ALB, NLB and GWLB. What is each one for?
Show the answer
Say this first
An Application Load Balancer works at layer 7: it terminates HTTP and HTTPS, routes on host, path and headers, and always opens a new connection to the target, passing the client IP in X-Forwarded-For. A Network Load Balancer works at layer 4 for TCP, UDP and TLS, gives one static IP per AZ, handles very high rates with low latency, and can preserve the client IP. A Gateway Load Balancer sends traffic to firewall appliances inline, wrapped in GENEVE on UDP 6081.
Go deeper
| ALB | NLB | GWLB | |
|---|---|---|---|
| Layer | 7 (HTTP, HTTPS, gRPC) | 4 (TCP, UDP, TLS) | 3, transparent |
| Routing | Host, path, header, query, method | Port and protocol | All traffic to appliances |
| Static IP | No, use the DNS name | One per AZ, or Elastic IPs | Not addressed by clients |
| Client IP at target | In X-Forwarded-For | Preserved for instance targets by default | Original packet inside GENEVE |
| Typical use | Web apps, microservices, WAF | Non-HTTP, extreme rates, PrivateLink services | Inline firewalls and IDS |
Notes that come up
- ALB node addresses change. Partners who need a fixed IP get an NLB, or Global Accelerator in front.
- An NLB can be the front of a PrivateLink endpoint service; an ALB cannot by itself (you can put an ALB behind an NLB as a target).
- GWLB is used with GWLB endpoints placed as route targets in VPC route tables, so traffic is steered to the appliance fleet and back without changing addresses.
Other clouds
| AWS | Azure | GCP |
|---|---|---|
| ALB | Application Gateway (regional), Front Door (global) | Application Load Balancer |
| NLB | Azure Load Balancer (Standard) | Network Load Balancer, passthrough or proxy |
| GWLB | Gateway Load Balancer | Internal passthrough Network LB as a route next hop |
| Route 53 DNS steering | Traffic Manager | Cloud DNS routing policies |
They will ask next
Which one would you put in front of a gRPC service?
An ALB with a target group whose protocol version is gRPC, if I want per-request balancing and gRPC health checks. An NLB if I only need connection-level balancing, accepting that long-lived HTTP/2 connections pin to one target.
Why does the backend see the ALB's address as the source?
The ALB is a full proxy. It ends the client's TCP connection and opens its own to the target. The original client IP travels in
X-Forwarded-For.
Traps
- Saying an ALB has a static IP.
- Putting UDP traffic behind an ALB. An ALB speaks HTTP only; UDP services need an NLB.