LiteSpeed Web ADC: load balance a LiteSpeed fleet

When one LiteSpeed node stops being enough — you're adding a second web server for redundancy, or splitting WordPress traffic across three boxes — you need something to sit in front and distribute requests. LiteSpeed Web ADC (Application Delivery Controller) is LiteSpeed's own Layer 7 load balancer. It speaks the same config dialect as LSWS, terminates SSL and HTTP/3, caches at the edge, and health-checks your backends.

This guide is for operators running two or more LiteSpeed Web Server backends who want a LiteSpeed-native load balancer rather than HAProxy or Nginx out front. It covers installation, defining a cluster, wiring backend nodes, terminating TLS, and — the part people get wrong — sizing the worker-process license so you don't overpay or starve the box.

When Web ADC is the right tool

Web ADC earns its place when you have real horizontal scale or HA requirements. If you run a single server, you do not need it — LSWS already does everything Web ADC does for one node. Reach for it when:

• You're running an active/active or active/passive pair and need health-checked failover.
• You want one place to terminate SSL and HTTP/3 so backends serve plain HTTP on a private network.
• You want edge caching in front of a pool, so a cache hit never touches a backend at all.

Install Web ADC

Web ADC ships as a standalone tarball, separate from LSWS. Install it on the box that will be your load balancer — not on a backend.

cd /root
wget https://www.litespeedtech.com/packages/lslb/lslb-2.7-x86_64-linux.tar.gz
tar -zxvf lslb-2.7-x86_64-linux.tar.gz
cd lslb-2.7
./install.sh

The installer prompts for:

• WebAdmin username (default admin) and password — this is your console login, set a strong one.
• User/Group the service runs as (default nobody:nobody).
• HTTP port (default 80).
• Admin HTTP port (default 7090).

Start the service and confirm the admin console is listening:

/usr/local/lslb/bin/lslbctrl start

The WebAdmin console is now at https://your-adc-ip:7090. Everything below is configured there. The 15-day trial license is enough to build and test the whole setup before you buy — see licensing for sizing.

Define a cluster

A cluster is Web ADC's term for a backend pool plus the policy that routes to it. In WebAdmin → Configuration → Clusters → Add:

• Name — e.g. wp-pool.
• Type — Layer 7 for HTTP/HTTPS. This is what you want for web traffic.
• Mode — Stateful keeps a client pinned to one backend (session affinity); Stateless ignores affinity and spreads every request.
• Strategy — how requests are picked: Round Robin rotates evenly, Least Load sends to the backend with the fewest active connections.

For a stateless app — WordPress with a shared database and an external object cache — use Stateless + Least Load. It gives the smoothest distribution and survives a backend dropping out without stranding sessions.

Add backend nodes

Inside the cluster, the backend servers live in a Worker Group. Add one (Type: HTTP Proxy) and define the nodes. The node address list uses LiteSpeed's tagged format:

(web1)10.0.0.1->10.0.0.11:8080
(web2)10.0.0.1->10.0.0.12:8080

Each entry is (tag)ADC_internal_IP->backend_IP:port. Point the ADC at each LSWS backend's HTTP listener — run the backends on a private interface on port 8080 and never expose them publicly. Set per-node limits while you're here:

• Max Connections — cap concurrent connections per backend so one box can't be flooded.
• Initial Request Timeout — how long to wait for the first byte before marking a node slow.
• Retry Timeout — how long a failed node stays out of rotation before Web ADC retries it.

Web ADC health-checks nodes automatically: a backend that stops answering is pulled from the pool and re-added when it recovers, which is the entire point of running it for HA.

Terminate SSL and HTTP/3 at the edge

Terminate TLS on the ADC so backends serve plain HTTP internally. Under Configuration → Listeners → Add:

• Port 443, Secure Yes.
• On the SSL tab, point at your private key, certificate, and CA chain file paths.
• Enable Allow QUIC to serve HTTP/3 over QUIC from the edge.
• Map the listener to your cluster's virtual host so 443 traffic routes into wp-pool.

Add a second listener on port 80 that redirects to HTTPS. With SSL terminated here, your certificate renewals happen in one place instead of on every backend — a real operational win once you're past two nodes.

Size the license correctly

This is where money is won or lost. Web ADC is licensed by worker processes, not by traffic or core count:

A worker process does the real work — routing, SSL encryption/decryption, caching, rewriting — and each one uses roughly one CPU core. LiteSpeed's guidance is to license enough workers to use about 25% of the ADC server's cores. On a 4-core load balancer, the Small tier (1 worker) is the right starting point; the remaining cores absorb kernel networking and bursts.

The pressure that pushes you up a tier is HTTPS volume — TLS handshakes are CPU-heavy, and if the ADC also terminates QUIC, encryption dominates its workload. Watch worker CPU under real load before upgrading; don't buy Large speculatively. Licensing is prorated, so you can move between tiers as traffic grows. For how this fits alongside your backend LSWS licenses, see LiteSpeed license tiers, and for volume or multi-node quotes, talk to sales.

Verify the load balancer works

From outside, hit the ADC and confirm responses come back and rotate across backends. Add a temporary header on each backend (X-Backend: web1 / web2) and watch it alternate:

for i in $(seq 1 6); do curl -sI https://yoursite.example.com/ | grep -i x-backend; done

You should see the two backends alternate under Round Robin. Then stop LSWS on web1 and re-run — every response should now show web2, proving health-check failover works. Bring web1 back and confirm it re-enters the pool after the retry timeout.

Next steps

• Install LiteSpeed Web Server on cPanel
• LiteSpeed license tiers explained
• Enable HTTP/3 and QUIC on LiteSpeed
• LiteSpeed Web Server vs OpenLiteSpeed