[Yandex Cloud documentation](../../index.md) > [Yandex Application Load Balancer](../index.md) > [Step-by-step guides](index.md) > HTTP routers > Creating an HTTP router for HTTP traffic # Creating an HTTP router for HTTP traffic To create an [HTTP router](../concepts/http-router.md) and add a [route](../concepts/http-router.md#routes) to it: {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to create your HTTP router. 1. Navigate to **Application Load Balancer**. 1. In the left-hand panel, select ![image](../../_assets/console-icons/route.svg) **HTTP routers**. 1. Click **Create HTTP router**. 1. Specify your HTTP router name. 1. Under **Virtual hosts**, click **Add virtual host**. 1. In the **Name** field, enter a name for the new virtual host. Follow these naming requirements: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. 1. Optionally, in the **Authority** field, specify the HTTP/1.1 `Host` (HTTP/2 `:authority`) header value for virtual host selection. If **Authority** is not specified, all traffic will be routed to this virtual host (same as `*`). 1. Optionally, in the **Security profile** field, select a [Yandex Smart Web Security](../../smartwebsecurity/index.md) [security profile](../../smartwebsecurity/concepts/profiles.md). A security profile allows you to filter incoming requests and enable [WAF](../../smartwebsecurity/concepts/waf.md) for protection against malicious activities. For more information, see [Security profiles](../../smartwebsecurity/concepts/profiles.md). 1. Optionally, enable **Limit on all requests** and/or **Limit on requests from one IP** and set the limits for the number of requests the virtual host will be processing per unit of time. 1. Optionally, expand **DNS settings for internal addresses** and click **Add record**. * In the **Type** field, select where you want to modify the header: * `Request`: To modify incoming request headers, from client to load balancer. * `Response`: To modify outgoing response headers, from backend to external client. * In the **Header name** field, give the header a name, e.g., `Host`, `User-Agent`, `X-Forwarded-For`, `Strict-Transport-Security`, etc. * In the **Operation** field, select an action: * `append`: To add a string to the header value. Specify the string in the field on the right. * `replace`: To completely replace the header value. Specify the new header value in the field on the right. * `remove`: To delete the header. Both the header value and the header itself will be removed. * `rename`: To change the header name. Specify the new header name in the field on the right. The header value will not change. If required, click **Change header** to add new rows if you need to modify multiple headers at once. 1. Click **Add route** and do the following in the **New route** form that opens: 1. In the **Name** field, specify the name of the route you are creating. Follow these naming requirements: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. 1. In the **Type** field, select `HTTP`. 1. In the **Path** field, select one of the options: * `Matches`: To route requests with the same path as the one specified in the text box on the right. For example, to route all requests, specify the `/` path. * `Starts with`: To route requests whose path begins with the prefix specified in the text box on the right. * `Regular expression`: To route requests whose path matches the [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression) specified in the text box on the right, e.g., `\/[a-z]{10}[0-9]{3}`. 1. In the **HTTP methods** field, select the HTTP [methods](https://en.wikipedia.org/wiki/HTTP#Request_methods) for which to route the requests. 1. In the **Action** field, select one of the options: `Routing`, `Forward`, or `Response`. Depending on the selected option: {% list tabs %} - Routing * In the **Backend group** field, select a [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host for which you are creating the new route. * Optionally, in the **Rewrite path or start** field, specify the path the HTTP router should redirect traffic to. If you select `Matches` in the **Path** field, the path will be completely replaced. If you select `Starts with`, only the prefix will be changed. * Optionally, in the **Host header rewrite** field, select one of these options: * `none`: The Host header in the request does not change. * `rewrite`: The Host header is replaced with the specified value. * `auto`: The Host header in the request is automatically replaced with the target [VM](../../compute/concepts/vm.md) address. * Optionally, enable **Limit on all requests** and/or **Limit on requests from one IP** and set these limits for the number of