Service comparisons / Application Load Balancer vs Network Load Balancer vs Gateway Load Balancer
ALB vs NLB vs Gateway Load Balancer
The Application Load Balancer routes HTTP requests by content, the Network Load Balancer handles TCP and UDP with static IPs and very low latency, and the Gateway Load Balancer inserts firewall appliances. Which to pick and why.
Last checked against AWS documentation · How we write our content
| Question | Application Load Balancer | Network Load Balancer | Gateway Load Balancer |
|---|---|---|---|
| Use it when | Web apps and APIs need routing by path, host or header | You need TCP or UDP, static IP addresses, or extreme performance | Traffic must pass through third-party virtual appliances such as firewalls |
| Layer | Layer 7 (HTTP, HTTPS, gRPC, WebSockets) | Layer 4 (TCP, UDP, TLS) | Layer 3 (IP packets, using the GENEVE protocol) |
| Static IP | No; use its DNS name (or put Global Accelerator in front) | Yes, one per AZ, and you can assign Elastic IPs | Not applicable; reached through Gateway Load Balancer endpoints |
| Extras | AWS WAF, user authentication with Cognito or OIDC, Lambda targets | Preserves client source IP; can front a PrivateLink endpoint service | Scales appliances and keeps flows sticky to one appliance |
| Watch out for | Can't be given an Elastic IP | Can't attach AWS WAF | Not for spreading app traffic across web servers |
Elastic Load Balancing has three current types. Scenarios usually give away the answer through one detail: the protocol, a need for fixed IPs, or a firewall appliance.
How to choose
- HTTP or HTTPS with routing rules (“send
/api/*to one target group and/images/*to another”, “route by hostname”): ALB. - Non-HTTP protocols, gaming over UDP, millions of requests per second, or clients that must allowlist fixed IPs: NLB.
- “Inspect all traffic with our third-party firewall appliances” in a scalable, highly available way: Gateway Load Balancer.
Exam traps
- “Protect the app with AWS WAF” rules out the NLB. Use an ALB, CloudFront or API Gateway.
- “Static IP and path-based routing” is Global Accelerator in front of an ALB, or an NLB with an ALB as its target.
- Sticky sessions keep a user on one target, but storing session state in ElastiCache or DynamoDB is the more resilient answer.
- With cross-zone load balancing on, each node spreads traffic across targets in all AZs, which evens out load when AZs have different numbers of targets.