Sold by: Lynxroute
Deployed on AWS
Free Trial
This product has charges associated with it for hardening, security configuration, and support.
HAProxy is the industry-standard single-binary TCP and HTTP load balancer and reverse proxy, built from the official 3.4 LTS source against the system OpenSSL 3 library. Unlike bare HAProxy AMIs that ship an older distribution build, terminate no TLS, leave the statistics page open with no password, and hand you an empty configuration, this Lynxroute build is ready out of the box: HTTPS terminated on port 443 with a per-instance certificate, a password-protected stats dashboard bound to loopback, a healthy default config that boots and answers immediately, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base.
GPL-2.0 license - fully auditable, no vendor lock-in.
Overview
This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.
WHAT IS HAPROXY
HAProxy is the world's most widely deployed open-source software load balancer and reverse proxy - a single, high-performance C binary trusted for its reliability at scale. It balances TCP and HTTP/HTTPS traffic across pools of backend servers with active and passive health checks, multiple balancing algorithms (round-robin, leastconn, source, URI hash), sticky sessions, connection queuing, rate limiting, ACL-based routing, and request and response header rewriting. This image builds HAProxy 3.4 LTS from the official release source linked against the system OpenSSL 3 library, so it terminates TLS itself with no separate web server, and exposes a built-in real-time statistics and administration dashboard. A Lua scripting engine, PCRE2 regular expressions, and zlib compression are compiled in. GPL-2.0 license, no vendor lock-in.
WHAT THIS AMI ADDS
Security hardening:
- Per-instance self-signed TLS certificate generated at first boot - HTTPS works immediately on port 443; drop in your own PEM or a Let's Encrypt certificate any time
- Statistics and administration dashboard bound to 127.0.0.1 only, protected by a strong password generated at first boot - reach it over an SSH tunnel, never exposed to the network
- Healthy default configuration - the instance boots and answers on ports 80 and 443 with no backend configured; you edit one section to route to your own servers
- UFW firewall - SSH on 22, proxied traffic on 80 and 443 only
- fail2ban, AppArmor
- CVE scan - every image is scanned for vulnerabilities before release
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, SSH hardening, Kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Highlights
- HAProxy security baked in: a per-instance TLS certificate and HTTPS on port 443 at first boot, a password-protected stats dashboard bound to loopback, and a healthy default config that boots ready - unlike bare HAProxy AMIs that terminate no TLS, leave the stats page open with no password, and ship an older distribution build you must configure from an empty file.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- High-performance TCP and HTTP load balancing and reverse proxy: active health checks, multiple balancing algorithms, ACL routing, rate limiting, TLS termination, and Lua scripting, built from the official 3.4 LTS source. GPL-2.0 license - fully auditable, no vendor lock-in.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.small Recommended | $0.03 |
m6i.large | $0.05 |
m6i.xlarge | $0.05 |
t3.large | $0.05 |
t3.medium | $0.05 |
Dimensions summary
You pay by the hour based on the EC2 instance size you launch. Five instance types are available: t3.small, t3.medium, and t3.large run on burstable general-purpose hardware, while m6i.large and m6i.xlarge run on fixed-performance general-purpose hardware. Pricing scales with the compute capacity of each instance, so bigger sizes cost more per hour. All options run the same hardened load balancer image. Choose the instance that matches your traffic and performance needs. Billing is metered hourly through AWS, with no upfront commitment.
Top-of-mind questions for buyers
Each instance runs on an EC2 virtual machine of the size you pick. The t3 sizes (small, medium, large) use burstable CPUs that flex under load. The m6i sizes (large, xlarge) deliver fixed, steady CPU performance. Every option boots the same hardened load balancer image on Ubuntu 24.04 LTS.
Software charges accrue only while the instance runs. A fully stopped instance stops the hourly software meter. You may still pay underlying AWS storage fees for the attached disk while stopped. Charges resume automatically when you start the instance again.
