AWS › Elastic Load Balancing (ALB, NLB & CLB)

How does a Network Load Balancer's preservation of the client's source IP address benefit certain applications compared to an Application Load Balancer?

Intermediate

Answer

A Network Load Balancer operates at the transport layer and by default preserves the original client IP address all the way through to the backend target, which is important for applications that need to log or make decisions based on the actual client IP, such as certain security appliances or applications requiring strict IP based access control, whereas an Application Load Balancer, operating at a higher layer, requires the backend application to read the client's original IP from an added header rather than seeing it directly on the connection itself.

aws elbv2 create-target-group --name nlb-targets --protocol TCP --port 443 --target-type instance --vpc-id vpc-12345

Real-world example A security appliance vendor requires visibility into the actual client IP address for its filtering logic, so the company deploying it uses a Network Load Balancer rather than an Application Load Balancer to ensure that IP information is preserved without requiring any application level changes.

Common follow-ups: How does an Application Load Balancer expose the client's original IP address if it does not preserve it directly?;What other transport layer protocols does a Network Load Balancer support besides TCP?

VPC & Networking;AWS Security Hub & GuardDuty