I've used haproxy in tcp passthrough mode (no ssl termination or proxy) in the past. IIRC we did leastconn to the backend servers. Connections are long lived so tendency of traffic clump after server side restarts. further haproxy notes. • Send logs to /dev/log instead of that local0 nonsense. You'll need to add the socket via this in rsyslog ``$AddUnixListenSocket /var/lib/haproxy/dev/log`` • enable seamless reloads. watchdog of 3-600s should be fine. • haproxy::listen won't work. Use haproxy::frontend and haproxy::backend