Direct Server Return

Direct Server Return is the deployment in which the request is distributed through TR7, while the response returns directly to the client without passing through TR7 (on the Network vService, the LB Mode field set to Direct Server Return; TCP - L4 or UDP - L4 as the Protocol, Port Range disabled; Backend Services on the same network as TR7 and prepared to accept the vService address). TR7 only decides which server the incoming traffic goes to; it does not touch the packet's addresses or content.

Because response traffic does not pass through the load balancer, TR7's capacity is dedicated to traffic coming from the client. For services whose responses are many times larger than their requests, this means carrying far more traffic with the same device. The client address also reaches the server without undergoing any translation.

Network vService only

This deployment operates at L4 and is set up with a Network vService. TLS termination, WAF, AGS, L7 DDoS and Bot protection, and X-Forwarded-For are not available on this vService type; if these layers are needed, the other deployments set up with an HTTP or L7 TCP vService are used.

Direct Response

Does not pass through TR7

The Backend Service sends the response to the client itself; TR7 is not on the return path

Minimal Load

Request side only

Response data does not pass through TR7; TR7's capacity is dedicated to traffic coming from the client

Real IP

Address is not translated

The packet's source and destination addresses do not change; the server sees the client as it is

TCP and UDP

At L4

Packets are distributed at the connection level without being opened at the application layer

Health Check

Failed server taken out of service

Backend Services with a defined health check are added to or removed from distribution according to the result

Ready Option

Network vService

In the add form, the LB Mode field comes with Direct Server Return selected

Direct Server Return

The diagram shows the traffic flow in a single-device installation in three steps: the vService address the client connects to (172.16.102.92:80), TR7 and the Backend Service are on the same interface (1G-1 in the diagram) and on the same network (VLAN_102 in the diagram). The request passes through TR7; the response, however, returns from the Backend Service to the gateway and from there to the client without passing through TR7 (dashed green line in the diagram).

In the diagram's example, TR7 forwards the incoming packet to the Backend Service it selects without changing its addresses: the packet's source remains the client's address (x.x.x.x) and its destination remains the vService address (172.16.102.92:80). The Backend Service is prepared to accept this address as its own address (vService IP, accepted locally in the diagram); it sends the response directly to the client via its own gateway (172.16.102.1), showing the vService address as the source.

The health check is performed from TR7 to the Backend Service's own address (172.16.102.161), not to the vService address.

In the diagram's example, the source and destination information of the packets in the three steps of the connection is as follows:

Step	Direction	Source IP	Source Port	Destination IP	Destination Port
1	Client → TR7	x.x.x.x (Client IP)	Random	172.16.102.92 (vService address)	80
2	TR7 → Backend Service	x.x.x.x (Client IP)	Source port of step 1	172.16.102.92 (vService address); the packet is forwarded to the Backend Service without its addresses changing	80
3	Backend Service → Client (does not pass through TR7)	172.16.102.92 (vService address)	80	x.x.x.x (Client IP)	Source port of step 1

Color	Meaning
	Request
	Response

In steps 1 and 2 the packet is the same; TR7 only determines which Backend Service it goes to. The fourth step in the other deployments, that is, forwarding the response from TR7 to the client, does not exist in this deployment.

Why Direct Server Return?

Deployments where the response also passes through TR7	With Direct Server Return
Both the request and the response pass through the load balancer; the device carries the traffic of both directions.	TR7 only distributes the incoming request; the response goes directly from the server to the client.
Large responses (media, files, streaming) consume the load balancer's capacity.	Response data does not pass through TR7; the load on TR7 remains limited to packets coming from the client.
The source address is translated, or the return path is provided separately.	The address is not translated; the server sees the client directly and sends the response directly to it.
On HTTP and L7 TCP vServices, every connection is terminated on TR7 and processed at the application layer.	Packets are forwarded without being opened; TR7 adds no latency on the response path.

How Does Traffic Flow?

ClientReaches the service at the vService address

RequestTo the vService addressResponseDoes not return this way

TR7Only distributes the requestL4 LBTCPUDPThe packet's address and content do not change

RequestWithout changing the addressesResponseIs not sent to TR7

Backend ServiceAccepts the vService address as its own address

Direct responseFrom the Backend Service to the client, without passing through TR7

1. Request arrivesThe client sends a packet to the vService address at which the service is published.
2. TR7 distributesTR7 forwards the packet to the selected Backend Service without opening it and without changing its destination address and port.
3. Server acceptsThe Backend Service processes the packet arriving at the vService address as if it had arrived at its own address.
4. Response returns directlyThe Backend Service sends the response to the client itself; the response does not pass through TR7.

RequestResponse

In this deployment, TR7 is not an inspection point but a distribution point: its job is to select the right server and get out of the way. This is why it is preferred for services where speed and volume come first.

Highlights

Response path is freeThe Backend Service sends the response directly to the client; no separate routing or address translation is set up for return traffic.

Load does not build up on TR7Because response traffic does not pass through the device, the load on TR7 decreases and no latency caused by TR7 occurs on the response path.

Client address as it isBecause no address translation is performed, the Backend Service sees the client's own IP address as the source of the connection.

TCP and UDP servicesUDP services such as DNS, NTP and SIP, and raw TCP services are distributed with the same deployment.

Algorithm and persistenceDistribution is performed according to the vService's LB Algorithm and L4 Persistence settings; the Backend Service's weight and connection limit are used in distribution.

Health status is reflected in distributionBackend Services with a defined health check are added to or removed from distribution according to the check result.

Comes selected in the formIn the Network vService add form, the LB Mode field comes with Direct Server Return selected.

Other modes on the same vServiceWhen needs change, Route Mode or SNAT is selected from the same field; these modes are for the layout in which the response passes through TR7 and carry their own conditions.

When Is It Preferred?

Services with large responses High volume

For services such as media streaming and file distribution, where the response is very large compared to the request, return traffic does not occupy the load balancer.

Latency-sensitive services Low latency

For services where every millisecond matters, such as real-time game servers and live broadcasting, the response reaches the client by the shortest path.

UDP infrastructure services DNS, NTP, SIP

Infrastructure services that work with short and numerous packets are distributed to more than one server without being opened at the application layer.

Requirements and limits of this deployment

• Same network. Backend Services are on the same network as TR7; because the packet's destination address and port are forwarded unchanged, there cannot be a router in between.
• Preparation on the server side. Each Backend Service is prepared to accept packets arriving at the vService address: it accepts the address as its own address, but does not respond on behalf of this address on the network, and listens on the vService port. TR7 does not check this preparation on the server side; when the preparation is not made, packets remain unanswered. Because the health check is performed to the server's own address, a server with incomplete preparation can appear healthy.
• Protocol. It applies on TCP - L4 and UDP - L4 vServices while Port Range is disabled.
• No L7 layers. TLS termination, WAF, AGS, L7 DDoS and Bot protection, conditional routing and X-Forwarded-For are not available on this vService type. Because the response does not pass through TR7, no processing is performed on the response side either.

Related Pages

Network vService

LB Mode options, protocols, Port Range and L4 Persistence.

→

One Arm Topology

The one-arm deployment in which the response passes through TR7 and no preparation is required on the server side.

→

Backend Services

Backend Service address, weight, connection limit and health check.

→

Health Checks

Health check types for UDP and TCP services.

→