Configure path-based forwarding rules - Server Load Balancer

Feature overview

Forwarding rules for a CLB listener distribute incoming client requests to different backend servers based on domain names and URL paths.

Key features

Domain name-based forwarding

Matching mode: Supports exact match and wildcard match (including single-level and multi-level wildcards). For example, www.aliyun.com is an exact match, and *.aliyun.com and *.market.aliyun.com are wildcard matches.

Matching priority: The matching order is Exact Match > Narrower Wildcard > Broader Wildcard, ensuring the most precise rules are executed first.

The following table shows examples of matching priority. A ✓ indicates a match and an × indicates no match.

Mode	Test request URL	Domain forwarding rule
Mode	Test request URL	www.aliyun.com	*.aliyun.com	*.market.aliyun.com
Exact Match	www.aliyun.com	✓	×	×
Wildcard match	market.aliyun.com	×	✓	×
Wildcard match	info.market.aliyun.com	×	×	✓

URL path-based forwarding

Matching logic: The system uses longest prefix matching based on the URL path. For example, if you configure rules for both /abc and /abcd, a request for /abcde matches the /abcd rule.
Policy combinations: You can configure multiple policies under the same listener and use a combination of domain names and URL paths to implement complex traffic distribution scenarios, such as directing read and write requests to different server groups.

How it works

You can add multiple forwarding rules to a single listener, with each rule associated with a different vServer group. The matching logic is shown in the following figure. If you have not configured any forwarding rules, the load balancer forwards all requests to the default server group configured for the listener. When forwarding rules are configured, the load balancer attempts to match a rule. If a request matches a rule, it is forwarded to that rule's associated server group. Otherwise, the request is sent to the listener's default server group.

Use cases

Microservices architecture: In a microservices architecture, an application consists of multiple independent services deployed on different instances or containers. Path-based routing directs client requests to the specific service instance that handles the corresponding business logic. For example, on an e-commerce platform, user authentication, order processing, and payment requests can be routed to the respective authentication, order, and payment services based on the URL path in the HTTP request.
Read/write separation: For services with high concurrency and strict data consistency requirements, such as order processing, you can implement read/write separation to optimize performance and data security. Read and write operations are handled by different database instances or clusters. Read operations are routed to a read database, while write operations are directed to the write database.
Multi-tenant applications: In multi-tenant applications, independent environments are required to provide service isolation and personalization for different tenants. For example, you can use tenant-specific subdomains to distinguish different entry points and use URL paths to further refine service functions. This approach not only ensures data security and privacy for each tenant but also allows for customized user experiences and interfaces.

Limits

Only Layer 7 HTTP and HTTPS listeners support forwarding rules.
The backend server groups specified in forwarding rules must be vServer groups.
You can add up to 40 domain name and URL forwarding rules to an HTTP or HTTPS listener. For more information, see Limits.

Example scenario

An education platform wants to offer a variety of online learning services, including video courses and an online exam library, through a single domain name. The video service requires high bandwidth and streaming capabilities, while the exam library service requires intensive computation and fast response times. Initially, all services were deployed in a single server group, which led to uneven resource allocation. During peak video streaming hours, the performance of the exam library was affected, degrading the user experience. The high server load during traffic spikes also compromised service stability.

To address this, the platform uses Alibaba Cloud CLB forwarding rules to route traffic based on different URL paths under the same domain name. As shown in the following figure, requests to /video/ are forwarded to the video service vServer group RS1, ensuring sufficient bandwidth and processing power for the video service. Requests to /exam/ are forwarded to the exam service vServer group RS2, optimizing compute resources for fast query responses and submissions. This approach achieves precise routing and ensures that each subservice operates independently.

Prerequisites

You have created a Virtual Private Cloud (VPC) named VPC1 in the China (Shanghai) region, and created two vSwitches, VSW1 and VSW2, in Zone E and Zone G, respectively.
You have created ECS instances ECS01 and ECS02 in VSW1 and VSW2, respectively, and deployed an application service on each. Note: Ensure that the security group rules allow traffic on the ports used by the application services.

The following sample commands show how to deploy the test applications on ECS01 and ECS02:
Sample commands to deploy test services on the ECS instances
Commands for ECS01
```
yum install -y nginx
systemctl start nginx.service
mkdir /usr/share/nginx/html/video
cd /usr/share/nginx/html/video
echo "Hello World ! This is video service." > index.html
```
Commands for ECS02
```
yum install -y nginx
systemctl start nginx.service
mkdir /usr/share/nginx/html/exam
cd /usr/share/nginx/html/exam
echo "Hello World ! This is exam service." > index.html
```
You have created two vServer groups, RS1 and RS2, for your CLB instance, and added ECS01 to RS1 and ECS02 to RS2. The backend server port must match the application service port. This example uses the NGINX default port 80.
You have configured an HTTP listener or an HTTPS listener for your CLB instance.
You have registered a domain name with Alibaba Cloud and completed the ICP filing.

