Reverse TCP Proxy Load Balancing for Firewall-Isolated Clusters

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing load balancing systems struggle to provide high-availability workload balancing over reverse connections, especially when direct network connectivity between a management system and a cluster is not possible, such as when the cluster is on an internal network behind a firewall.

Innovation Solution

A framework for workload balancing over reverse connections that enables clients on external networks to access clusters on internal networks with high-availability and load balancing capabilities, using a reverse TCP proxy over WebSocket to bypass firewall restrictions and manage clusters without direct access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If a reverse connection is used to access internal network clusters from external networks, then firewall restrictions are bypassed and external access is enabled, but high-availability load balancing capabilities are lost

Engineering Contradiction:

Improveexternal network access capabilityVSAvoidhigh-availability load balancing

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

A reverse TCP proxy is introduced as an intermediary component that sits on the external network and maintains a persistent reverse connection to the internal cluster. This proxy mediates all client requests, forwarding them through the reverse connection to the cluster while implementing load balancing algorithms and health checking mechanisms. The proxy acts as a bridge that preserves high-availability capabilities despite the restrictive firewall environment.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system is segmented into multiple components: the reverse TCP proxy on the external network, the reverse connection tunnel, and the internal cluster. This segmentation allows the load balancing functionality to be distributed between the proxy and cluster components, enabling high-availability features to function even though the reverse connection itself is a single point of entry. Multiple backend cluster nodes can be managed independently through this segmented architecture.

Inventive Principle:

Principle #1Segmentation

2Reliability

If direct network connectivity is required for load balancing, then high-availability capabilities are maintained, but firewall restrictions prevent external network access

Engineering Contradiction:

Improvehigh-availability load balancingVSAvoidexternal network access capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

Instead of having external clients directly connect to internal cluster nodes (which would require inbound firewall rules), the connection direction is inverted. Internal cluster nodes initiate outbound connections to establish the reverse TCP proxy connection. This inversion allows the internal network to主动 reach out externally, bypassing traditional firewall restrictions while maintaining load balancing control.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

A reverse connection tunnel is established in advance before any client requests arrive. This preliminary action creates a pre-configured communication channel that persists and can handle multiple requests. The tunnel is set up with all necessary authentication and routing information beforehand, enabling subsequent load balanced requests to flow through without requiring real-time firewall negotiations.

Inventive Principle:

Principle #10Preliminary action

3Adaptability or versatility

If a reverse TCP proxy is implemented to enable external access, then firewall restrictions are overcome, but system complexity increases

Engineering Contradiction:

Improveexternal network access capabilityVSAvoidsystem architecture

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The reverse TCP proxy is designed to perform multiple functions within a single component: it handles load balancing across multiple cluster nodes, implements health checking, manages the reverse connection tunnel, and provides authentication. By consolidating these functions into one universal proxy rather than separate systems, the overall architecture complexity is reduced despite the added capability of external access through reverse connections.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12549626B2Method and system for high availability load balancing over a reverse connection

Publication Date: 2026.02.10 DELL PROD LP

AI summary

A method for managing workload balancing over a reverse connection includes: receiving a request from a user that wants to access a cluster to initiate performing a workload, sending a call to a proxy service; upon receiving the call: sending a message to an agent executing on a first targeted IHS in the cluster; initiating a TCP server hosted by the proxy service; making a determination that a first targeted IHS is not down; receiving, based on the determination, a response from the agent indicating that a tunnel has been established; after receiving the response from the agent, sending, a second response to the client to indicate that the tunnel is ready to use; initiating a TCP connection to the TCP server; receiving, via the TCP connection, data associated with the workload from the client; and transferring the data to the agent over the reverse connection.