Network Load Balancer (NLB) in AWS - Deep Dive

Overview - Network Load Balancer (NLB)

What is it?

A Network Load Balancer (NLB) is a service that directs internet or internal traffic to multiple servers to balance the load. It works at the connection level, handling millions of requests quickly and efficiently. NLB helps keep applications available and responsive by spreading traffic evenly. It is designed to handle sudden and volatile traffic patterns smoothly.

Why it matters

Without NLB, a single server could become overwhelmed by too many requests, causing slow responses or crashes. This would make websites or apps unreliable and frustrating to use. NLB ensures traffic is shared fairly, improving speed and uptime, which is critical for businesses and users who expect fast, always-on services.

Where it fits

Before learning about NLB, you should understand basic networking concepts like IP addresses and TCP connections. After NLB, you can explore other load balancing types like Application Load Balancers (ALB) and how they differ. Later, you might learn about auto-scaling and how NLB works with it to handle growing traffic.

Mental Model

Core Idea

A Network Load Balancer acts like a smart traffic cop that directs each connection to the best available server to keep the flow smooth and fast.

Think of it like...

Imagine a busy toll booth on a highway with multiple lanes. The toll operator directs each car to the lane with the shortest line to keep traffic moving quickly without jams.

┌───────────────┐       ┌───────────────┐
│   Clients     │──────▶│ Network Load  │
│ (Internet)    │       │  Balancer     │
└───────────────┘       └──────┬────────┘
                                │
          ┌─────────────────────┼─────────────────────┐
          │                     │                     │
  ┌───────────────┐     ┌───────────────┐     ┌───────────────┐
  │   Server 1    │     │   Server 2    │     │   Server 3    │
  └───────────────┘     └───────────────┘     └───────────────┘

Build-Up - 7 Steps

1

Foundation

What is a Load Balancer?

Concept: Introduction to the idea of distributing traffic to multiple servers.

A load balancer is a tool that shares incoming requests among several servers. This prevents any one server from getting too busy and helps keep websites or apps running smoothly. Think of it as a helper that spreads work evenly.

Result

You understand that load balancers help manage traffic to avoid overload on a single server.

Knowing the basic role of load balancers sets the stage for understanding why NLBs are important for handling large volumes of network traffic.

2

Foundation

Basics of Network Traffic and Connections

Concept: Understanding how network connections work at a low level.

Network traffic is made up of connections between clients and servers using IP addresses and ports. Each connection is like a phone call that needs to be answered and managed. NLB works by managing these connections efficiently.

Result

You grasp that NLB operates at the connection level, handling each network call individually.

Understanding connections helps you see why NLB focuses on speed and low latency for each network request.

3

Intermediate

How Network Load Balancer Works

🤔Before reading on: do you think NLB inspects the content of requests or just directs connections? Commit to your answer.

Concept: NLB directs traffic based on connection information without looking inside the data.

NLB listens for incoming connections on a specific IP and port. It then forwards each connection to one of the healthy backend servers. It does not inspect the content of the traffic, which makes it very fast and suitable for TCP or UDP protocols.

Result

You see that NLB is optimized for speed by handling connections without deep inspection.

Knowing that NLB works at the connection level explains why it can handle millions of requests with low latency.

4

Intermediate

Health Checks and Server Availability

🤔Before reading on: do you think NLB sends traffic to servers even if they are down? Commit to your answer.

Concept: NLB regularly checks if backend servers are healthy before sending them traffic.

NLB performs health checks by sending simple requests to servers. If a server does not respond correctly, NLB stops sending it traffic until it recovers. This ensures users only connect to working servers.

Result

You understand that NLB improves reliability by avoiding unhealthy servers.

Understanding health checks helps you see how NLB maintains high availability and prevents user disruptions.

5

Intermediate

Static IP and High Availability

Concept: NLB provides a fixed IP address and can handle failures without downtime.

Unlike some load balancers, NLB offers a static IP address that clients can always use. It also runs across multiple availability zones, so if one zone fails, traffic is routed to others without interruption.

