ALB vs NLB
AWS Elastic Load Balancing offers specialized balancers for different architectural requirements. The Application Load Balancer (ALB) operates at Layer 7 of the OSI model, inspecting HTTP/HTTPS traffic for intelligent content routing. The Network Load Balancer (NLB) operates at Layer 4, forwarding raw TCP, UDP, and TLS connections with ultra-high throughput and sub-millisecond latency.
Application Load Balancer (ALB)
Layer 7 Smart HTTP/HTTPS Content Router
Strengths
- •Advanced routing based on HTTP path, host header, query strings, and HTTP request methods
- •Native integration with AWS WAF for Layer 7 web security and DDoS inspection
- •Built-in user authentication through any OIDC provider or Amazon Cognito (which can federate SAML)
- •Redirect and fixed-response actions without forwarding traffic to backend targets
Weaknesses
- •Higher latency (low milliseconds) due to deep HTTP packet inspection
- •No static IP addresses (dynamic DNS names; static IPs need Global Accelerator or an NLB in front of the ALB)
- •Limited to HTTP, HTTPS, and gRPC protocols (cannot balance raw TCP/UDP streams)
Best For:
Microservice architectures, web applications, containerized HTTP services, and routing rules based on URL paths or host headers.
Network Load Balancer (NLB)
Layer 4 Ultra-High Throughput TCP/UDP/TLS Balancer
Strengths
- •Extreme throughput capable of handling millions of requests per second with sub-millisecond latency
- •Assigns one static Elastic IP address per Availability Zone for firewall allowlisting
- •Can preserve the client source IP at the packet level (on by default for instance targets)
- •Supports non-HTTP protocols including raw TCP, UDP, and TLS passthrough
Weaknesses
- •No Layer 7 content inspection (cannot route based on URL paths or HTTP headers)
- •Cannot directly integrate with AWS WAF without an ALB behind it
- •Target health checks are limited to TCP handshakes and basic HTTP status pings
Best For:
High-performance computing, financial exchanges, IoT MQTT gateways, gaming servers, and architectures requiring static IP addresses.
Feature Comparison
| Aspect | Application Load Balancer (ALB) | Network Load Balancer (NLB) |
|---|---|---|
| OSI Layer | Layer 7 (Application - HTTP, HTTPS, gRPC) | Layer 4 (Transport - TCP, UDP, TLS) |
| Routing Capabilities | Path-based, host-based, header, and query parameter routing | Port, protocol, and listener routing only |
| IP Addressing | Dynamic DNS names with changing IPs (static IPs need Global Accelerator or an NLB in front) | Dedicated static Elastic IP address per Availability Zone |
| Performance & Latency | Milliseconds; auto-scales horizontally (pre-warming needed for sudden spikes) | Sub-millisecond; handles sudden million-request spikes instantly |
| Client IP Preservation | Injects X-Forwarded-For and X-Forwarded-Proto HTTP headers | Preserves source client IP natively at the packet level |
| Security Integration | Native AWS WAF attachment, SSL policy selection, OIDC auth | TLS termination or passthrough; AWS WAF not supported at Layer 4 |
Architecture Rule of Thumb
Connect the choice to business and networking constraints. When an interviewer asks to connect partner companies through corporate firewall rules, recommend NLB for its static Elastic IPs. When they describe a microservices architecture where /api/orders routes to one cluster and /api/users to another, explain how ALB path-based routing eliminates the need for separate load balancers.
Common Mistakes
- •Assuming ALB can provide a static IP address natively (it needs Global Accelerator or an NLB in front).
- •Attempting to attach AWS WAF directly to an NLB (WAF requires Layer 7 HTTP inspection).
- •Forgetting that with client IP preservation on, a target that connects to its own NLB can time out, because NLB does not support hairpinning in that mode.
Related Topics
That's where we come in.
Being able to explain when you would choose Application Load Balancer (ALB) or Network Load Balancer (NLB) is different from reading a comparison table.
Kernelry helps you rehearse technical questions, evidence-led debugging, safe next steps, and the clear communication teams expect. The drills adapt to your answer, so you practice the reasoning rather than memorize a company-specific script. During early access, free accounts include ten daily scenarios across our mixed question pool, with no credit card required.