What Is It?
Managed Network Load Balancer (NLB) distributes TCP traffic at OSI Layer 4 (transport layer). Operating below the application layer, NLB handles connections based on IP protocol, source/destination IP addresses, and ports without inspecting packet contents. The service provides high-performance load balancing with low latency, supports static IP addresses, and preserves client IP information.
Quick Facts
| Aspect | Details |
|---|---|
| Type | Layer 4 (transport layer) load balancer |
| Protocols | TCP |
| IP Preservation | Client IP preserved using proxy protocol |
| IP Types | Public (reserved IPv4) or Private (automatic) |
| Health Checks | TCP handshake |
| Flow Logs | Supported (one flow log per NLB) |
| Management | DCD, Cloud API, DevOps Tools |
What You Can Do
Layer 4 Load Balancing
Distribute traffic at the transport layer based on IP protocol, addresses, and ports. Process packets without application-layer inspection for high performance and low latency.
TCP Support
Balance TCP traffic across backend targets. Supports protocols that operate over this transport protocol.
Client IP Preservation
Backend servers do not receive connections with the original client IP address per default. However, proxy protocol can be enabled so that the client IP address can be forwarded using that protocol. Proxy protocol enables accurate logging, access control, and application logic based on source IP.
High Performance
Achieve low-latency load balancing by operating at Layer 4 without application-layer processing overhead. Ideal for latency-sensitive applications.
Static IP Addresses
Use reserved public IPv4 addresses for public NLBs or automatic private IPs for internal load balancing.
Health Checks
Configure TCP health checks per target. NLB automatically removes unhealthy targets from rotation.
Flow Logging
Attach one flow log per NLB to monitor traffic patterns. Logs are written to IONOS Cloud Object Storage buckets for analysis.
Public and Private Load Balancing
Create public NLBs with reserved IPv4 addresses for external traffic, or private NLBs with automatic IPs for internal traffic distribution.
Best For
| Scenario | Why It Fits |
|---|---|
| TCP applications | Protocols that don't require HTTP-level inspection |
| Low-latency requirements | Layer 4 processing minimizes overhead |
| Client IP logging | Preserved source IP for accurate analytics using proxy protocol |
| Database load balancing | Distribute connections to database replicas |
| SSL passthrough | End-to-end encryption without termination at load balancer |
| High throughput | Performance-optimized for large connection volumes |
Key Considerations
Billing & Costs
- Main billing: Per forwarding rule per hour (not per NLB instance): first 5 rules at 0,02 EUR/hour each, each additional rule at 0,01 EUR/hour.
- Additional costs: Public IP address reservation (if using public listeners), flow logging storage
- Per Forwarding Rule: The first 5 forwarding rules are billed at 0,02 EUR/hour each, additional rules at 0,01 EUR/hour each, with a minimum charge equivalent to one rule
- Egress Traffic not included in the NLB price: Egress traffic is billed separately and will come on top of the NLB price
Limitations
- Layer 4 only (no HTTP-level inspection or routing)
- IPv6 not supported (IPv4 only)
- One flow log maximum per NLB
- Cannot perform path-based or host-based routing (use ALB for Layer 7 routing)
- No TLS termination (use ALB or implement on backend servers)
- Supports end-to-encryption
Management Options
- Data Center Designer (DCD)
- Cloud API
- Configure listeners, forwarding rules, and health checks
- Flow log configuration