Every instance ships CIS Level 1 hardened with SSH hardening, kernel hardening, a firewall, and intrusion prevention pre-configured. It includes a CycloneDX SBOM and CIS Conformance Report stored on the instance. Unique credentials generate at first boot. These artifacts are the same across all five instance sizes.
lynxroute.com
Helpful?
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
HAProxy 3.4.0 - Initial release (June 2026)
- HAProxy 3.4.0 LTS on Ubuntu 24.04 LTS, built from official source against the system OpenSSL 3 library
- TLS terminated on port 443 with a per-instance self-signed certificate generated at first boot
- Password-protected statistics and administration dashboard bound to loopback (127.0.0.1:8404)
- Healthy default configuration - boots and answers on ports 80 and 443 with no backend configured
- CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
- CVE-scanned before every release
- UFW firewall pre-configured (ports 22, 80, 443 only)
- fail2ban, auditd, AppArmor pre-configured
- SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
- CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
- IMDSv2 enforced
Additional details
Usage instructions
- Launch instance (t3.small recommended)
- Open Security Group - allow TCP 80 and TCP 443 from your clients, and TCP 22 from your IP
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read credentials: sudo cat /root/haproxy-credentials.txt
- Open https://<PUBLIC_IP>/ in your browser - accept the self-signed certificate warning
- Route to your backends: edit the "sample_backend" section in /etc/haproxy/haproxy.cfg (replace the placeholder with your "server name ip:port check" lines), then run: sudo systemctl reload haproxy
The statistics and administration dashboard is bound to localhost only. Reach it over an SSH tunnel: ssh -L 8404:127.0.0.1:8404 -i key.pem ubuntu@<PUBLIC_IP> then open http://127.0.0.1:8404/ and log in with user "admin" and the password from the credentials file.
The port 443 frontend uses a per-instance self-signed certificate. For production, drop in your own certificate at /etc/haproxy/certs/default.pem (full chain + private key concatenated into one PEM) and reload, or obtain a free Let's Encrypt certificate with the certbot standalone plugin.
Credentials are saved to /root/haproxy-credentials.txt at first boot.
Resources
Vendor resources
Support
Vendor support
This AMI packages the community open-source HAProxy distribution (GPL-2.0) as a self-hosted, hardened EC2 image. Lynxroute is an independent publisher and is not affiliated with the upstream HAProxy project or its maintainers.
Visit us online: https://lynxroute.com
For HAProxy documentation: https://docs.haproxy.org/3.4/configuration.html For HAProxy upstream issues:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
This product has charges associated with it for image hardening, maintenance, and support. HAProxy on Amazon Linux 2023, security-hardened for production: minimal package set, SSH key-only access, IMDSv2-only, firewall pre-configured for HTTP/HTTPS, and continuously patched images.
HAProxy Enterprise is a fast, flexible, and reliable software load balancer. It features SSL termination and offloading, multi-layered security including a web application firewall (WAF), detailed observability, application acceleration, and robust administration. HAProxy Enterprise is backed by authoritative support and professional services.
HAProxy Enterprise is a fast, flexible, and reliable software load balancer. It features SSL termination and offloading, multi-layered security including a web application firewall (WAF), detailed observability, application acceleration, and robust administration. HAProxy Enterprise is backed by authoritative support and professional services.
HAProxy Technologies offers widely used software load balancer to deliver websites and applications with the utmost performance, observability, and security at any scale and in any environment.
HAProxy Enterprise is a fast, flexible, and reliable software load balancer. It features SSL termination and offloading, multi-layered security including a web application firewall (WAF), detailed observability, application acceleration, and robust administration. HAProxy Enterprise is backed by authoritative support and professional services.
HAProxy Enterprise is a fast, flexible, and reliable software load balancer. It features SSL termination and offloading, multi-layered security including a web application firewall (WAF), detailed observability, application acceleration, and robust administration. HAProxy Enterprise is backed by authoritative support and professional services.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.