What Survives a Proxy VIP Failover?
Separate recovery of the proxy entrance from survival of established CONNECT tunnels and the website-facing exit address.
A floating address keeps the proxy setting stable: clients continue to use the same hostname or IP after the active machine fails. That is useful availability. An existing download can still stop.
Consider an HTTPS request already inside CONNECT. The active proxy owns the client-facing TCP connection and another connection toward the website. It also owns the application state joining those streams.
Moving an address to a standby machine does not, by itself, move either TCP control block or that relay state. The new owner can accept fresh connections without being able to continue a byte stream established by the old owner.
| Expectation | Ordinary address failover provides it? |
|---|---|
| Keep one configured entrance | That is the intended benefit |
| Continue an established CONNECT stream | Additional stateful machinery would be required |
| Keep the same outward public IP | Depends on egress routing and NAT |
| Repeat an interrupted application operation safely | Depends on the operation and client |
VRRP defines election and address ownership. It is not a replication protocol for the proxy process. A deployment using other high-availability software needs the same distinction unless it explicitly supplies more.
Review what the health check actually observes. A machine can answer advertisements while its proxy service, DNS or upstream route has failed. Conversely, overly sensitive checks can cause unnecessary switches.
Client recovery matters too. A fresh browser request may reconnect easily; an upload with a consumed body or a non-idempotent API operation may require application-specific handling. Do not promise invisible failover merely because a new request succeeds through the standby.