Result

You learn that NLB supports stable connections and fault tolerance.

Knowing about static IPs and multi-zone support explains why NLB is trusted for critical applications.

6

Advanced

Handling Sudden Traffic Spikes

🤔Before reading on: do you think NLB can handle sudden bursts of millions of connections smoothly? Commit to your answer.

Concept: NLB is designed to scale instantly to handle sudden large increases in traffic.

NLB uses a highly optimized architecture that can process millions of new connections per second. It does this by distributing load across many servers and availability zones automatically, without manual intervention.

Result

You realize NLB can keep applications responsive even during unexpected traffic surges.

Understanding NLB's scaling ability shows why it is ideal for unpredictable workloads like gaming or IoT.

7

Expert

Preserving Source IP and Protocol Transparency

🤔Before reading on: do you think NLB changes the client’s IP address when forwarding traffic? Commit to your answer.

Concept: NLB preserves the original client IP and supports TCP/UDP protocols transparently.

Unlike some load balancers, NLB forwards traffic without changing the source IP address. This allows backend servers to see the real client IP, which is important for logging and security. It also supports protocols like UDP that other load balancers may not handle well.

Result

You understand that NLB provides protocol-level transparency and accurate client information.

Knowing this helps you design systems that require client IP visibility and support non-HTTP protocols.

Under the Hood

NLB operates at the transport layer (Layer 4) of the network stack. It listens on a static IP and port, accepts incoming TCP or UDP connections, and forwards them to backend servers using flow hashing to maintain connection consistency. It uses health checks to monitor server status and routes traffic only to healthy targets. NLB is built on a highly scalable, distributed architecture that can handle millions of connections with minimal latency by avoiding deep packet inspection.

Why designed this way?

NLB was designed to handle extreme scale and volatile traffic patterns common in modern applications like gaming, IoT, and real-time communications. By operating at Layer 4, it avoids the overhead of inspecting application data, enabling ultra-low latency and high throughput. Alternatives like Application Load Balancers inspect HTTP data but are slower and less suitable for non-HTTP protocols. The static IP and multi-zone design ensure reliability and ease of integration with existing network setups.

┌───────────────┐
│ Client Request│
└───────┬───────┘
        │
┌───────▼─────────────┐
│ Network Load Balancer│
│ (Layer 4 Transport) │
└───────┬───────┬─────┘
        │       │
  ┌─────▼─┐ ┌───▼────┐
  │Server1│ │ Server2 │
  └───────┘ └────────┘

Health Checks monitor servers and update routing dynamically.

Myth Busters - 4 Common Misconceptions

Quick: Does NLB inspect HTTP headers to route traffic? Commit to yes or no.

Common Belief: NLB inspects HTTP headers to make routing decisions like an Application Load Balancer.

Reality: NLB only routes based on network-level information like IP and port; it does not inspect HTTP headers.

Why it matters: Believing this leads to using NLB for application-level routing, causing unexpected behavior and security gaps.

Quick: Can NLB change the source IP address of incoming traffic? Commit to yes or no.

Common Belief: NLB changes the client’s IP address to its own when forwarding traffic to backend servers.

Reality: NLB preserves the original client IP address, allowing backend servers to see who connected.

Why it matters: Misunderstanding this causes incorrect assumptions about logging, security, and IP-based access controls.

Quick: Does NLB automatically scale only after manual configuration? Commit to yes or no.

Common Belief: You must manually scale NLB to handle more traffic.

Reality: NLB automatically scales instantly to handle millions of connections without manual intervention.

Why it matters: Thinking manual scaling is needed can lead to overprovisioning or downtime during traffic spikes.

Quick: Is NLB suitable for routing HTTP requests based on URL paths? Commit to yes or no.

Common Belief: NLB can route HTTP requests based on URL paths or hostnames.

Reality: NLB cannot route based on HTTP content; this is the role of Application Load Balancers.

Why it matters: Using NLB for HTTP routing needs leads to misconfigured applications and failed requests.

