Can the Backend Service port be different from the frontend port (sending a request received on 443 to 8080)?

Short answer

Yes; this is TR7's default behavior. HTTP and L7 TCP vServices receive requests on their own port and connect to the Backend Service on the port in the Address field. To send a request received on 443 to 8080, the Backend Service's port is written as 8080 and Use Frontend Port is left off (default); if 8080 is plain HTTP, the vService terminates TLS on 443 and SSL Service stays off on the Backend Service. On a Network vService, the port is not translated if Port Range is on, if Protocol is ANY - L3, or if LB Mode is Direct Server Return.

Problem: The Application Runs on a Non-Standard Port

Application servers often run on ports such as 8080, 8443 and 3000, while users are expected to access them from the standard ports (80/443). Instead of doing the port translation on the server, TR7 needs to receive the requests on the standard port and forward them to the server's own port.

Solution: Three Methods

The port is in the same field in a single Backend Service and in a Backend Group row; the same field is also written on the command line.

Your situation	Suitable method
I use a single Backend Service	Method 1: Backend Services form
I use a Backend Group (the rows can be on different ports)	Method 2: Backend Group row
I want to do it from the command line	Method 3: WEB-CLI

Method 1: Backend Services Form Recommended

• How it works TR7 connects to the Backend Service on the port in the Address field; the vService's port is only the client side.
• Where it is openedLoad Balancer → Backend Services → Add or Edit → Address
• Requirement Use Frontend Port off (default)
• vService type HTTP and L7 TCP; on a Network vService there are exceptions

Step-by-Step Configuration

1

Adım 1 Open the form

On the Load Balancer → Backend Services screen, the Backend Service is selected and Edit is clicked; for a new record, Add is used.

2

Adım 2 Enter the port

8080 is written in the port part of the Address field.

3

Adım 3 Check Use Frontend Port

The Details switch is turned on; Use Frontend Port must be off (its default value is off). If it is on, the port in the Address field is ignored and the connection is made to the port on which the request arrived.

4

Adım 4 Set SSL Service according to the server

If 8080 is plain HTTP, SSL Service stays off. If the server expects TLS on a port such as 8443, SSL Service is turned on.

5

Adım 5 Save the Backend Service

The Edit (Add for a new record) button at the bottom of the form is clicked. If the Backend Service is already used on the vService on 443, the configuration is completed with this step.

6

Adım 6 Add to the vService (if needed)

If the Backend Service is not in the Default Backend Services list of the vService on 443, the vService is selected on the Load Balancer → Load Balancer vService List screen, Edit is clicked, and the Backend Service is added to the list.

7

Adım 7 Save the vService

The Save button at the bottom of the form is clicked. While clustering is on and Manual Sync Mode is off (default), the change is transferred to the peer device automatically.

Verification

1RequestClient side

A request is sent from the client to the vService address.

Commandcurl -vk https://192.0.2.80/

ExpectedThe application's response (200)

2Server portBackend Service side

The connection arriving at 8080 on the server is checked; in TR7, the Address column of the Backend Services list shows IP : 8080.

Commandtcpdump -ni any port 8080

ExpectedConnection from TR7 to 8080

Method 2: Backend Group Row

• How it works Each row of the group has its own port; the rows can be on different ports.
• Where it is openedLoad Balancer → Backend Groups → Add or Edit → Backends
• Requirement Use Frontend Port off in the group (default)
• vService type HTTP and L7 TCP; on a Network vService there are exceptions

Step-by-Step Configuration

1

Adım 1 Open the group

On the Load Balancer → Backend Groups screen, the group is selected and Edit is clicked.

2

Adım 2 Enter the row ports

In the Backends table, 8080 is written in the port part of each row; the port of a new row comes as 80. Use Frontend Port in the group's Details section stays off.

3

Adım 3 Save

The Edit button at the bottom of the form is clicked.

Verification

1Row addressesTR7 side

In the Backend Groups list, the Show Backend Services switch is turned on.

ExpectedIP : 8080 · Health: OK in each row

Method 3: WEB-CLI

• How it works In a single Backend Service the port is given with the addr.port field, and in a group row with the --servers.N.addr.port field.
• Where it is opened TR7 WEB-CLI → lb backend and lb backend-group
• Requirement WEB-CLI access
• vService type HTTP and L7 TCP

Step-by-Step Configuration

1

Adım 1 Add a new Backend Service with 8080

The required fields are written without a prefix and in order; Host for v-device and 1 (DEFAULT route table) for namespace are the default values:

lb backend add name app-1 v-device Host namespace 1 addr.ip 192.0.2.21 addr.port 8080

2

Adım 2 Change the port of an existing Backend Service (if needed)

The ID of the Backend Service is written in place of <id> (Tab lists them; they also appear in the lb backend list output):

lb backend update id <id> --addr.port 8080

3

Adım 3 Write the port of the group row (if a group is used)

In a new group, the servers are written with the --servers.N fields starting from 0:

lb backend-group add name app-grp v-device Host namespace 1 --servers.0.addr.ip 192.0.2.21 --servers.0.addr.port 8080

In an existing group, the port of a row is changed with lb backend-group update id <id> --servers.0.addr.port 8080; .0 indicates the first row in the group, and only the port of that row changes. The row order is seen in the lb backend-group show <id> output.

Verification

1RecordWEB-CLI

The port field in the lb backend show <id> output is checked.

ExpectedPort 8080

Network vService Exceptions

• If Port Range is on or if Protocol is ANY - L3, the destination port on which the client arrived is used for the Backend Service; the port in the Address field is not applied.
• If LB Mode is Direct Server Return, the port is not translated; the server must listen on the vService's port.
• In the Route Mode and SNAT modes (while Port Range is off), the port is translated; the Backend Service's port is used.

Common Mistakes

• Leaving Use Frontend Port on. The 8080 on the Backend Service is ignored, and the connection is made to 443, where the request arrived.
• Turning on SSL Service while the server speaks plain HTTP. TR7 tries to connect to 8080 with TLS, and the connection cannot be established.
• Forgetting to direct the health check to a separate port. By default, the health check probes the Backend Service's address and port (8080); if the application's health endpoint is on another port, Use Different IP for Health Check → Different Address is selected under Details and the IP and port are entered.

How it is done in the documentation

• Backend Services · Port
• Backend Services · Use Frontend Port
• HTTP (L7) vService · Port
• Network vService · Port Range

Related questions

• What does the "Use Frontend Port" option do?
• What does the SSL Service option do; what is needed to connect to the backend over an encrypted connection?
• How is a Backend Service added; which information is required?