What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use two layers: authoritative DNS chooses the healthiest or most suitable region, and NGINX on each Ubuntu region balances requests across local application servers. This design can distribute users across countries and fail over a region, but DNS caching means a change is not instantaneous and existing connections do not move. The guide below builds that architecture, explains the limits of round-robin DNS, and gives a testable Ubuntu and NGINX configuration.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What global DNS and NGINX load balancing actually does
Global server load balancing (GSLB) distributes traffic among server resources in multiple points of presence. In this design, DNS is the global steering layer. A recursive resolver asks your authoritative DNS service for the address of your application and receives one or more regional endpoints. The selected endpoint is an NGINX reverse proxy in a particular region.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →NGINX then performs the second decision locally. Its upstream group contains application instances in that region, such as two servers listening on port 8080. NGINX sends each HTTP request to an upstream according to the selected method and temporarily avoids an instance that fails enough in-band requests.
- DNS layer: chooses a region using records, health monitors, geography, latency, or another provider policy.
- Regional NGINX layer: terminates or passes through TLS and balances requests among local application servers.
- Application layer: must be deployable in every region with compatible data, sessions, secrets, and migrations.
Multiple A or AAAA records alone provide simple round-robin DNS. They do not, by themselves, know whether a region can serve a real request. Health-aware failover and intelligent geographic or performance routing require an authoritative DNS load-balancing service that supports pools, monitors, and steering policies.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Plan the topology before installing anything
Minimum production shape
Start with at least two regional Ubuntu hosts in different failure domains. Each region should have the same application release, TLS policy, firewall rules, monitoring agents, and deployment process. Put two or more application instances behind NGINX in each region when the region itself must survive an instance failure.
| Layer | Example responsibility | Failure it can handle |
|---|---|---|
| Authoritative DNS | Returns the address of the preferred healthy region | Regional outage, according to monitor state and policy |
| Regional NGINX | Reverse-proxies to an upstream group |
Individual application-instance failure |
| Application | Serves requests and exposes a meaningful health endpoint | Application process or dependency failure, when reported correctly |
| Data services | Database, cache, object storage, and queues | Only if separately replicated and failover-tested |
Global traffic distribution does not replicate a database or make a stateful application multi-region. Decide where sessions live, how writes are routed, how data conflicts are handled, and whether a region can be read-only during recovery.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsPrerequisites checklist
- Two Ubuntu servers with stable public addresses and synchronized clocks.
- A domain whose authoritative DNS can create regional records or pools and run health monitors.
- Identical application builds and environment-specific configuration for each region.
- TLS certificates covering the public hostname and a renewal process that runs in every region.
- Firewall rules allowing client HTTPS traffic to NGINX and private traffic from NGINX to application ports.
- Monitoring for DNS answers, NGINX status, application health, latency, error rate, and certificate expiry.
- Source control for NGINX configuration, deployment scripts, and rollback versions.
Prepare each Ubuntu regional host
Install NGINX from an Ubuntu-supported repository
Run the installation on every regional proxy. Use the repository and package version supported by your Ubuntu release, and keep the package update process consistent between regions.
sudo apt update
sudo apt install nginx
sudo systemctl enable --now nginx
sudo nginx -t
sudo systemctl status nginxnginx -t must report that the syntax is okay and the test is successful before you reload. Keep the default virtual host disabled if it could answer for your production hostname.
sudo rm -f /etc/nginx/sites-enabled/default
sudo mkdir -p /etc/nginx/conf.d
sudo mkdir -p /etc/nginx/snippetsSet firewall boundaries
Allow HTTPS (and HTTP only if you need an HTTP-to-HTTPS redirect) from the internet. Allow the application port only from the NGINX host or private network. Do not expose an internal health endpoint publicly unless it is authenticated or deliberately designed for public monitoring.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseThe exact private-network rule depends on your network ranges. Test the rule from NGINX to each upstream and from an external monitoring location to the public listener.
