When scaling web applications or backend services on Ubuntu Server, administrators typically deploy Layer 7 reverse proxies such as Nginx or HAProxy. While these software load balancers are incredibly feature-rich—offering SSL termination, URL routing, and deep packet inspection—they suffer from a significant performance bottleneck. Because they operate at the application layer, they must establish full TCP connections with the client, read the request, and then establish a second TCP connection to the backend server. Under massive traffic loads, this architecture consumes significant CPU and memory resources.
For environments requiring extreme throughput and minimal latency, administrators should implement Layer 4 load balancing using IP Virtual Server (IPVS). Built directly into the Linux kernel as part of the Netfilter framework, IPVS routes traffic based entirely on IP addresses and TCP/UDP ports. It modifies network packets in-flight without ever establishing a full connection socket, allowing a single Ubuntu server to balance hundreds of thousands of concurrent connections with virtually zero overhead.
Installing the IPVS Administration Tools
Because the IPVS module is already compiled into the standard Ubuntu Linux kernel, you do not need to install a heavy service daemon. You only need to install ipvsadm, the user-space command-line utility used to construct and modify the kernel’s load balancing tables.
sudo apt update
sudo apt install ipvsadmDuring the installation, you may be prompted to choose a startup method. For manual configuration, you can select “none”.
Understanding IPVS Forwarding Methods
Before configuring the virtual server, you must choose a routing architecture. IPVS supports three distinct forwarding methods:
- NAT (Network Address Translation): The IPVS server acts as a gateway. It rewrites the destination IP address of incoming packets to the backend server’s IP, and rewrites the source IP of outgoing packets back to the virtual IP. This is the easiest to configure but limits maximum throughput since all return traffic must flow back through the load balancer.
- Direct Routing (DR): The IPVS server forwards the packets directly to the backend servers via their MAC addresses. The backend servers process the request and reply directly to the client, entirely bypassing the load balancer on the return path. This offers massive scalability but requires the backend servers to be on the same physical subnet and configured to silently accept traffic destined for the Virtual IP.
- IP Tunnelling (TUN): Similar to DR, but packets are encapsulated within an IP tunnel, allowing backend servers to be located on entirely different geographic networks.
For this guide, we will configure a NAT-based load balancer, which is the most common starting point.
Configuring the Virtual Server and Backend Pool
To configure IPVS, you first define the Virtual Service (the public IP and port the clients will connect to), and then you add the Real Servers (the backend application servers) to that service.
Assume your Ubuntu load balancer has a public IP of 203.0.113.50, and you have two backend web servers on a private subnet: 10.0.0.10 and 10.0.0.11.
First, create the Virtual Service for TCP port 80 (HTTP), using the Round Robin (-s rr) scheduling algorithm:
sudo ipvsadm -A -t 203.0.113.50:80 -s rrNext, add the two Real Servers to this pool, specifying the NAT forwarding method (-m) and assigning them equal weight:
sudo ipvsadm -a -t 203.0.113.50:80 -r 10.0.0.10:80 -m
sudo ipvsadm -a -t 203.0.113.50:80 -r 10.0.0.11:80 -mEnabling IP Forwarding
Because the NAT method requires the Ubuntu server to route packets between two different network interfaces (public and private), you must enable IPv4 forwarding in the kernel. Without this step, the kernel will simply drop the packets.
Open the sysctl configuration file:
sudo nano /etc/sysctl.confUncomment or add the following line:
net.ipv4.ip_forward=1Apply the changes immediately:
sudo sysctl -pVerifying and Persisting the Configuration
To view the current IPVS routing table and verify that connections are being distributed to your backend servers, use the list command:
sudo ipvsadm -L -nBecause ipvsadm modifies the running kernel, all configurations are instantly lost if the Ubuntu server reboots. To make the rules persistent, you must save the current table to a file and configure the ipvsadm systemd service to restore it on boot.
sudo ipvsadm-save > /etc/ipvsadm.rulesEnsure the ipvsadm service is enabled to run at startup:
sudo systemctl enable ipvsadmBy shifting the load balancing workload from user-space applications down to the kernel level, IPVS provides unmatched efficiency, allowing a modest Ubuntu server to effortlessly distribute traffic across massive backend clusters.