requests that will be processed for this route per unit of time. * Optionally, in the **Timeout, s** field, specify the maximum connection time. * Optionally, in the **Idle timeout, seconds** field, specify the maximum connection idle timeout (keep-alive time). * Optionally, in the **Valid values for the Upgrade header** field: * Optionally, list the protocols the backend group can switch to within a TCP connection on client's request. To add more protocols, click **Add upgrade type**. * Optionally, enable **WebSocket** if you want to use the [WebSocket](https://en.wikipedia.org/wiki/WebSocket) protocol. - Forward * In the **HTTP status code** field, select the HTTP forwarding status code: * `301 Moved Permanently` * `302 Found` * `303 See Other` * `307 Temporary Redirect` * `308 Permanent Redirect` * Optionally, enable **Rewrite path or start** and specify the modification type of the path the HTTP router should redirect traffic to: * `Entire path`: To completely replace the request path with the value set in the field on the right. * `Start`: To replace the request path prefix with the value set in the field on the right. {% note info %} If you select `Matches` in the **Path** field above, the path will be completely replaced, even with `Start` selected in the **Rewrite path or start** field. {% endnote %} * Optionally, enable **Delete query parameters** to remove all query parameters from requests. * Optionally, enable **Replace scheme** to replace the scheme found in requests with the one specified in the field on the right. If the original URI uses the `http` (`https`) scheme and port `80` (`443`), changing the scheme will delete the port. * Optionally, enable **Replace host** and specify the new host in the field on the right. * Optionally, enable **Replace port** and specify the new port in the field on the right. - Response * In the **HTTP status code** field, select the static response code to return. * In the **Response body** field, set the static response body to return. To do this, click **Select** and in the window that opens: * In the **Method** field, select: * `File`: To select a text file containing the response body. * `Text`: To enter the response text in the relevant text box. * Click **Add**. {% endlist %} 1. Click **Create**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. See the description of the [CLI](../../cli/index.md) command for creating an HTTP router: ```bash yc alb http-router create --help ``` 1. Run this command: ```bash yc alb http-router create ``` Result: ```text id: a5dcsselagj4******** name: test-http-router folder_id: aoerb349v3h4******** created_at: "2021-02-11T21:04:59.438292069Z" ``` 1. See the description of the CLI command for creating a virtual host: ```bash yc alb virtual-host create --help ``` 1. Create a virtual host by specifying its name and these settings: ```bash yc alb virtual-host create \ --http-router-name \ --authority ,,..., \ --modify-request-header name=Accept-Language,append=ru-RU \ --modify-response-header name=Accept-Charset,replace=utf-8 \ --rate-limit rps=100,all-requests \ --security-profile-id ``` Where: * `--http-router-name`: HTTP router name. Instead of the HTTP router name, you can provide its ID in the `--http-router-id` parameter. * `--authority`: List of domains for the `Host` header (HTTP/1.1) or the `authority` pseudo-header (HTTP/2) associated with this virtual host, comma-separated. You can use wildcards, e.g., `*.foo.com` or `*-bar.foo.com`. For gRPC traffic, you may specify the load balancer's IP address. This is an optional parameter. If not specified, all traffic will be routed to this virtual host. * `--modify-request-header`: Request HTTP header modification settings in `=` format. Available properties: * `name`: Modified header name, e.g., `Host`, `User-Agent`, `X-Forwarded-For`, `Strict-Transport-Security`, etc. * `append`: Add a row to the current header value. * `replace`: Completely replace the current header value. * `rename`: Change the header name. The header value will not change. * `remove`: Delete the header. Both the header value and the header itself will be removed. To modify multiple HTTP headers in a request, include `--modify-request-header` as many times as needed. This is an optional parameter; if omitted, request headers go to the backend unchanged. * `--modify-response-header`: Response HTTP header modification settings in `=` format. Available properties: * `name`: Modified header name, e.g., `Host`, `User-Agent`, `X-Forwarded-For`, `Strict-Transport-Security`, etc. * `append`: Add a row to the current header value. * `replace`: Completely replace the current header value. * `rename`: Change the header name. The