Define the regional NGINX upstream
Choose a balancing method
| Method | How requests are selected | Good fit | Important limitation |
|---|---|---|---|
| Round-robin (default) | Cycles through available servers | Similar request cost and stateless applications | Does not account for current connection count or response time |
least_conn |
Sends the next request to the server with the fewest active connections | Long-lived or uneven-duration requests | Connection count is not the same as application capacity |
ip_hash |
Maps a client address to a server | Legacy sticky-session requirements | Users behind NAT can concentrate on one instance; it is not a substitute for shared sessions |
| Weights | Gives selected servers more or fewer requests | Different instance sizes or gradual rollout | Weights describe intended capacity, not live health or latency |
least_time |
Uses connection and response-time information where supported | Latency-sensitive workloads | Confirm availability and licensing in the NGINX build you operate |
For a normal stateless web service, begin with round-robin. Use least_conn when requests remain open for materially different lengths. Avoid ip_hash unless you have a specific compatibility reason; shared session storage is usually more resilient.
Create an upstream and virtual host
On the regional NGINX host, create /etc/nginx/sites-available/app.example.com. Replace the private addresses with the application servers in that region.
upstream app_region {
# Omit this line for the default round-robin method.
least_conn;
server 10.20.1.11:8080 max_fails=3 fail_timeout=10s;
server 10.20.1.12:8080 max_fails=3 fail_timeout=10s;
}
server {
listen 80;
listen [::]:80;
server_name app.example.com;
location / {
proxy_pass http://app_region;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_connect_timeout 5s;
proxy_read_timeout 60s;
}
location = /health/ready {
proxy_pass http://app_region;
proxy_set_header Host $host;
}
}max_fails=3 fail_timeout=10s means NGINX can mark an upstream temporarily unavailable after the configured failures during that period, then try it again with later live traffic. This is passive, in-band handling: Open Source NGINX does not continuously request a health URI just because it is configured in the application.
Enable the site and reload only after testing:
sudo ln -s /etc/nginx/sites-available/app.example.com /etc/nginx/sites-enabled/app.example.com
sudo nginx -t
sudo systemctl reload nginxForward the right client and protocol information
The proxy headers above let the application recover the original host, client address, and HTTPS scheme. Configure the application to trust those headers only from your NGINX addresses. If the service uses WebSockets or another upgraded connection, add the appropriate Upgrade and Connection handling and test long-lived connections separately.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Make health checks represent usable service
A monitor that only confirms an open TCP port can declare a broken application healthy. Expose a private or authenticated readiness endpoint that returns success only when the instance can serve real traffic. It should check the dependencies that are required for the request path, such as a database connection, cache, signing key, or critical downstream API. Keep expensive diagnostics out of a frequently polled endpoint.
Open Source NGINX: passive handling
With NGINX Open Source, upstream failures are learned from proxied requests. The max_fails and fail_timeout parameters control the temporary avoidance behavior. This catches failures when traffic arrives, but it cannot detect an idle region that has stopped serving before a user request reaches it. Your DNS monitor should therefore test the public regional endpoint independently.
NGINX Plus: active checks and operational controls
NGINX Plus adds active periodic health checks, configurable intervals and pass/fail counts, richer status, shared upstream zones, monitoring, and API-based dynamic changes. An active check can request a URI and require configured status, header, or body conditions. Use it when you need an instance removed before a customer request exposes the failure or when operations require live upstream changes and detailed dashboards.
Configure authoritative DNS as the global steering layer
Create regional endpoints or pools
At your authoritative DNS load-balancing provider, create one endpoint for each regional NGINX address. Group endpoints into pools if the service supports pool-level failover. Attach a monitor to each endpoint or pool and define which response codes, headers, body content, and timeout constitute health.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Create the public hostname, such as
app.example.com, in the provider’s DNS load-balancing area. - Add the NGINX address for each region as an endpoint. Use the public address that clients can reach, not an internal application address.
- Configure an HTTPS monitor against a readiness path such as
/health/ready. Require the expected status and, where supported, a known response body or header. - Choose the steering policy: simple round-robin, geographic proximity, latency, weighted distribution, or priority failover.
