weights.
• Least connections — the server with the fewest active connections is picked.
• Failover — traffic goes to the first healthy server; the others stand by as backups.

Health checks

Configure these in the health check modal for each server:

Setting	Default	Description
Check path	e.g. /health	Path the probe requests
Interval	30 s	How often a healthy server is probed
Timeout	5 s	Maximum wait per probe
Expected status	200	HTTP codes treated as healthy
Fail threshold	3 consecutive	Consecutive failed probes required to mark the server down

A single failed probe does not take a server down — only when the threshold of consecutive failures is reached is the server disabled, and traffic flows to the remaining healthy servers. When the server recovers, the health check re-enables it automatically.

Note

The health check only re-opens servers that it closed. If you disabled a server manually, it stays off until you enable it manually.

How failover works

• If a TCP connection to an origin fails, the request is retried on the next healthy server in the same group (a single retry per request).
• If the origin returns a 5xx, there is no retry — the response is passed through as-is. Use the health check threshold and Failban to react to 5xx errors.
• Failover works only within the same upstream group; there is no cross-group failover.

Rule-based origin selection

To route specific traffic to a different upstream group, use the Origin action in the rule engine with the group name as its parameter. Example: add the action origin: api-group to the condition http.request.base_uri has_prefix "/api". If no rule matches, the default group is used.

Origin timeout

The time allowed for the origin to start responding defaults to 100 seconds (range 10–600 s). This value is a ceiling: for paths that must respond quickly, set a shorter timeout with the OriginTimeout rule action — a rule cannot exceed the domain ceiling.

Verification

1. On the Servers page, check that all servers show green (up) — the group header shows an “X/N up” summary.
2. To test failover, stop one origin temporarily; once the fail threshold is reached the server turns red and traffic keeps flowing through the other servers without interruption.

Load BalancingDistribution algorithms and weights.

Health ChecksProbe settings and notifications.