header value will not change. * `remove`: Delete the header. Both the header value and the header itself will be removed. To modify multiple HTTP headers in a response, include `--modify-response-header` as many times as needed. This is an optional parameter; if omitted, response headers go to the client unchanged. * `--rate-limit`: Request rate limit. Available properties: * `rps` or `rpm`: Number of incoming requests per second or per minute. * `all-requests`: Limits all incoming requests. * `requests-per-ip`: Applies the limit per client IP address. You can configure only one type of rate limit per virtual host, either `all-requests` or `requests-per-ip`. This is an optional parameter; if not specified, no rate limiting is applied. * `--security-profile-id`: [Yandex Smart Web Security](../../smartwebsecurity/index.md) [security profile](../../smartwebsecurity/concepts/profiles.md) ID. A security profile allows you to filter incoming requests, enable [WAF](../../smartwebsecurity/concepts/waf.md), and set limits on the number of requests for protection against malicious activity. Learn more [here](../../smartwebsecurity/concepts/profiles.md). This is an optional parameter. Result: ```text name: test-virtual-host authority: - example.com - example.org modify_request_headers: - name: Accept-Language append: ru-RU - name: Accept-Charset replace: utf-8 route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "100" ``` 1. See the description of the CLI command for adding a route to the end of the virtual host's route list: ```bash yc alb virtual-host append-http-route --help ``` 1. Add the route by specifying its name and additional parameters: ```bash yc alb virtual-host append-http-route \ --http-router-name \ --virtual-host-name \ --match-http-method ,,... \ --exact-path-match \ --prefix-path-match \ --regex-path-match \ --backend-group-name \ --request-timeout s \ --request-idle-timeout s \ --rate-limit rps=,requests-per-ip \ --disable-security-profile ``` Where: * `--http-router-name`: Name of the HTTPS router you are creating the route in. Instead of the HTTP router name, you can provide its ID in the `--http-router-id` parameter. * `--virtual-host-name`: Name of the virtual host where the route is created. * `--match-http-method`: List of HTTP [methods](https://en.wikipedia.org/wiki/HTTP#Request_methods) for which requests need to be routed, e.g., `--match-http-method GET,POST,OPTIONS`. This is an optional parameter. If not specified, requests with any methods will be routed. * Parameters with path-based routing conditions: * `--exact-path-match`: Route requests with the same path as the specified one. For example, to route all requests, specify the `/` path. * `--prefix-path-match`: Route requests whose path starts with the specified prefix, e.g., `/myapp/`. * `--regex-path-match`: Route requests whose path matches the specified [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression), e.g., `\/[a-z]{10}[0-9]{3}\/`. {% note info %} The `--exact-path-match`, `--prefix-path-match`, and `--regex-path-match` parameters are mutually exclusive: you can use only one of them. {% endnote %} * `--backend-group-name`: Name of the [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host for which you are creating the new route. Instead of the backend group name, you can provide its ID in the `--backend-group-id` parameter. * `--request-timeout`: Maximum connection time in seconds for a connection on request. * `--request-idle-timeout`: Maximum connection idle time in seconds. * `--rate-limit`: Request rate limit. Available properties: * `rps` or `rpm`: Number of incoming requests per second or per minute. * `all-requests`: Limits all incoming requests. * `requests-per-ip`: Limits requests per client IP address. You can configure only one type of rate limit per route, either `all-requests` or `requests-per-ip`. This is an optional parameter; if not specified, no rate limiting is applied. * `--disable-security-profile`: Parameter that disables the use of the virtual host’s [Yandex Smart Web Security](../../smartwebsecurity/index.md) [profile](../../smartwebsecurity/concepts/profiles.md) for the route. A security profile allows you to filter incoming requests, enable [WAF](../../smartwebsecurity/concepts/waf.md), and set limits on the number of requests for protection against malicious activity. For more information, see [Security profiles](../../smartwebsecurity/concepts/profiles.md). This is an optional parameter. By default, the security profile associated with a virtual host applies to all routes you create. {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-route http: match: path: prefix_match: / route: backend_group_id: ds7dnf2s5dco******** timeout: 60s auto_host_rewrite: false - name: my-second-route http: match: http_method: - GET - POST - OPTIONS path: exact_match: / route: backend_group_id: ds7dnf2s5dco******** timeout: 2s idle_timeout: 5s rate_limit: requests_per_ip: per_second: "10" disable_security_profile: true modify_request_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "100" ``` {% endcut %} For detailed information about the `yc alb virtual-host append-http-route` command with the full list of properties, see the [CLI reference](../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/append-http-route.md). - Terraform {#tf} With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed. Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license. For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md). If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method. 1. In the configuration file, specify your HTTP router and virtual host settings: ```hcl resource "yandex_alb_http_router" "tf-router" { name = "" labels = { tf-label = "tf-label-value" empty-label = "" } } resource "yandex_alb_virtual_host" "my-virtual-host" { name = "" http_router_id = yandex_alb_http_router.tf-router.id rate_limit { all_requests { per_second = # or per_minute = } requests_per_ip { per_second = # or per_minute = } } route { name = "" disable_security_profile = true|false http_route { http_match { http_method = ["","",...,""] path { prefix = "//" # or exact = "" # or regex = "" } } http_route_action { backend_group_id = "" host_rewrite = "" timeout = "s" idle_timeout = "s" prefix_rewrite = "/" rate_limit { all_requests { per_second = # or per_minute = } requests_per_ip { per_second = # or per_minute = } } } } } authority = ["","",...,""] modify_request_headers { name = "" append = "" # or replace = "" # or remove = true|false } modify_response_headers { name = "" append = "" # or replace = "" # or remove = true|false } route_options { security_profile_id = "" } } ``` Where: * `yandex_alb_http_router`: HTTP router description. * `name`: HTTP router name. Follow these naming requirements: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. * `labels`: HTTP router [labels](../../resource-manager/concepts/labels.md). Specify a key-value pair. * `yandex_alb_virtual_host`: Virtual host description: * `name`: Virtual host name. Follow these naming requirements: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. * `http_router_id`: HTTP router ID. * `rate_limit`: Request rate limit for the entire virtual host (optional). * `all_requests`: Limit on all requests per second or per minute (optional): * `per_second`: Maximum number of incoming requests to the virtual host per second. * `per_minute`: Maximum number of incoming requests to the virtual host per minute. The `per_second`, and `per_minute` parameters are mutually exclusive: you can use only one of them. * `requests_per_ip`: Additionally limits requests for each IP address per second or per minute (optional): * `per_second`: Maximum number of incoming requests from a single IP address to the virtual host per second. * `per_minute`: Maximum number of incoming requests from a single IP address to the virtual host per minute. The `per_second`, and `per_minute` parameters are mutually exclusive: you can use only one of them. * `route`: Virtual host route description: * `name`: Route name. * `disable_security_profile`: Disabling the [Yandex Smart Web Security](../../smartwebsecurity/index.md) [security profile](../../smartwebsecurity/concepts/profiles.md) (optional). The possible values are `true` (the profile is disabled) or `false` (the profile is enabled). The default value is `false`: the security profile is enabled. * `http_route`: Route description for HTTP traffic: * `http_match`: Parameter for filtering incoming HTTP requests (optional): * `http_method`: List of HTTP [methods](https://en.wikipedia.org/wiki/HTTP#Request_methods) for which requests will be routed (optional). By default, requests with any methods are routed. * `path`: Optionally, parameters for filtering the path of an incoming request: * `exact`: Route requests with the same path as the specified one. For example, to route all requests, specify the `/` path. * `prefix`: Route requests whose path starts with the specified prefix. * `regex`: Route requests whose path matches the specified [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression), e.g., `\/[a-z]{10}[0-9]{3}\/`. The `exact`, `prefix`, and `regex` parameters are mutually exclusive: you can use only one of them. * `http_route_action`: Action applied to HTTP traffic. * `backend_group_id`: ID of the [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host