blog.6admin.io
guest@6admin.io:~$
linux, pound, reverse-proxy, tls

Pound: a very light reverse proxy

Pound is a reverse proxy that does three things: it terminates TLS, it checks that the backends are alive and it balances. That is all. And it is exactly what you need when you do not want an Apache that also proxies.

The config

ListenHTTP
    Address 0.0.0.0
    Port    80
End

ListenHTTPS
    Address 0.0.0.0
    Port    443
    Cert    "/etc/pound/server.pem"
End

Service
    BackEnd
        Address 192.168.1.11
        Port    8080
    End
    BackEnd
        Address 192.168.1.12
        Port    8080
    End
    Session
        Type    IP
        TTL     300
    End
End

The Pound config file is a declarative format that reads like a text block: each BackEnd is a pool server, each Service is a group of backends, the Session sticks clients by source IP. TLS terminates in Pound, the backends speak plain HTTP on the internal network.

What Pound does well

  • TLS is offloaded: the backends do not manage certificates, Pound handles it;
  • The health check is built in: a dead backend leaves the pool automatically;
  • The config is short: under 30 lines for basic TLS proxy + load balancing;
  • It is light: one process, a few MB of RAM, no modules to load.

What Pound does not do

Pound does not route on request content (no ACL on the Host, no path-based routing, no sticky session by cookie). It balances, it terminates TLS, it checks the backends. That is all. When you need to route on URL or Host, you move up a level: haproxy .

The difference with haproxy

Pound does the job of a simple reverse proxy. haproxy does the job of a reverse proxy with ACLs, TCP and HTTP modes, configurable health checks, real-time stats and a config that reads like code. The move from Pound to haproxy is the move from “it works” to “I control every request”.

[edit: 2026] Pound ended up forgotten (the last release dates from 2016), haproxy crossed everything and became the default edge and the haproxy article tells the rest. The 2008 Pound config would have loaded into a 2026 haproxy without changing one concept.