Compare the four types
ALB, NLB, and GWLB solve different protocol and routing problems; performance alone is not a selection rule.
Choose ALB for HTTP-aware decisions
ALB terminates HTTP or HTTPS, evaluates listener rules, and forwards requests to target groups. Rules can match host names, paths, methods, headers, query strings, and source IP ranges. ALB supports instance, IP, and Lambda targets. HTTPS listeners integrate with ACM certificates, security policies, optional mutual TLS, and AWS WAF. Security groups control the load balancer and target path. Do not choose ALB for non-HTTP protocols or fixed endpoint IP requirements. ALB is addressed by DNS and its underlying addresses can change. ALB makes routing decisions from HTTP request content.Choose NLB for transport traffic
NLB selects a target for each flow without interpreting HTTP. It supports documented TCP, TLS, UDP, and combined protocol modes. Common uses include databases, messaging systems, and PrivateLink endpoint services. Each enabled Availability Zone receives a static address. An internet-facing NLB can associate one Elastic IP per enabled subnet. TLS listeners can terminate TLS; TCP listeners can pass encrypted bytes through. NLB provides static zonal addresses, not one global permanent IP address.Choose GWLB for inline appliances
GWLB combines a transparent network gateway with distribution across virtual appliances. Traffic reaches Gateway Load Balancer endpoints, is encapsulated with GENEVE on port 6081, and is sent to healthy appliance targets. Use GWLB when traffic must traverse firewalls, intrusion-prevention systems, or inspection appliances without changing application endpoints. Appliances must support the GWLB integration. GWLB distributes IP traffic to security appliances; it is not a web ingress load balancer.Keep CLB only with a reason
Classic Load Balancer can continue serving older applications, but AWS identifies it as the previous generation. Migration requires rechecking health checks, certificates, security groups, DNS cutover, connection behavior, and headers.Generic traffic flow
- The client resolves the load balancer or endpoint DNS name.
- AWS directs traffic to a node in an enabled Availability Zone.
- ALB evaluates HTTP rules, NLB selects a flow target, or GWLB selects an appliance.
- Health and cross-zone configuration constrain target choice.
- The target handles the request, connection, or packet flow.
- Return traffic follows the product-specific path.
Security and cost boundaries
ALB can use AWS WAF because it understands HTTP. GWLB carries traffic through appliances. NLB security relies on protocol design, security groups where configured, network controls, and targets. Each product has hourly and capacity-unit billing dimensions. Processed bytes, connections, rules, certificates, public IPv4 addresses, cross-zone transfer, PrivateLink, and appliance licensing can also matter.Frequently asked questions
Can one AWS load balancer handle every protocol?
Can one AWS load balancer handle every protocol?
No. ALB is HTTP-aware, NLB handles documented transport protocols, and GWLB carries IP traffic to appliances. Layered designs can combine products, such as an NLB targeting an ALB, but every layer adds configuration, observability, and cost.
Does NLB provide one permanent public IP?
Does NLB provide one permanent public IP?
NLB provides a static address for each enabled Availability Zone. An internet-facing NLB can assign one Elastic IP per enabled subnet. Clients should normally use DNS and account for all zonal addresses.
Should a new workload use CLB?
Should a new workload use CLB?
Usually not. AWS identifies Classic Load Balancer as the previous generation and recommends current products. Keep CLB only when a verified legacy dependency justifies it, then plan migration to the service matching the protocol.