of the new route. * `host_rewrite`: Replacing the Host header in the request with the specified value (optional). You specify the `auto_host_rewrite` parameter instead of the `host_rewrite` parameter; in this case the Host header in the request will be automatically replaced with the address of the target [VM](../../compute/concepts/vm.md). * `timeout`: Maximum connection time in seconds (optional). The default value is 60 seconds. * `idle_timeout`: Maximum connection idle timeout (keep-alive time) (optional). If not specified, the idle connection will be terminated immediately. * `prefix_rewrite`: Value to replace the path or part of the path specified in the `path` parameter (optional). * `rate_limit`: Limits the number of requests per unit of time (optional): * `all_requests`: Limits all incoming requests (optional): * `per_second`: Maximum number of incoming requests to a route per second. * `per_minute`: Maximum number of incoming requests to a route per minute. The `per_second`, and `per_minute` parameters are mutually exclusive: you can use only one of them. * `requests_per_ip`: Limits incoming requests from a single IP address (optional): * `per_second`: Maximum number of incoming requests to a route from a single IP address per second. * `per_minute`: Maximum number of incoming requests to a route from a single IP address per minute. The `per_second`, and `per_minute` parameters are mutually exclusive: you can use only one of them. * `authority`: HTTP/1.1 `Host` (HTTP/2 `authority`) header domains associated with this virtual host. You can use wildcards, e.g., `*.foo.com` or `*-bar.foo.com`. For gRPC traffic, you may specify `*` or the the load balancer's IP address. This is an optional parameter. If not specified, all traffic will be routed to this virtual host. * `modify_request_headers`: HTTP request header modification settings. Possible parameters: * `name`: Modified header name, e.g., `Host`, `User-Agent`, `X-Forwarded-For`, `Strict-Transport-Security`, etc. * `append`: Add a row to the current header value. * `replace`: Completely replace the current header value. * `remove`: Delete the header. Both the header value and the header itself will be removed. The possible values are `true` or `false`. This is an optional parameter; if omitted, request headers are provided to the backend unchanged. * `modify_response_headers`: HTTP response header modification settings. Possible parameters: * `name`: Modified header name, e.g., `Host`, `User-Agent`, `X-Forwarded-For`, `Strict-Transport-Security`, etc. * `append`: Add a row to the current header value. * `replace`: Completely replace the current header value. * `remove`: Delete the header. Both the header value and the header itself will be removed. The possible values are `true` or `false`. This is an optional parameter; if omitted, response headers are provided to the client unchanged. * `route_options`: Additional virtual host parameters (optional): * `security_profile_id`: Security profile ID. A security profile allows you to filter incoming requests, enable [WAF](../../smartwebsecurity/concepts/waf.md), and set limits on the number of requests for protection against malicious activity. For more information, see [Security profiles](../../smartwebsecurity/concepts/profiles.md). For more information on the properties of Terraform resources, see these provider guides: * [yandex_alb_http_router](../../terraform/resources/alb_http_router.md) * [yandex_alb_virtual_host](../../terraform/resources/alb_virtual_host.md) 1. Create the resources: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. Terraform will create all the required resources. You can check your new resources and their settings in the [management console](https://console.yandex.cloud) or using this [CLI](../../cli/index.md) command: ```bash yc alb http-router get ``` {% note warning "Timeouts" %} The Terraform provider limits the execution time for operations with Application Load Balancer HTTP routers and virtual hosts to 10 minutes. Operations in excess of this time will be interrupted. {% cut "How do I modify these limits?" %} Add the `timeouts` section to the descriptions of the HTTP router and virtual host (the `yandex_alb_http_router` and `yandex_alb_virtual_host` resources, respectively). Here is an example: ```hcl resource "yandex_alb_http_router" "" { ... timeouts { create = "60m" update = "60m" delete = "60m" } } ``` {% endcut %} {% endnote %} - API {#api} Use the [create](../api-ref/HttpRouter/create.md) REST API method for the [HttpRouter](../api-ref/HttpRouter/index.md) resource or the [HttpRouterService/Create](../api-ref/grpc/HttpRouter/create.md) gRPC API call. {% endlist %}