- Set a secondary region or pool for the case in which the preferred pool becomes unhealthy.
- Publish the DNS record and verify that the authoritative nameservers return the intended answers.
When a monitored pool becomes unhealthy, a managed DNS load balancer can remove it from endpoint rotation. That decision is separate from NGINX’s local upstream decision: DNS may send new clients to another region while each regional NGINX continues to remove individual failed instances.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Round-robin records versus health-aware DNS
| Approach | What it provides | What it cannot provide |
|---|---|---|
| Several A or AAAA records | Simple distribution among returned addresses | Reliable health-aware failover, geographic optimization, or guaranteed removal of a dead region |
| Managed DNS load balancing | Records, pools, monitors, and policies such as priority, geography, or latency | Instant movement of already-established connections; behavior outside the provider’s documented limits |
Use plain multi-record DNS when coarse distribution and manual recovery are acceptable. Use a health-aware service when the requirement is automatic regional failover or proximity-based routing, and verify its plan limits and current pricing before adoption.
Set TTLs with caching and recovery in mind
Recursive resolvers and clients cache DNS answers for the record’s TTL. A shorter TTL can allow a steering change to be observed sooner, but it increases DNS query volume and does not force every resolver or application to discard an answer immediately. A longer TTL reduces query load but extends the period during which clients may continue using an old region.
There is no universal TTL that is correct for every provider and topology. Select a conservative value supported by your DNS service, measure how quickly changes appear from several recursive resolvers, and document the resulting worst-case failover window. Before a planned migration, lower the TTL early enough for the previous value to age out, then restore it after the change is stable.
DNS changes affect new lookups. Existing TCP connections, HTTP keep-alive sessions, WebSockets, and cached application addresses remain attached to the old endpoint until they close, time out, or are deliberately drained. Include connection draining in your regional maintenance procedure.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Terminate TLS consistently in every region
Each NGINX endpoint that can answer for the public hostname needs a certificate covering that hostname and the same minimum protocol and cipher policy. Automate issuance and renewal in every region or distribute certificates through a controlled secret-management process. Verify SNI by connecting to each regional address with the public hostname; a certificate that works in one region does not prove that the other region is configured correctly.
If TLS is terminated at NGINX, proxy the request to the application over a protected private network when credentials or personal data are involved. If TLS is passed through instead, use the stream context rather than an HTTP server block and ensure the health monitor can validate the resulting protocol.
Balance TCP or UDP services with NGINX stream
Web traffic belongs in the http {} context with proxy_pass. NGINX also supports TCP and UDP proxying in the stream {} context. UDP listeners must include the udp parameter, which matters for DNS and other UDP protocols.
stream {
upstream dns_region {
server 10.20.1.21:53;
server 10.20.1.22:53;
}
server {
listen 53 udp;
proxy_pass dns_region;
proxy_timeout 5s;
proxy_responses 1;
}
}Do not paste a stream configuration into an HTTP-only location and expect it to work. Test packet behavior, timeouts, response counts, and source-address handling with protocol-specific tools. DNS-over-TCP and DNS-over-TLS are separate cases from ordinary UDP DNS and need their own listeners and tests.
Validate distribution, failure, and recovery
Run the following checks from more than one geographic network. Testing from a single office resolver can hide cached answers and route-specific problems.
- Authoritative answers: Query the authoritative nameservers and confirm that the published pools and policy return the expected regional addresses.
- Recursive behavior: Query through several public and ISP resolvers. Record the answer, TTL, and time at which a deliberate pool change becomes visible.
- TLS and SNI: Connect to each regional address using the public hostname and verify certificate chain, expiry, protocol policy, and hostname matching.
- HTTP path: Request a normal page and the readiness endpoint. Confirm status, headers, redirects, and the region identifier in logs or a safe diagnostic header.
- Local balancing: Send enough requests to each region to see round-robin or the selected method distribute them among application instances.
- Instance failure: Stop one application instance or block its port. Confirm NGINX logs failures, avoids it temporarily, and resumes sending traffic after recovery.
