Which IPs should I allow on the server firewall for health checks?

Short answer

The health check comes from the address in the Health Check Source IP setting of the Backend Service. In Default, the source address is the Interface IP, in the same subnet as the server (as the gateway if the server is reached over a gateway), of the interface from which the traffic to the server exits in the Route Table of the Backend Service; if Device IP is selected, the selected IP is used. The source address of the data traffic depends on the SNAT setting and is not applied to the health check; both are allowed on the firewall. In a cluster, each device makes the check from its own Interface IP; the addresses of both devices are allowed.

How Does It Work?

Traffic	Source address	Setting
Health Check	Default: The Interface IP, in the same subnet as the server (as the gateway if the server is reached over a gateway), of the interface from which the traffic to the server exits in the route table · Device IP: the selected IP	Backend Service → Details → Health Check Source IP
Data traffic (HTTP, L7 TCP)	Default: the same rule as Default in the health check · Use device IP: the selected SNAT IP · Use client IP: the IPs of the clients	Backend Service → Details → SNAT
Data traffic (Network)	If LB Mode is SNAT, the SNAT IP on the vService; in Route Mode and Direct Server Return, the IPs of the clients	vService → LB Mode / SNAT IP

Example: If there is a 192.0.2.5/24 Interface IP in the route table of the Backend Service and the server is 192.0.2.20, in Default the check comes from 192.0.2.5. Which IP is in which interface and route table is seen on the Network → Interfaces screen.

Ports and Protocols

• The health check goes to the Address port of the Backend Service, or, if a different address was entered with Use Different IP for Health Check, to that address and port; in Scenario sub-checks, the address entered with HC address is used.
• For the Ping type, ICMP echo is allowed, and for the DNS and UDP types, UDP traffic is allowed.
• The Oracle check goes to the address in the Connection String.
• The Expression (JSONata) type does not send a network request; no firewall rule is required.

In a Cluster Setup

Each TR7 device makes the check itself and shows its result separately; the Health indicator in the Backend Services list consists of two semicircles. Since the network configuration is transferred to the peer device with its own addresses:

• Default: Each device uses its own Interface IP (e.g. device 1 192.0.2.5, device 2 192.0.2.6); the VIP is not used as the source address.
• If an Interface IP is selected as Device IP: Each device uses its own address of this record.

The addresses of both devices are allowed on the server firewall; otherwise, one device sees the server as Error, and the server does not receive traffic while that device is active.

Common Misconceptions

• "Allowing only the VIP is enough." The health check comes not from the VIP but from the Interface IP of the device.
• "The SNAT IP also covers the health check." SNAT is applied only to the data traffic; the source of the health check is the Health Check Source IP field (Which source IP are health check packets sent from; can I change it?).
• "If the server expects the PROXY protocol, the health check also sends a PROXY header." The health check does not send a PROXY header; checking a port that expects PROXY with HTTP or TCP scenario fails.

How it is done in the documentation

• Backend Services · Health Check Source IP
• Backend Services · SNAT
• Backend Services · Route Table
• Backend Services · Health Status Indicator

Related questions

• Which source IP are health check packets sent from; can I change it?
• What does "Default" in the SNAT field mean; can I choose a specific SNAT IP?
• The server is running, but TR7 shows it as down; why?