Load Balancing

Console → WAF → [your domain] → Origin Servers — add servers to each upstream group, and configure Load Balancer and Connection Failover.

---

Upstream groups

Traffic always goes to the default upstream group. When you have more than one group, the others only receive traffic via the “Select Origin” action in rules — for example, requests starting with /api go to the API group, and everything else goes to the web group.

Each group can hold up to 16 servers.

---

Load Balancer — traffic distribution mode

Load Balancer is configured separately for each upstream group.

Mode	How it works
On (Active-Active)	Requests are distributed round-robin across all healthy servers in the group according to their weights.
Off (Active-Passive)	Traffic goes to the first server in the list; if it goes down, the next healthy server takes over.

Weight: Each server is assigned a weight from 1 to 9. A server with weight 3 receives approximately 3× more requests than one with weight 1. Weight only has an effect when Load Balancer is on. At least 2 servers are required to enable Load Balancer.

---

Connection Failover

If a TCP connection to a server cannot be established — connection refused, server unreachable, or connection timeout — the request is automatically moved to the next healthy server in the same group. The visitor sees no error.

Note

Connection Failover only recovers requests that failed before a connection was established. If the connection succeeded but the server returns 5xx, drops the connection, or responds slowly, that is not covered — the response is forwarded to the visitor as-is. This is intentional: if a server never received the request, retrying is safe; if it did, retrying risks duplicate processing.

At least 2 servers are required to enable Connection Failover.

---

Using with Health Checks

Load Balancer and Connection Failover work together with Health Checks:

• Health Checks probe servers periodically; unhealthy servers are removed from the pool and re-added when they recover.
• Connection Failover catches connection failures in the window between health check intervals, before a server is marked unhealthy.
• Load Balancer distributes traffic only among healthy (active) servers.

---

Multiple upstream groups — example scenarios

Separate API and web traffic: Route requests starting with /api to a dedicated API server group via a rule, and leave the rest to the web group. Each group scales independently.

Route more traffic to a stronger server: Assign higher weights to more powerful machines in the same group — they receive proportionally more requests.

Active-passive setup: Load Balancer off + Connection Failover on. Traffic always goes to the first server; if it fails a TCP handshake, the request moves to the next one automatically.