Unit 2.4: Networking Services

Introduction

Think of networking services as the postal system of your cloud infrastructure. Just as mail needs to be sorted, routed, and delivered securely to the right addresses, your cloud applications need traffic distribution, secure connections, and efficient routing between services. IONOS Cloud provides a comprehensive suite of networking services that handle everything from distributing traffic across multiple servers to connecting your cloud resources securely to on-premises systems.

In this unit, you will explore the key networking services that power IONOS Cloud infrastructure. Whether you need to balance traffic across multiple servers, provide secure internet access to private resources, or connect different parts of your infrastructure, understanding these services will help you design robust, scalable network architectures.

1. Load Balancing Services

Load balancing is the practice of distributing incoming network traffic across multiple servers to ensure no single server becomes overwhelmed. IONOS Cloud offers two types of load balancers, each designed for different scenarios and operating at different layers of the network stack.

1.1 Managed Application Load Balancer (ALB)

The Managed Application Load Balancer operates at Layer 7 of the OSI model (the application layer), which means it can make intelligent routing decisions based on HTTP/HTTPS traffic content. When a request arrives at an ALB, it examines the HTTP attributes and forwards the request to the appropriate backend servers (called Target Groups) based on user-defined policies.

Key Characteristics:

The ALB supports advanced routing capabilities that go far beyond simple traffic distribution. You can route requests based on HTTP method, headers, hostname, URL path, or query string parameters. This makes it ideal for microservices architectures where different services handle different parts of your application. The ALB can also return fixed responses or redirect traffic to another host without involving any backend server, which is useful for maintenance pages or URL redirects.

Health checks are built into the ALB, continuously probing registered targets to ensure only healthy servers receive traffic. This improves overall reliability and makes your architecture highly available. The service also supports both public load balancing (exposed to the internet) and private load balancing (internal traffic within your data center).

When to Use ALB:

Choose the Managed Application Load Balancer when you need application-layer intelligence such as URL-based routing, cookie-based session stickiness, HTTP redirects, or TLS termination. It is typical for web applications, SaaS front-ends, container or Kubernetes ingress controllers, and API services where content-aware routing is required.

1.2 Managed Network Load Balancer (NLB)

The Managed Network Load Balancer operates at Layer 4 of the OSI model (the transport layer), working with raw TCP traffic. Unlike the ALB, the NLB does not inspect HTTP content. Instead, it simply forwards TCP packets to backend servers based on IP address and port, making it lighter weight and capable of handling higher throughput with lower latency.

Key Characteristics:

The NLB provides multiple Layer 4 load-balancing algorithms including Round Robin, Least Connection, Random, and Source IP. It can handle both public (internet-facing) and private (internal) traffic. Because the NLB does not terminate TLS, it can pass encrypted traffic unchanged to the backend, enabling end-to-end encryption. This makes it suitable for applications that require the backend to handle TLS directly.

The NLB is designed for high performance, offering the lowest latency and highest connection-per-second capacity. Health checks are TCP-based (connection-oriented) rather than HTTP-based, ensuring backend servers are reachable at the network level.

When to Use NLB:

Choose the Managed Network Load Balancer when you need raw, high-performance TCP forwarding with no HTTP parsing, want to preserve TLS encryption all the way to the backend, or are balancing non-HTTP services such as databases, SSH, custom protocols, or high-throughput data pipelines.

1.3 Choosing Between ALB and NLB

The following table summarizes the core differences to help you decide which load balancer fits your needs:

1.4 Business Benefits of Load Balancing

Both load balancers provide critical business benefits. They improve scalability by distributing traffic across multiple compute resources, allowing you to add or remove servers without service interruption. They enhance reliability through health checks that ensure traffic only goes to healthy instances, eliminating single points of failure. High availability is built-in, with automatic failover if a component fails or during maintenance.

Load balancers also enable zero-downtime deployments. Because traffic can be shifted away from instances being patched or upgraded, you can apply updates without taking your application offline. As fully managed services, they eliminate the need to provision, patch, or scale load balancer hardware or software yourself.

2. Gateway Services

Gateway services provide controlled access between your cloud resources and external networks, whether that is the public internet, your on-premises data center, or other cloud environments. These managed services are available in the Public Cloud and enable secure connectivity for resources on private LANs.

