How does TLS termination work on NodeBalancer?

You upload a certificate and key when you create or update the configuration. The NodeBalancer terminates TLS and forwards plain HTTP to the backend Linodes (or HTTPS if you specify), which simplifies certificate management — only the NodeBalancer has to know about the certificate. Renewals require uploading the new cert; the NodeBalancer does not auto-renew.

What's the difference between proxy protocol and not?

Without proxy protocol, the backend sees the NodeBalancer's IP as the client source — losing the real client IP. With proxy protocol enabled, the NodeBalancer prepends a small header containing the real client IP and the backend (if it understands proxy protocol) reads the real source. Use proxy protocol when client IP matters for logging, rate limiting, or geolocation.

Linode NodeBalancer Config Builder

NetworkingLinode

Build NodeBalancer configurations with health checks, SSL termination, sticky sessions, and backend nodes.

Last verified: May 2026

Linode NodeBalancer Configuration

Build NodeBalancer configurations with ports, health checks, SSL termination, sticky sessions, backend nodes, and load balancing algorithms.

Required Fields

labelregionconfigs

{
  "label": "prod-web-lb",
  "region": "us-east",
  "clientConnThrottle": 20,
  "configs": [
    {
      "port": 443,
      "protocol": "https",
      "algorithm": "roundrobin",
      "stickiness": "table",
      "check": "http",
      "checkPath": "/health",
      "checkInterval": 10,
      "checkTimeout": 5,
      "checkAttempts": 3,
      "sslCert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
      "sslKey": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----",
      "proxyProtocol": "v2",
      "nodes": [
        {
          "label": "web-01",
          "address": "192.168.1.10:8080",
          "weight": 50,
          "mode": "accept"
        },
        {
          "label": "web-02",
          "address": "192.168.1.11:8080",
          "weight": 50,
          "mode": "accept"
        }
      ]
    },
    {
      "port": 80,
      "protocol": "http",
      "algorithm": "roundrobin",
      "check": "http",
      "checkPath": "/",
      "checkInterval": 15,
      "nodes": [
        {
          "label": "web-01",
          "address": "192.168.1.10:8080",
          "weight": 50,
          "mode": "accept"
        },
        {
          "label": "web-02",
          "address": "192.168.1.11:8080",
          "weight": 50,
          "mode": "accept"
        }
      ]
    }
  ],
  "tags": ["production", "web"]
}

Generated Output

Output will appear here...

See It in Action

Your team's web tier is moving from a single Linode to three for redundancy. You provision a NodeBalancer with the builder, configure TLS termination and HTTP-to-HTTPS redirect, point DNS at the NodeBalancer's IP, and attach the three backend Linodes. After cutover, you can take any single backend down for maintenance without user-visible impact. The total monthly cost — NodeBalancer plus extra backends — comes out to about $30 more, an obvious win.

What This Tool Does

Linode NodeBalancers are managed load balancers — they handle TCP and HTTPS traffic, terminate TLS, run health checks, and distribute traffic across backend Linodes. The Linode NodeBalancer Config Builder produces a complete configuration: ports, protocols, health check parameters, SSL termination settings, sticky-session behavior, and backend node specifications. Output is API-ready and includes a node-attachment plan.

Technical Details

The builder collects NodeBalancer name, region, client connection throttle, and a list of configurations. Each config has a port, protocol (TCP, HTTP, HTTPS), algorithm (roundrobin, leastconn, source), stickiness setting, health check parameters, optional TLS certificate, and list of backend nodes. Output is JSON for the Linode NodeBalancer API plus the node-attachment payload.

Common Use Cases

1Standing up a new public-facing HTTPS endpoint backed by multiple Linodes, with automatic TLS termination and HTTP-to-HTTPS redirect.
2Adding sticky sessions for a legacy stateful app that can't yet be refactored to a shared session store.
3Tuning health check thresholds for a service whose startup is slow enough that default checks mark healthy backends as down.
4Generating a TCP-mode NodeBalancer for a non-HTTP protocol (database proxy, custom service) with custom port forwarding.

Common Questions

How does TLS termination work on NodeBalancer?: You upload a certificate and key when you create or update the configuration. The NodeBalancer terminates TLS and forwards plain HTTP to the backend Linodes (or HTTPS if you specify), which simplifies certificate management — only the NodeBalancer has to know about the certificate. Renewals require uploading the new cert; the NodeBalancer does not auto-renew.
What's the difference between proxy protocol and not?: Without proxy protocol, the backend sees the NodeBalancer's IP as the client source — losing the real client IP. With proxy protocol enabled, the NodeBalancer prepends a small header containing the real client IP and the backend (if it understands proxy protocol) reads the real source. Use proxy protocol when client IP matters for logging, rate limiting, or geolocation.

Expert Tips

TIP

Set up multiple NodeBalancer configurations on the same NodeBalancer for different ports rather than running multiple NodeBalancers. One NodeBalancer with three configurations (80, 443, custom port) costs the same as one with a single config.

TIP

Configure HTTP health checks against an explicit endpoint like /healthz, not just the root /. A check against / often hits expensive page-generation code; /healthz can be a cheap 'process is alive' response.

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.