Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Can I make a vService listen on a wide port range (e.g. 4000-5000)?
Short answer
Yes. In HTTP and L7 TCP vServices, the range is written directly in the frontend Port field (e.g. 4000-5000); the vService keeps working with all its features, and if the Backend Service is to receive the connection on the port the client came in on, Use Frontend Port is turned on. In a Network vService, the Port Range switch is turned on first, then the range is written. The port range in Network has restrictions: only Round-Robin / Weighted Round-Robin works, LB Mode is not applied, the health check result is not reflected in the distribution, and connections to the Backend Service are made on the port the client came in on.
Problem: Why Does an Application Use a Port Range?
Some applications work on a port range instead of a single port: passive FTP data ports, RTP voice streams that come with SIP, game and media servers, and the like. Opening a separate frontend row for each port is not practical. How the range is defined and which features are preserved depends on the vService type.
Solution: Two Methods
| Your situation | Suitable method |
|---|---|
| TCP application; TLS, rules, health check and all algorithms are to be used | Method 1: Range in an HTTP / L7 TCP vService |
| UDP or distribution at the L3/L4 level is needed | Method 2: Port range in a Network vService |
Method 1: Range in an HTTP / L7 TCP vService Recommended
- How it works The vService listens on all the ports in the range; the traffic is processed as in other vServices.
- Where it is opened vService → Frontend → Port:
4000-5000(HTTP, L7 TCP) - Requirement TCP traffic
- vService type HTTP, L7 TCP
- Backend Service side If the server also listens on the same ports, Use Frontend Port is turned on in the Backend Service; if it is not turned on, all connections go to the single port in the Address of the Backend Service.
Step-by-Step Configuration
1
Adım 1 Open the Backend Service edit form
On the Load Balancer → Backend Services screen, the Backend Service is selected and the Edit button is clicked (if none exists, it is created with Add).
2
Adım 2 Turn on Use Frontend Port
If the server is to receive the connection on the port the client came in on, Use Frontend Port is turned on in the Details section of the form.
3
Adım 3 Save the Backend Service
The Edit (Add for a new record) button at the bottom of the form is clicked.
4
Adım 4 Open the vService form
On the Load Balancer → Load Balancer vService List screen, the HTTP or L7 TCP vService is selected and the Edit button is clicked; for a new vService, the form is opened with Add.
5
Adım 5 Write the range in the Port field
The range is written in the Port field of the frontend row in the start-end format (e.g. 4000-5000). The start must be smaller than the end; a comma-separated list is not accepted. For multiple ranges, separate rows are added.
6
Adım 6 Select the Backend Service
In the Default Backend Services table, the Backend Service prepared in steps 1–3 is selected.
7
Adım 7 Save
The Save button is clicked. In a cluster setup, the change is also transferred to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent manually with Synchronize.
Verification
1By connecting to a port in the rangeClient side
Command
nc -vz 203.0.113.30 4500Expected
Connection to 203.0.113.30 4500 port [tcp/*] succeeded!Method 2: Port Range in a Network vService
- How it works The destination address of the packets arriving at the range is translated to the Backend Service; the destination port is preserved. Distribution is done only with Round-Robin / Weighted Round-Robin, and the traffic is routed through TR7.
- Where it is opened vService → Type: Network → Port Range switch → Frontend Port:
4000-5000 - Requirement The Backend Service listening on the same ports
- vService type Network (TCP - L4, UDP - L4)
- Backend Service side The server listens on the client's destination port. If no SNAT IP was selected, the return traffic of the servers must pass through TR7 (the server's gateway is TR7).
Step-by-Step Configuration
1
Adım 1 Open the Backend Service add form (if none exists)
On the Load Balancer → Backend Services screen, the Add button is clicked (How is a Backend Service added; which information is required?).
2
Adım 2 Enter the server information
Backend Service Name and Address are entered, and the vService's route table is selected as the Route Table. The port in Address is not used in this method.
3
Adım 3 Save the Backend Service
The Add button at the bottom of the form is clicked. Steps 1–3 are repeated for each server.
4
Adım 4 Open the Network vService form
The Load Balancer → Load Balancer vService List → Add steps are followed; Name is entered and Network is selected as the Type.
5
Adım 5 Select the Protocol and turn on Port range
TCP - L4 or UDP - L4 is selected as the Protocol, and the Port Range switch is turned on (off by default). While the Protocol is ANY - L3, Port range is hidden.
6
Adım 6 Write the range
The range is written in the Port field of the frontend row. If a range is entered while the switch is off, the Invalid port error appears. If the IP is not in the list, it is first added with Network → Interfaces → Actions → Add IP (Why can't I type the Frontend IP manually; what should I do to use an IP that is not in the list (e.g. IPv6) on a vService?).
7
Adım 7 Select the Backend Services
In the Default Backend Services table, the Backend Services added in steps 1–3 are selected. If the return traffic does not pass through TR7, SNAT is selected in the LB Mode field and the SNAT IP is determined; while Port range is on, the only part of LB mode that is applied is the use of the SNAT IP as the source address.
8
Adım 8 Select the algorithm
The Details switch at the top right of the form is turned on; Round-Robin or Weighted Round-Robin is selected in the LB Algorithm box. In this mode, Round-Robin is applied even if another algorithm is selected.
9
Adım 9 Save
The Save button is clicked. In a Network vService, each save restarts the vService; the change is made at a low-traffic time. In a cluster setup, the change is also transferred to the peer device with the default auto-sync.
Verification
1By capturing packetsBackend Service side
Command
tcpdump -n port 4500 · on the client nc -vz 203.0.113.30 4500Expected
The packet reaches the Backend Service on port 4500Common Mistakes
- Relying on the health check in Network. While Port range is on, the health check result is not reflected in the distribution; a failed Backend Service continues to receive packets.
- Expecting a different Backend Service port in Network. With Port range, connections to the Backend Service are always made on the port the client came in on; the port in Address is not used.
- Relying on LB mode in Network. While Port range is on, Direct Server Return and Route Mode are not applied; the traffic is routed through TR7, and the source address is translated only if a SNAT IP is selected.
- Using it together with HTTP/3. In an HTTP vService, the
alt-svcheader is not added on a row where a port range is entered; there is no switch to HTTP/3.
How it is done in the documentation