2.1 Managed NAT Gateway

A Network Address Translation (NAT) Gateway sits between a private network and the public internet, translating private IP addresses to public IP addresses when private resources initiate outbound connections. Crucially, it only allows outbound traffic; it does not permit unsolicited inbound connections from reaching your private resources.

What It Provides:

The Managed NAT Gateway performs Source NAT (SNAT), allowing VMs on private networks to reach the internet (for example, to download software updates, sync time with NTP servers, or push backups to cloud storage) without requiring each VM to have its own public IP address. All outbound traffic from attached private LANs is translated to one (or a few) public IP addresses.

As a fully managed service, IONOS operates, patches, and updates the NAT Gateway. It is highly scalable to meet growing traffic demands and deployed across multiple availability zones for high availability and fault tolerance. You can attach up to six private networks per gateway and configure custom SNAT rules to control exactly which traffic is allowed outbound.

When to Use NAT Gateway:

Use the Managed NAT Gateway when your workload only needs outbound internet access and should never be reachable from the internet. This improves security by reducing the attack surface (VMs remain hidden from external threats) and simplifies your network architecture. It is ideal for application VMs that need to download patches, access external APIs, or push backups but do not serve web traffic directly.

Benefits:

The NAT Gateway improves security by ensuring VMs are not directly reachable from the internet. It simplifies architecture by replacing many individual public network interfaces with a single gateway and reduces costs by requiring only a single public IP address. You gain operational ease because IONOS handles all software updates, patches, and high-availability provisioning.

2.2 VPN Gateway

A VPN Gateway creates encrypted, site-to-site connections over the public internet, linking your on-premises network, branch offices, or other cloud environments to IONOS Virtual Data Centers. It uses IPSec or WireGuard protocols to establish secure tunnels that protect data in transit.

What It Provides:

The VPN Gateway is a fully managed service that runs in a virtual data center and is assigned a public IPv4 address. It supports both IPSec (IKEv2) and WireGuard protocols. The two protocols can be used at the same time to connect the same Virtual Data Center, but each requires its own gateway instance: a single VPN gateway is single-protocol. You can choose from three tiers (Standard, Enhanced, Premium) that support increasing numbers of LANs and tunnels/peers. Each tier can optionally include high availability (active-passive VM pair) for automatic tunnel failover.

The gateway supports static routing only (no BGP) and can handle both IPv4 and IPv6 traffic, though tunnel endpoints and gateway IPs are IPv4 only. Performance scales up to 1 Gbps per tunnel, and the Premium tier supports up to 30 tunnels or peers.

When to Use VPN Gateway:

Use the VPN Gateway when you need encrypted, bidirectional connectivity between IONOS and external networks that are not in the same IONOS region. Typical use cases include hybrid-cloud connectivity to an on-premises data center, multi-cloud interconnects (linking IONOS with AWS, Azure, or other providers), disaster-recovery and migration scenarios, hub-and-spoke or mesh network topologies, and secure remote access for employees.

Benefits:

The VPN Gateway provides strong encryption (AES-256, SHA-256/384/512) to protect data in motion, meeting regulatory and compliance requirements. It simplifies operations as a fully managed service that handles patching and updates. High availability options minimize downtime for critical workloads. The service offers flexibility in protocol choice: IPSec for broad compatibility or WireGuard for lower latency and higher throughput.

3. Connecting Virtual Data Centers

IONOS Cloud provides Cross Connect, a feature that creates private LAN-based links between multiple Virtual Data Centers in the same geographic region and contract.

3.1 What is Cross Connect?

Cross Connect is an internal networking feature that connects VDCs using IONOS's private backbone infrastructure. Traffic between connected VDCs never leaves the IONOS network, eliminating public internet hops and providing low-latency, high-bandwidth connectivity comparable to a local network interface card (NIC).

How It Works:

Cross Connect establishes a private LAN connection between VDCs that belong to the same contract and are located in the same IONOS region. This constraint ensures data sovereignty and compliance by keeping traffic within the chosen geographic jurisdiction. The connection is transparent to your workloads; VMs in different VDCs can communicate as if they were on the same local network.

3.2 When to Use Cross Connect

Cross Connect is designed for specific scenarios where you need fast, reliable communication between VDCs in the same region:

Resource Sharing: You can centralize services such as firewalls, VPN gateways, DNS servers, or databases in one VDC and have other VDCs connect to them securely without duplicating infrastructure.

Organizational Separation: Different VDCs can be used for separate billing units, teams, or projects while still allowing controlled data exchange through the private link.

