Network Load Balancer for Beginners

What Is a Network Load Balancer?

A Network Load Balancer (NLB) is Elastic Load Balancing’s Layer 4 load balancer. Think of it as a very fast traffic switch for connections.

Clients open a connection (TCP, UDP, or TLS). The NLB picks a healthy target—often an EC2 instance—and keeps that connection flowing. It does not read website paths the way an Application Load Balancer does.

• TCP / UDP / TLS — connection-level traffic, not just HTTP pages.
• Static IP per AZ — each enabled zone gets a fixed front-end address (Elastic IP optional).
• Ultra-low latency — built for sudden spikes and millions of requests per second.

In Simple Words

What problem does it solve?

One server can fail or get overloaded. An NLB gives clients one place to connect, then spreads those connections across healthy targets. It also keeps a stable IP per Availability Zone, which some firewalls and partners require.

Is NLB the same as ALB?

No. An ALB understands HTTP—hosts, paths, headers, methods. An NLB understands connections—protocol and port. Choose ALB for most websites. Choose NLB for TCP/UDP apps, gaming, IoT, TLS passthrough or offload at scale, or when you need static IPs.

When should a beginner use it?

After you understand target groups and have tried an ALB. Use NLB when your app needs a protocol an ALB cannot handle, or when a partner says “give us a fixed IP.”

A tiny traffic picture

Client → NLB listener (TCP/UDP/TLS + port) → target group → healthy registered targets. Health checks decide who still gets new connections.

Words You Will See

Come back to this table when the console shows a new word.

What You Need First

Before you click Create, have these ready:

Step-by-Step

Four small steps to create a basic internet-facing NLB that forwards TCP to a target group.

Step 1 — Choose Network Load Balancer

Start the same Create load balancer wizard you use for ALB, then pick the Layer 4 type.

1. Sign in to the AWS console and open EC2.
2. In the left menu, under Load Balancing, choose Load Balancers.
3. Choose Create load balancer.
4. Under Network Load Balancer, choose Create.
5. Set a clear name (for example demo-nlb), scheme Internet-facing, and IP address type IPv4 unless you need dualstack.

How It Works

1. ALB and NLB share the same console entry, but they are different products.
2. Internet-facing means clients on the public internet can reach the NLB DNS name / IPs.
3. You cannot mix ALB and NLB in one create wizard—pick one type.
4. The name is for you in the console; clients will use the DNS name or static IPs AWS assigns.

Step 2 — Map VPC and Availability Zones

Enable the zones where your targets live (or where you want NLB nodes).

1. Select your VPC.
2. Enable at least one Availability Zone (two or more is safer for production).
3. Pick a subnet in each enabled zone.
4. Optionally assign an Elastic IP per zone if you need your own fixed public addresses.

How It Works

1. Each enabled AZ gets an NLB node with a static IP on a network interface.
2. Elastic IPs are optional; without them AWS still provides a static IP per AZ.
3. Put healthy targets in those zones (or understand cross-zone settings) so traffic has somewhere to go.
4. DNS failover can remove unhealthy zone IPs via Route 53 when no healthy targets remain in a zone.

Step 3 — Add a Listener and Target Group

Tell the NLB which port to listen on, and which backends receive the connections.

1. Under Listeners and routing, choose a protocol such as TCP and a port (for example 80 or your app port).
2. Create a new target group (or select an existing one) with a matching protocol.
3. Register your EC2 instance(s) or IP targets.
4. Confirm health checks use a path/port your app answers on.
5. Create the load balancer and wait until the state is active.

How It Works

1. The listener is the front door for a protocol and port.
2. The target group is the back room of healthy instances or IPs.
3. Protocol mismatch breaks health—TCP listener + TCP target group is the simple starter combo.
4. For TLS listeners, attach an ACM certificate when you terminate TLS on the NLB.

Step 4 — Test the DNS Name (or Static IP)

Prove that clients can reach a healthy target through the NLB.

1. Open the NLB details and copy the DNS name.
2. Note the IP addresses listed per Availability Zone if you need fixed IPs for allow lists.
3. From your computer, connect with a tool that matches the protocol (browser for HTTP on TCP:80, or a TCP client for other ports).
4. If nothing answers, check target health, security groups on the instances, and that the listener port matches the app.

How It Works

1. DNS resolves to the NLB IPs for the enabled zones.
2. Only healthy targets should receive new connections.
3. Security groups still matter on the targets (and any rules you place around the NLB).
4. Later, point a domain with Route 53 alias records when you leave the raw NLB DNS name behind.

Common Beginner Mistakes

Key Takeaways