Traffic
TCP and UDP proxying
Everything else on this site is about web traffic. This page is about the rest: a protocol that speaks for itself, where all you need is a port to listen on and somewhere to send the connections.
How it differs from a site
There are no paths, no error pages and no redirects, because those are web ideas and this is not the web. What you get is a port to listen on and a pool to send connections to. Health checks still apply, and so do the balancing methods.
Making one
- Make a pool with the backend servers in it. Stream pools are separate from the pools sites use.
- Go to TCP & UDP and press Add one.
- Choose TCP or UDP. If you are not sure, it is TCP.
- Say which port to listen on.
- Choose the pool, then save and apply.
Pools are kept separate
Pools used here are separate from the pools used by sites, even when the servers in them are the same machines. That is a rule in nginx, not a choice made here, so you will see the same addresses listed twice and that is correct.
Passing on the visitor's address
By default your backend sees the connection as coming from the load balancer, because it is. If your application needs the real client address, turn on the proxy protocol setting.
Only if the backend understands it
Proxy protocol adds a short header before the connection data. A backend that does not expect it will fail to read the connection at all, and the failure looks like the service being completely broken rather than like a setting being wrong.
What people actually use this for
| Service | Protocol | Notes |
|---|---|---|
| PostgreSQL or MySQL read replicas | TCP | Use least connections. Long lived connections make round robin uneven. |
| SMTP, IMAP or POP3 | TCP | Proxy protocol if your mail server supports it, so logs show the real sender. |
| DNS resolvers | TCP and UDP | Two services, one per protocol, pointing at the same pool. |
| Game servers | UDP | Watch the health check type. A connection check means little for UDP. |
| Redis | TCP | Only for read replicas. Balancing writes across a cluster is not something a proxy can fix. |
Common questions
Can I terminate TLS for a stream service?
Yes, nginx is built with the stream TLS module. You pick a certificate the same way a site does.
Does the health checker work for UDP?
It can open a socket and it can check a TCP port on the same host. A meaningful UDP health check depends entirely on the protocol, so check a companion TCP port where one exists.
Can two services share a port?
No. One listen port belongs to one service, the same as in nginx itself.
Step by step instructions
The how to section has searchable, task shaped answers. Search it for tcp.
Related features
Backend pools
The list of servers behind a site, and how traffic is shared.
Read moreActive health checks
Probe every backend on a schedule and pull the dead ones out.
Read moreTLS settings
Protocols, ciphers, stapling and HTTP/2 or HTTP/3.
Read moreLoad balancing methods
Round robin, least connections, hashing and consistent hashing.
Read more