ALB vs. NLB: Which AWS load balancer fits your needs?
Which load balancer fits my workload best? As is often the case, AWS offers more than one solution. Read on to learn whether to use the Application Load Balancer (ALB) or the Network Load Balancer (NLB) to distribute incoming requests among a fleet of virtual machines or containers.
This is a cross-post from the Cloudcraft blog.
I created the following diagram showing an ALB and an NLB both distributing incoming requests among two EC2 instances:
The components are the same for both the ALB and the NLB. The following figure illustrates the components.
- The load balancer acts as the entry point into your system.
- The listener listens for incoming connections
- The load balancer forwards requests to a target group.
- The target group consists of one or multiple targets.
- A target might be an EC2 instance, container, or internal service.
- The health check monitors the targets.
As the components are the same, it is not a big deal to switch from an ALB to an NLB -or vice versa. Of course, you can only do so if you do not use any features of the ALB that the NLB does not provide.
When in doubt, choose the ALB. There are two main reasons for that:
- The ALB comes with a lot of built-in features. See the comparison table at the end of the article.
- The NLB comes with a few rough edges and requires more experience and care.
So when deciding between an ALB and an NLB, choose the ALB unless one of the points we discuss next applies to your scenario.
If the answer to one of the following questions is “yes”, consider an NLB for your workload.
The ALB only supports HTTP/1.1, HTTP/2, or gRPC. So when clients use a different protocol to connect with your application, you need to use the NLB instead. For example, all scenarios that are using UDP do require an NLB. Also, when you want to use HTTP/3, the NLB is currently your only choice.
The ALB operates on layer 7, which means the ALB inspects the details of every incoming HTTP request. In contrast, the NLB works on layer 4. All the NLB cares about is forwarding the incoming TCP or UDP connection to a target. The NLB does not inspect an incoming HTTP request, for example.
Looking for a new challenge?
Therefore, the NLB has much less work to do than an ALB. As a result, the NLB needs significantly less time to forward an incoming request. So when performance is crucial to your workload, you should consider using an NLB to reduce latency.
The ALB adapts to an increase of connections and requests automatically. However, it takes minutes to do so. So, when expecting substantial traffic spikes, the ALB might not be able to scale fast enough to handle all incoming requests immediately. AWS advises informing their support team when you expect a huge traffic spike in the future to allow them to pre-warm the ALB for you. However, this approach only works when you can predict traffic spikes.
In contrast, the NLB does not need to scale the number of nodes processing incoming connections. Instead, the NLB is designed to handle unpredicted and huge traffic spikes.
So, when you expect unpredicted and substantial traffic spikes, the NLB is a better fit. Unfortunately, AWS does not define what “huge traffic spike” means. Most applications will never reach the limits of an ALB. Think of traffic spikes caused by a super-bowl ad hitting your web application or the new Playstation becoming available at your online shop as scenarios where this becomes an issue.
To connect to an ALB, a client needs to resolve its DNS name. For example, one of my load balancers is reachable via
jenkins-YC728XLHQAVF-1237735722.eu-west-1.elb.amazonaws.com resolves to
126.96.36.199. The IP addresses are subject to change. For example, when the ALB needs to scale, the name would point to additional IP addresses.
So when you need static IP addresses for inbound traffic, the ALB is not an option. Luckily, that’s something the NLB comes with out-of-the-box. Typical scenarios are: a third party that insists on static IP addresses to create firewall rules, or a client that does not come with the ability to resolve hostnames.
The following table compares the ALB and NLB in detail.
|Protocols||HTTP/1, HTTP/2, gRPC||TCP, UDP|
|Performance||Low Latency||Very Low Latency|
|Traffic Spikes||⚠️ Inform AWS Support about huge traffic spikes||✅ Deals with huge and unexpected traffic spikes|
|Static IP Addresses||❌ No. However, you could place an NLB in front of an ALB.||✅ Yes|
|TLS Termination||✅ Yes||✅ Yes|
|Targets||EC2 Instance, IP Address, Lambda||EC2 Instance, IP Address, ALB|
|Client IP preservation||Use HTTP header X-Forwarded-For||Optional, but comes with limitations|
|Routing Algorithm||Round Robin or Least Outstanding Requests||Random|
|Deregistering targets||ALB stops sending requests and waits for open requests||NLB stops opening new connections, but the application needs to terminate connections properly|
|Multiplexing||✅ Yes, reuses connections to targets||❌ No, does not reuse connections to targets|
|Maximum number of targets||1000-5000||500-1000|
|Security Group||Security group of ALB controls inbound traffic, targets reachable from ALB only||Security group of targets control inbound traffic, targets reachable from clients|
|Request based routing||✅ Yes, based on hostname, path, header, …||❌ No|
|WAF||✅ Yes||❌ No|
|Authentication||✅ Yes (OpenID Connect, SAML, …)||❌ No|
|Slow Start Mode||✅ Yes||❌ No|
|Sticky Session||✅ Yes||❌ No|
|IPv6||✅ Yes||✅ Yes|
|Costs||💰💰💰||💰💰 (But causes more connections and therefore higher load on targets.)|
When it comes to AWS, it helps to have a mental model of the provided building blocks.
Think about the ALB as a reverse proxy distributing incoming requests among a fleet of virtual machines or containers. Besides that, the ALB provides features like request-based routing, authentication, and security. The ALB is like a fully-managed, scalable, and highly available version of NGINX, HAProxy, or Caddy.
In contrast, think about the NLB as a way to route traffic to a fleet of virtual machines or containers on the network layer. You get static anycast IP addresses pointing to a dynamic pool of targets. Similar services are the AWS Global Accelerator and the Google Cloud Load Balancer.
If you have to pick a load balancer, choose the ALB unless you can find a good reason to go with an NLB. Typical reasons for selecting an NLB instead of an ALB are:
- The workload requires UDP or a non-HTTP protocol.
- Latency is very crucial, and you have to optimize for every millisecond.
- Unexpected and huge traffic spikes are likely to happen.
- Static IP addresses are required for inbound traffic.