Disaster Recovery and Backup: Fast replication between VDCs in the same region supports business continuity strategies. The low-latency, high-bandwidth connection makes it practical to maintain synchronized backup copies of critical data.

Scaling Infrastructure: As your infrastructure grows, you can add new VDCs and attach them to the existing Cross Connect, providing a scalable network fabric without additional networking overhead.

3.3 Benefits of Cross Connect

Cross Connect offers several important advantages. It provides reduced latency and higher throughput because traffic stays on a private LAN, avoiding public internet congestion. Reliability is enhanced because private links are less prone to network spikes and congestion.

Security and compliance are strengthened because data never leaves the IONOS private network, helping meet regulatory requirements. Cost efficiency is achieved by sharing central resources instead of replicating them in each VDC. The service supports scalability and flexibility, allowing you to add or remove VDCs without re-architecting your network. Cross Connect is also provided at no additional charge (both legacy and upgraded versions are free).

4. DNS and IP Management

IONOS Cloud provides services for managing domain name resolution and modern IP addressing.

4.1 Cloud DNS

Cloud DNS is a managed Domain Name System service that translates human-readable domain names (like example.com) into IP addresses that computers use to locate services on the internet. As a fully managed service, IONOS handles the infrastructure, redundancy, and performance of your DNS resolution.

Why Use Cloud DNS:

Managing DNS manually requires maintaining multiple DNS servers for redundancy, configuring zone files correctly, and ensuring high availability. Cloud DNS eliminates this operational burden by providing a managed service with built-in reliability and global distribution. It simplifies DNS management while ensuring your domain names resolve quickly and reliably for users worldwide.

When to Use Cloud DNS:

Use Cloud DNS when you need to manage domain name resolution for web applications, APIs, or services hosted on IONOS Cloud. It is especially valuable for production workloads that require high availability and fast DNS resolution without the complexity of managing your own DNS servers.

4.2 IPv6 Configuration

IPv6 (Internet Protocol version 6) is the newest internet protocol standard, using 128-bit addresses instead of the 32-bit addresses used by IPv4. This provides an almost limitless pool of unique addresses, solving the IPv4 address exhaustion problem.

Why Use IPv6:

IPv4 address space has been depleted due to the exponential growth of internet-connected devices. IPv6 ensures future-proof connectivity by providing enough addresses for billions of devices without network address translation or address sharing. It also brings operational advantages such as simplified network configuration through automatic static address assignment via DHCPv6.

What IONOS Provides:

IONOS Cloud supports IPv6-enabled LANs with automatic DHCPv6 address assignment. Each VDC is automatically allocated a /56 IPv6 prefix, and each LAN can receive a /64 prefix, ensuring unique, routable IPv6 space for every workload. You can configure static IPv6 addresses on network interfaces directly from the Data Center Designer or API.

When to Use IPv6:

Enable IPv6 when you need to support modern cloud-native or IoT workloads that expect IPv6 connectivity, when you want to avoid the complexities of NAT, or when you are planning for long-term infrastructure that will outlast IPv4 availability.

5. Content Delivery and Connectivity

IONOS Cloud offers additional networking services for optimizing content delivery and establishing dedicated connectivity.

5.1 Content Delivery Network (CDN)

A Content Delivery Network is a system of globally distributed edge servers that cache web content and applications close to end users. By serving requests from the nearest edge location, a CDN reduces the distance data must travel, lowering latency and improving load times.

Key Benefits:

CDNs provide reduced latency by delivering content from the nearest edge server, shortening round-trip time for users. They enhance availability by serving cached copies even when the origin server is unavailable. Scalability is improved by offloading cacheable traffic from the origin, allowing your infrastructure to handle higher traffic spikes without degradation.

Security is strengthened through DDoS protection, web application firewall capabilities, and SSL/TLS encryption. CDNs also improve cost efficiency by reducing origin bandwidth usage and the need for over-provisioned infrastructure.

When to Use CDN:

Use a CDN for website performance optimization (static assets like images, CSS, and JavaScript), software distribution (delivering updates and patches globally), and API request optimization (caching API responses at the edge to reduce backend load). CDNs are especially valuable for applications with global user bases that require consistently fast performance regardless of geographic location.

