HA Deployments and the Safe-List: Don't Skip This Step

How one missing configuration entry can turn your load-balancer into a self-inflicted denial-of-service machine

Load balancers are interesting network citizens. They connect, they probe, they disconnect, often without completing any authentication. That is exactly what they are designed to do. From a security standpoint, however, that pattern looks indistinguishable from a port scanner or a connection-flood attack.

Syncplify Server! has a built-in protection mechanism, called Protector!, that automatically block-lists IP addresses exhibiting suspicious behavior. It works brilliantly against actual attacks. Against your own load balancer, though, it will work just as well, and that is the problem. If your load balancer’s IP address is not in the safe-list, Protector! will eventually block it, and when that happens, every node behind that load balancer stops accepting connections. Not because the software failed. Because it did exactly what it was told.

The fix is a single configuration step: every IP address used by every load balancer in your HA deployment must go in the safe-list. Not the allow-list (which has entirely different semantics), not the block-list (obviously), the safe-list. Safe-listed addresses are never auto-blocked, regardless of how many times they connect and disconnect without authenticating. This is precisely what the safe-list was designed for. Full details on all three list types are in our knowledge base, alongside the complete HA setup guide. If you are running a load-balanced HA cluster and have not checked this, now is a good time.