Back to: AWS-Basics-Advanced

AWS Network Load Balancer (NLB) — From Basics to Advanced

While ALB operates at Layer 7 (Application Layer), a Network Load Balancer (NLB) works at Layer 4 (Transport Layer). It is designed for high-performance, low-latency, and TCP/UDP-based traffic.

NLB is ideal for applications that require extreme performance, static IPs, or TLS termination at the network layer.

1️⃣ What is a Network Load Balancer (NLB)?

Definition:
An NLB is a highly scalable, ultra-low latency load balancer that can handle millions of requests per second while maintaining TCP/UDP connections.

Key Benefits:

Operates at Layer 4 (TCP/UDP)
Handles volatile workloads with high throughput
Provides static IPs per AZ (Elastic IP optional)
Supports TLS termination
Integrates with Auto Scaling groups, ECS, and Lambda

Example Use Case:

Game servers
Real-time trading applications
IoT data ingestion services
Any service needing static IPs or extreme performance

2️⃣ Core Components of NLB

Component	Role
Network Load Balancer	Receives incoming traffic and routes it to targets.
Listeners	Protocol and port configuration (TCP, UDP, TLS).
Target Groups	Groups of targets (EC2, IP, Lambda) receiving traffic.
Targets	Actual resources serving the application.
Health Checks	Monitor the availability of targets.
Elastic IPs	Optional static IPs per AZ for clients.

3️⃣ Advanced Features

Static IP per AZ – Useful for firewall whitelisting
TLS Termination – Offload TLS at NLB and forward decrypted traffic
Preserve Source IP – Target can see the original client IP
Zonal Isolation – One NLB per AZ improves fault tolerance
Cross-Zone Load Balancing – Optional, spreads traffic across AZs
High Throughput – Millions of requests per second
Integration with ECS/EKS & Auto Scaling

4️⃣ Step-by-Step NLB Creation

Step 1: Create Network Load Balancer

Go to EC2 → Load Balancers → Create Load Balancer → Network Load Balancer
Configure:
- Name: MyNLB
- Scheme: Internet-facing / Internal
- IP Address Type: IPv4 / Dualstack
- Optional: Assign Elastic IPs per AZ for static IP

Step 2: Configure Listeners

Add listener(s) for TCP, UDP, or TLS (e.g., TCP 80, TLS 443)
TLS: Choose ACM certificate for TLS termination

Step 3: Configure Target Groups

Create target group(s):
- Protocol: TCP/UDP/TLS
- Target type: Instance, IP, Lambda
- Health check protocol: TCP (Layer 4) or HTTP/HTTPS (if TLS is terminated)

Step 4: Register Targets

Add your EC2 instances, IP addresses, or Lambda functions to the target group.

Step 5: Set Up Health Checks

Protocol: TCP (default) or custom
Port: Fixed or traffic port
Healthy threshold / Unhealthy threshold

Step 6: Attach Target Groups to Listeners

Go back to the listener → forward traffic to the target group(s)
You can also configure weighted target groups if needed

5️⃣ Sticky Sessions in NLB

Unlike ALB, NLB does not support HTTP cookies for sticky sessions because it works at Layer 4 (TCP/UDP).

Option for session stickiness:

Enable source IP affinity: NLB will consistently route traffic from the same client IP to the same target.

Steps to Enable Source IP Stickiness:

Open the target group → Attributes
Enable Source IP session stickiness
Set timeout (1–3600 seconds)

6️⃣ TLS Termination in NLB

NLB supports TLS termination at listener level
Steps:
- Choose TLS listener (e.g., port 443)
- Attach ACM certificate
- Forward decrypted traffic to target group via TCP
Useful for reducing SSL overhead on backend servers

7️⃣ Monitoring NLB

CloudWatch Metrics:
- ActiveFlowCount, NewFlowCount, ProcessedBytes, HealthyHostCount
Access Logs: NLB logs TCP/UDP flows to S3
Health Checks: Ensure targets are reachable

8️⃣ Best Practices

Use Elastic IPs for static IP requirements
Enable cross-zone load balancing for better distribution
Use TLS termination if backend instances cannot handle TLS
Monitor with CloudWatch alarms for traffic spikes and target failures
Combine NLB with ALB for hybrid architectures: NLB handles TCP/UDP traffic, ALB handles HTTP/S traffic

9️⃣ Comparison: ALB vs NLB

Feature	ALB	NLB
OSI Layer	7 (Application)	4 (Transport)
Protocol	HTTP/HTTPS	TCP/UDP/TLS
Routing	Host/Path/Header/Query	Source IP / Port
Sticky Sessions	Cookie-based	Source IP
TLS Termination	Yes	Yes
Static IP	No	Yes (Elastic IP)
Use Case	Web apps, microservices	Game servers, IoT, real-time apps

10️⃣ Conclusion

AWS Network Load Balancer (NLB) is perfect for high-performance, low-latency applications:

Supports TCP/UDP protocols
Offers static IP addresses per AZ
Can terminate TLS at the network layer
Supports source IP-based session stickiness

Use NLB when your application demands ultra-fast, scalable, and fault-tolerant network-level traffic routing, and combine with ALB when you need advanced Layer 7 features.

NLB(Network Load Balancer)