5.2 Cross Connect (Revisited in Connectivity Context)

In addition to connecting VDCs within the same region (covered in Section 3), Cross Connect plays a broader role in enterprise connectivity strategies. Organizations often use it as part of hybrid-cloud architectures where certain workloads remain in IONOS Cloud while others run on-premises or in other clouds. By centralizing shared services in one VDC and connecting others via Cross Connect, you can create hub-and-spoke topologies that simplify management and reduce costs.

Common Use Cases

Real-world scenarios where IONOS networking services are used:

1. E-Commerce Platform with Global Traffic: An online retailer uses Managed Application Load Balancer to distribute incoming HTTP traffic across multiple web server instances during seasonal sales. The ALB's health checks ensure only healthy servers receive traffic, and advanced routing directs mobile app traffic to optimized backends. Cross Connect links the production VDC to a separate VDC hosting centralized logging and monitoring services (as covered in Section 3.1), while CDN edge servers cache product images and static assets globally to reduce latency for international customers.
2. Hybrid Cloud Infrastructure with Secure Connectivity: A financial services company maintains sensitive customer databases on-premises while running analytics workloads in IONOS Cloud. They use VPN Gateway with IPSec tunnels (discussed in Section 2.2) to create encrypted, bidirectional connectivity between their on-premises data center and IONOS VDCs. Application servers in private subnets use Managed NAT Gateway (Section 2.1) for outbound internet access to download security updates without exposing themselves to inbound connections. IPv6 is enabled (Section 4.2) to future-proof their infrastructure as they plan a 5-year cloud migration strategy.
3. Microservices Architecture with Internal Routing: A SaaS provider deploys microservices across multiple VDCs in the same region. They use Cross Connect (Section 3.1 and 3.2) to establish private, low-latency links between VDCs hosting different service tiers (frontend, backend, data processing). Managed Application Load Balancer routes API requests based on URL path and HTTP headers (Section 1.1), directing /api/users to the user service and /api/orders to the order service. Cloud DNS (Section 4.1) provides reliable domain name resolution for service discovery, while Managed Network Load Balancer (Section 1.2) handles high-throughput database connections that require Layer 4 performance.

Summary

IONOS Cloud networking services provide the connectivity, security, and performance foundations your cloud infrastructure needs. Load balancers distribute traffic intelligently (ALB for application-layer routing, NLB for high-performance Layer 4 forwarding), gateways control access between networks (NAT Gateway for outbound-only internet access, VPN Gateway for encrypted site-to-site connections), and Cross Connect enables private, low-latency links between VDCs in the same region.

Additional services such as Cloud DNS simplify domain name management, IPv6 configuration future-proofs your infrastructure, and CDN improves content delivery performance globally. Understanding when to use each service allows you to design network architectures that are secure, scalable, and cost-effective.

Key Points:

• Managed Application Load Balancer operates at Layer 7 with advanced HTTP/HTTPS routing, ideal for web applications and microservices
• Managed Network Load Balancer operates at Layer 4 for high-performance TCP forwarding with lowest latency
• Managed NAT Gateway provides secure outbound-only internet access for private resources without exposing them to inbound connections
• VPN Gateway creates encrypted site-to-site tunnels for hybrid-cloud and multi-cloud connectivity
• Cross Connect establishes private LAN links between VDCs in the same region for low-latency, high-bandwidth communication
• IPv6 configuration solves address exhaustion and future-proofs infrastructure with automatic address assignment

Important Terminology:

• Layer 7 Load Balancing: Application-layer load balancing that can inspect and route based on HTTP content (method, headers, URL, query strings)
• Layer 4 Load Balancing: Transport-layer load balancing that forwards TCP traffic based on IP address and port without inspecting content
• Source NAT (SNAT): Network address translation that rewrites the source IP address of outbound traffic, allowing private resources to access the internet through a shared public IP
• IPSec and WireGuard: VPN protocols for creating encrypted tunnels; IPSec offers broad compatibility, WireGuard provides lower latency and higher throughput
• Cross Connect: Private LAN-based link between VDCs in the same region and contract, providing low-latency connectivity without traversing the public internet
• CDN (Content Delivery Network): Globally distributed system of edge servers that cache content close to users to reduce latency and improve performance

Next Steps

Continue Learning: Unit 2.5: Database and Data Services

Related Topics:

• Unit 2.1: Core Architectural Components
• Unit 2.6: Security Services
• Unit 2.7: AI and Container Services
• Unit 3.4: Activity Logs and Monitoring