Expert Zone

1

NLB’s flow hashing algorithm ensures that all packets from the same connection go to the same backend server, preserving session consistency without sticky sessions.

2

NLB supports static IP addresses and Elastic IPs, which is critical for integrating with firewall rules and whitelisting in enterprise environments.

3

NLB can handle both TCP and UDP traffic, making it versatile for protocols like DNS, gaming, and real-time communications that ALB cannot support.

When NOT to use

Avoid using NLB when you need advanced HTTP routing features like path-based or host-based routing, SSL termination, or WebSocket support. In those cases, use an Application Load Balancer (ALB) or Gateway Load Balancer. Also, for simple, low-traffic applications, a Classic Load Balancer might suffice.

Production Patterns

In production, NLB is often paired with auto-scaling groups to handle dynamic workloads. It is used for latency-sensitive applications like financial trading platforms or gaming servers. Enterprises use NLB with static IPs and security groups to tightly control network access. It is also common to combine NLB with ALB to separate TCP/UDP traffic from HTTP traffic.

Connections

Application Load Balancer (ALB)

Complementary technology with different focus layers

Understanding NLB helps clarify why ALB exists to handle application-level routing and features that NLB does not support.

TCP/IP Networking

Builds on fundamental network protocols

Knowing TCP/IP basics helps you grasp how NLB manages connections and why it operates at Layer 4 for speed.

Traffic Management in Urban Planning

Similar principles of load distribution and congestion avoidance

Seeing how city traffic lights and lane assignments optimize flow helps understand how NLB directs network traffic efficiently.

Common Pitfalls

#1 Sending traffic to unhealthy backend servers.

Wrong approach:

Configuring NLB without health checks or ignoring health check failures.

Correct approach:

Enable and configure health checks so NLB routes only to healthy servers.

Root cause:

Not understanding that NLB relies on health checks to maintain availability.

#2 Using NLB for HTTP routing based on URL paths.

Wrong approach:

Setting up NLB to route traffic by URL path expecting application-level routing.

Correct approach:

Use Application Load Balancer (ALB) for HTTP path-based routing instead.

Root cause:

Confusing NLB’s Layer 4 operation with ALB’s Layer 7 capabilities.

#3 Assuming NLB changes client IP addresses.

Wrong approach:

Designing backend servers to log NLB IP instead of client IP.

Correct approach:

Configure backend servers to read the preserved client IP from the connection.

Root cause:

Misunderstanding how NLB forwards traffic transparently.

Key Takeaways

Network Load Balancer (NLB) efficiently distributes network connections at the transport layer to keep applications fast and reliable.

NLB preserves the original client IP and supports TCP and UDP protocols, making it suitable for many real-time and non-HTTP applications.

It automatically scales to handle millions of connections and uses health checks to avoid sending traffic to unhealthy servers.

NLB provides a static IP and multi-zone availability for high fault tolerance and easy integration with network security.

For advanced HTTP routing and application-level features, use Application Load Balancer instead of NLB.

Practice

1. What is the primary purpose of an AWS Network Load Balancer (NLB)?

easy

A. To efficiently distribute TCP/UDP traffic at the connection level

B. To manage HTTP requests with advanced routing rules

C. To store and retrieve data in a scalable way

D. To provide a user interface for managing AWS resources

Solution

1. Step 1: Understand NLB's traffic handling

   NLB works at the connection level and handles TCP/UDP traffic efficiently.

2. Step 2: Compare with other AWS services

   Unlike Application Load Balancer, NLB does not manage HTTP features but focuses on low latency and high throughput for TCP/UDP.

3. Final Answer:

   To efficiently distribute TCP/UDP traffic at the connection level -> Option A

4. Quick Check:

   NLB purpose = TCP/UDP load balancing [OK]

Hint: NLB handles TCP/UDP, not HTTP features [OK]

Common Mistakes:

• Confusing NLB with Application Load Balancer
• Thinking NLB manages HTTP routing
• Assuming NLB stores data

2. Which of the following is a valid characteristic of an AWS Network Load Balancer (NLB)?

easy

A. Only supports HTTP and HTTPS protocols

B. Requires manual scaling for high traffic

C. Automatically modifies HTTP headers

D. Supports static IP addresses for the load balancer

Solution

1. Step 1: Identify NLB features

   NLB supports static IP addresses, which is useful for fixed IP requirements.