Procedure

Step 1: Configure forwarding rules

Log on to the Classic Load Balancer (CLB) console.
In the top navigation bar, select the region where your CLB instance is deployed.
On the Instances page, click the ID of the target instance.
On the Listener tab, find the target listener and click Set Forwarding Rule in the Actions column.
In the Add Forwarding Policy panel, configure the forwarding rule and click Add Forwarding Policy.
In this example, two forwarding rules are configured: requests with the URL /video are forwarded to vServer group RS1, and requests with the URL /exam are forwarded to vServer group RS2.
- Domain Name: Enter your registered domain name, which must have a completed ICP filing.
- URL: Enter the request path.
  
  Path matching for CLB forwarding rules is case-sensitive. For example, /video and /viDeo are considered two separate paths and require different forwarding rules.
Note
If the request URL path contains special characters, you must use URL encoding. For example, if a forwarding rule is configured for a URL path containing a number sign (#), such as /#/, the request URL must use the URL-encoded value "%23" (for example, /%23/) to be correctly matched and forwarded.

Step 2: Configure health checks

Note

By default, an HTTP health check sends an HTTP request to the default homepage of the application configured on the server. To use a page other than the default homepage for the health check, specify its exact path.

On the Instances page, find the target CLB instance and click its ID.
On the Listener tab, find the listener and click Set Forwarding Rule in the Actions column.
In the Add Forwarding Rules panel, under the Forwarding Rules, find the target forwarding rule and click Modify. Repeat this step for any other rules that need to be configured.
In the Modify Forwarding Rule panel, enable Advanced Setting and set the Health Check Path to the URL path of the forwarding rule. For the rule that uses the /video URL, for example, you would set the health check path to /video.

Enable the Health Check switch and click OK.

Step 3: Set up a DNS record

Note

For domains not registered with Alibaba Cloud, you must first add the domain to the Alibaba Cloud DNS console before you can configure DNS records.
If your CLB instance is an internal-facing instance, you must first associate an Elastic IP address (EIP) with it and then create an A record that maps the domain name to the EIP to enable public access.

In the left-side navigation pane, choose CLB > Instances.
On the Instances page, select the target instance and copy its IP Address.

Perform the following steps to add an A record:

Log on to the Alibaba Cloud DNS console.
On the Public Zone page, find the target domain name and click Settings in the Actions column.
On the Settings page, click Add Record.

In the Add Record panel, configure the following parameters. You can leave other parameters with their default values or modify them as needed. Then, click OK.

Parameter	Description
Record Type	Select A from the drop-down list.
Hostname	The prefix of your domain name. Note For a root domain, set the hostname to @.
Record Value	Enter the copied IP address of the CLB instance.

Step 4: Test the configuration

Use a browser to access http://<your domain name>/<URL>/ and verify that requests are routed to the correct server groups.

Access the video service at http://www.example.com/video/ to verify that the request is routed to the video service vServer group RS1.
If the access is successful, the page returns the following content:
```
Hello World ! This is video service.
```
Access the exam service at http://www.example.com/exam/ to verify that the request is routed to the exam service vServer group RS2.
If the page returns the following response, the request has been successfully routed to the exam service:
```
Hello World ! This is exam service.
```

FAQ

Do CLB forwarding rules support URL redirection?

No. CLB forwarding rules only forward traffic. If you need to configure URL redirection, consider using Application Load Balancer (ALB). For more information, see Configure forwarding rules for a listener.

Why are my health checks failing after I configured path-based forwarding?

When performing a health check, the load balancer ignores forwarding rules and sends requests to the health check path configured on the listener (the root path by default). If your backend services respond differently based on the request path, health checks sent to the default or a non-matching path may fail. You can configure a custom health check path for each forwarding rule as needed.

Are there additional charges for using domain-based forwarding rules?

Configuring domain-based forwarding rules does not incur charges. However, if you associate an EIP with an internal-facing CLB instance to expose it to the internet, you are charged for public network usage. For more information about billing, see CLB billing overview.

Are forwarding rules configured per listener?

Yes. The forwarding rules for each listener are independent and must be configured separately.

Server Load Balancer:Configure path-based forwarding rules