- Regional failure: Make the entire regional monitor fail. Confirm the DNS provider removes that pool and returns the secondary region to new resolvers.
- Existing connections: Observe keep-alive and WebSocket clients during the regional event; document how long they take to reconnect.
- Recovery: Restore the region, wait for monitor success, and verify that it re-enters rotation only after application data and dependencies are ready.
- Rollback: Revert the DNS policy and NGINX configuration from source control, run
nginx -t, reload, and repeat the external checks.
Keep timestamps for monitor transitions, DNS answers, NGINX errors, upstream response times, and application logs. Those records distinguish a DNS-cache delay from an NGINX failure or an application dependency outage.
Open Source, NGINX Plus, and managed DNS: which layer should you add?
| Option | Capabilities relevant to this design | Choose it when |
|---|---|---|
| NGINX Open Source | HTTP reverse proxy, round-robin, least-connection, IP-hash, weighted methods, and passive in-band failure handling | You can monitor regions at the DNS layer and accept request-driven upstream failure detection |
| NGINX Plus | Active periodic checks, configurable intervals and pass/fail counts, status and body matching, shared upstream zones, monitoring, and an API for dynamic changes | You need proactive instance removal, richer operational visibility, or runtime upstream control |
| Managed DNS load balancing | Provider-operated DNS records, pools, health monitors, and traffic-steering policies | You need automated global failover or geographic/latency routing without building authoritative DNS control yourself |
These are complementary choices. A managed DNS service does not replace the regional reverse proxy, and NGINX Plus does not replace authoritative DNS steering between countries. Start with Open Source NGINX and health-aware DNS when passive local handling is sufficient; add active NGINX checks or richer DNS policies when a measured operational requirement justifies them.
Troubleshoot the common failure modes
Users still reach a failed region
- Check the recursive resolver’s cached TTL and the time the monitor changed state.
- Confirm the monitor targets the public regional endpoint and uses the correct Host header and SNI.
- Verify that the readiness endpoint fails when a dependency required for real traffic is unavailable.
- Remember that existing connections are not redirected by a new DNS answer.
NGINX returns 502 or 504
- From the NGINX host, connect directly to every upstream address and port.
- Read the NGINX error log for connection refusal, timeout, name-resolution, or protocol errors.
- Check application bind addresses, private firewall rules, security groups, and container networking.
- Compare proxy connect and read timeouts with the application’s normal response duration.
Traffic is uneven inside a region
- Confirm whether the configured method is round-robin,
least_conn,ip_hash, or weighted. - Look for long-lived connections, large requests, retries, or one instance with a different weight.
- Check whether clients reuse connections; many HTTP requests on one keep-alive connection do not create a new upstream selection each time.
One region serves a different application or certificate
- Compare deployed release, environment variables, secrets, migrations, and feature flags.
- Test the public hostname against each regional address to catch SNI and virtual-host mistakes.
- Compare TLS policy, redirect behavior, compression, security headers, and health endpoint output.
UDP forwarding fails
- Ensure the listener is in
streamand includeslisten ... udp. - Confirm that return traffic, timeouts, and response-count settings match the protocol.
- Test both UDP and TCP if the service supports both; they are separate transport paths.
Operational checklist
- Keep every NGINX configuration in version control and review changes before deployment.
- Run
nginx -ton the target host before every reload. - Alert on monitor state, upstream failures, 5xx rate, latency, certificate expiry, and DNS-provider errors.
- Use a readiness check that reflects serving capability rather than merely process existence.
- Document TTL behavior, connection draining, DNS-provider limits, and the manual escape route if automation fails.
- Practice instance failure, complete regional failure, dependency failure, and recovery on a schedule.
- Keep data, sessions, and secrets consistent enough that a user can move between regions without an application error.
The resulting architecture is deliberately layered: authoritative DNS chooses where new clients should go, while NGINX chooses which healthy local application instance handles each request. That separation provides a practical global failover path without pretending that round-robin records are health checks or that DNS can move an already-open connection.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
