A Networking Recipe That’s Actually Delicious for Performance and Security

A firewall sandwich doesn’t exactly sound appetizing… until you realize it adds both security and performance. Suddenly it’s the most satisfying dish on the menu. Here’s the concept visually:

How It Works

Untrusted traffic from the wild Internet first hits the Load Balancer (top bun). This guy pulls double duty:

1. The top-bun load balancer handles the heavy SSL/TLS lifting
   Every HTTPS connection starts with that expensive handshake dance. The top bun is purpose-built to crush hundreds or even thousands of these transactions per second, offloading the pain from your web servers. It acts as a first-line bouncer. Anything that isn’t legitimate web traffic gets dropped right there. Simple, effective, and surprisingly good at keeping the riff-raff out. This can also improve firewall performance as the top bun shields the firewall, only letting web traffic pass through.
   
2. Once past the top bun, the traffic is decrypted and handed off to the Firewall (the hearty meat). Now your expensive security tools can actually see what’s inside the packets instead of just staring at encrypted gibberish. This is important since the advanced security services on the firewall can't do anything with encrypted traffic.
3. The bottom bun, lastly hitting the interior load balancer that handles sophisticated DoS and Bot defense (more on that soon) as well as balancing the traffic between web servers.

The Performance Win: SSL Offloading

Your web servers get to stop playing crypto cog. No more burning CPU cycles on handshakes, encryption and decryption. They can focus on what they do best — serving content lightning fast. Not only that, if you already have multiple web servers then you're doing duplicate SSL transactions. Offloading those to the top-bun load balancer centralizes those transactions so they are only done once.

The Security Win: Real Malware Scanning

Encrypted traffic is great for privacy, but it’s a blind spot for security services. In the sandwich, the firewall gets to inspect everything in the clear, dramatically improving your ability to catch malware, intrusions, and other nastiness.

But… Isn’t Decrypted Traffic Scary?

Great question! Here’s why it’s actually pretty safe:

Does Your Website Need Tweaks?

Sometimes. Many sites automatically redirect HTTP → HTTPS. With SSL offloading, the backend always sees plain HTTP, which can cause redirect loops. The fix is simple: the load balancer adds an X-Forwarded-Proto: https header so your app knows the original request was secure.

If you need to see the original IP of the visitor, another header will help you out: X-Forwarded-For: (visitor IP here)