FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Advanced

What is Direct Server Return (DSR); what preparation is needed on the server side? ​

Short answer

Direct Server Return (DSR) is the default LB Mode of the Network vService: the request goes to the server through TR7, and the server sends the response directly to the client, bypassing TR7; the client IP is preserved and the return traffic does not pass through TR7. The servers must be on the same L2 network as TR7, must carry the vService address as a local address but must not respond to ARP for this address, and must provide the service on the vService's port; the port is not translated. It is applied only on TCP - L4 and UDP - L4 vServices with Port Range off.

How Does It Work? ​

  1. The client connects to the vService address (VIP, e.g. 192.0.2.100); TR7 selects the server according to the algorithm.
  2. TR7 forwards the packet without changing its destination IP and port, only directing it at L2 to the server's MAC address.
  3. The server accepts the packet as if it had arrived at its own local VIP address.
  4. The server sends the response directly to the client (through its own default gateway) with the VIP as the source address; the response does not pass through TR7.
Direct Server ReturnRoute ModeSNAT
Source seen by the serverClient's IPClient's IPSNAT IP on the vService
Response pathServer → client (no TR7)Server → TR7 → clientServer → TR7 → client
Same L2 networkRequiredNot requiredNot required
Port translationNoneYesYes

Server Preparation ​

TR7 does not check the configuration of the servers; the preparation is done on the server side. If the preparation is not done, the packets remain unanswered. A common configuration for Linux (VIP 192.0.2.100 in the example):

text
ip addr add 192.0.2.100/32 dev lo
sysctl -w net.ipv4.conf.all.arp_ignore=1
sysctl -w net.ipv4.conf.all.arp_announce=2
  • The VIP is added to the loopback interface as /32; the server accepts the packets arriving at the VIP.
  • arp_ignore=1 makes the server give ARP responses only for addresses defined on the incoming interface, and arp_announce=2 makes the most suitable local address be used in ARP requests; this way the server does not give an ARP response for the VIP (Linux ip-sysctl). For the settings to be persistent, they are also written to the sysctl configuration file.
  • The service must listen on VIP:port (or on all addresses).
  • TR7's health check goes to the server's own address (the Address field of the Backend Service); the service must also respond at this address, otherwise a suitable address is checked with Use Different IP for Health Check.

In TR7 ​

  • Location: Load Balancer → Load Balancer vService List → Network vService → Edit → LB Mode → Direct Server Return (default on a new Network vService).
  • Scope: It is applied on the TCP - L4 and UDP - L4 protocols while Port range is off. While Protocol is ANY - L3 or Port range is on, the LB mode is not applied; the traffic is routed through TR7 (if a SNAT IP is selected on the vService, the source address is translated).
  • Health status: On TCP - L4 / UDP - L4 vServices with Port range off, it is reflected in the distribution (Health status and distribution).
  • Saving: On a Network vService, every save restarts the vService; the change is made at a low-traffic time.
  • When it is selected: To remove the return load from TR7 in traffic where the responses are much larger than the requests (e.g. media, file downloads) (Choosing the LB Mode: how do I decide between DSR, Route Mode and SNAT?).

Common Misconceptions ​

  • "The Backend Service can listen on a different port." In DSR, the port is not translated; the server must listen on the vService's port.
  • "The server can be in a different subnet." DSR requires the same L2 network.
  • "Adding the VIP to a normal interface on the server is enough." If the server gives ARP responses for the VIP, the client traffic goes directly to the server instead of TR7; the ARP response must be blocked.
  • "DSR is done on the ANY - L3 protocol." Although the LB mode can be selected, it is not applied while ANY - L3 or Port range is on.

How it is done in the documentation

Related questions