2. Step 2: Eliminate incorrect options

   NLB does not only support HTTP/HTTPS (it supports TCP/UDP), does not modify HTTP headers, and scales automatically.

3. Final Answer:

   Supports static IP addresses for the load balancer -> Option D

4. Quick Check:

   Static IP support = true for NLB [OK]

Hint: NLB supports static IPs, unlike ALB [OK]

Common Mistakes:

• Thinking NLB only supports HTTP/HTTPS
• Assuming NLB modifies HTTP headers
• Believing NLB requires manual scaling

3. Given an NLB configured to balance TCP traffic across three targets, what happens if one target becomes unhealthy?

medium

A. NLB stops sending traffic to the unhealthy target and continues with healthy ones

B. NLB sends traffic evenly to all targets regardless of health

C. NLB shuts down until the unhealthy target recovers

D. NLB redirects traffic to a backup Application Load Balancer

Solution

1. Step 1: Understand NLB health checks

   NLB performs health checks and routes traffic only to healthy targets.

2. Step 2: Analyze behavior on unhealthy target

   If a target is unhealthy, NLB excludes it from routing until it recovers.

3. Final Answer:

   NLB stops sending traffic to the unhealthy target and continues with healthy ones -> Option A

4. Quick Check:

   Health checks exclude unhealthy targets [OK]

Hint: NLB routes only to healthy targets [OK]

Common Mistakes:

• Assuming NLB sends traffic to unhealthy targets
• Thinking NLB stops completely on failure
• Believing NLB redirects to ALB automatically

4. You configured an NLB but notice it is not distributing UDP traffic as expected. What is the most likely cause?

medium

A. Health checks are disabled for the target group

B. The target group is configured for TCP instead of UDP

C. NLB does not support UDP traffic

D. NLB requires HTTP listeners for UDP traffic

Solution

1. Step 1: Check protocol configuration

   NLB supports UDP, but the target group must be set to UDP to handle UDP traffic.

2. Step 2: Identify misconfiguration

   If the target group is set to TCP, UDP traffic won't be routed correctly.

3. Final Answer:

   The target group is configured for TCP instead of UDP -> Option B

4. Quick Check:

   Target group protocol must match traffic [OK]

Hint: Match target group protocol to traffic type [OK]

Common Mistakes:

• Thinking NLB does not support UDP
• Ignoring target group protocol settings
• Assuming health checks cause traffic issues

5. You need to design a highly scalable system that requires static IP addresses and low latency for millions of TCP connections. Which AWS load balancer should you choose and why?

hard

A. Gateway Load Balancer, because it manages HTTP and TCP traffic with static IPs

B. Application Load Balancer, because it supports HTTP routing and static IPs

C. Network Load Balancer, because it supports static IPs and handles millions of TCP connections with low latency

D. Classic Load Balancer, because it is the newest and fastest option

Solution

1. Step 1: Identify requirements

   The system needs static IPs, low latency, and support for millions of TCP connections.

2. Step 2: Match requirements to load balancer features

   NLB supports static IPs, is designed for extreme scalability, and handles TCP traffic efficiently with low latency.

3. Step 3: Eliminate incorrect options

   ALB focuses on HTTP, Classic LB is older and less scalable, Gateway LB is for network appliances, not general TCP load balancing.

4. Final Answer:

   Network Load Balancer, because it supports static IPs and handles millions of TCP connections with low latency -> Option C

5. Quick Check:

   Static IP + TCP + scalability = NLB [OK]

Hint: For static IP and TCP scale, choose NLB [OK]

Common Mistakes:

• Choosing ALB for TCP static IP needs
• Confusing Classic LB as newest
• Assuming Gateway LB handles general TCP load balancing