# Load Balancers in the VPC — Cloud Networking: VPCs, Subnets & Peering

Source: https://www.skillbyai.com/en/cloud-networking/cn-load-balancers

> Choose between layer-4 and layer-7 load balancers and place internet-facing and internal ones in the right subnets.

## Layer 4 versus layer 7

A load balancer spreads traffic across healthy targets in several AZs and gives clients one stable entry point. A **layer-7** load balancer (AWS Application Load Balancer, Google Cloud Application Load Balancer, Azure Application Gateway) understands HTTP: it terminates TLS, routes by host name or path, rewrites headers and performs HTTP health checks. A **layer-4** load balancer (AWS Network Load Balancer) forwards TCP or UDP connections without reading the payload, which suits non-HTTP protocols, very high connection rates and cases needing static IP addresses per AZ. Either can be **internet-facing**, with nodes in public subnets and public addresses, or **internal**, with only private addresses for service-to-service traffic. Targets themselves stay in private subnets. A common trap: with a layer-7 load balancer the backend sees the load balancer's address as the source, so the client's real IP must be read from the `X-Forwarded-For` header.

## Receptionist versus post room

A layer-7 balancer is a receptionist who reads each visitor's request and sends them to the right department. A layer-4 balancer is a post room that forwards sealed envelopes to the next free desk without opening them.

## Health checks need firewall rules too

Targets marked unhealthy for no obvious reason often have a security group that does not allow the load balancer's health-check traffic. Allow the health-check port from the load balancer's security group.

**Quiz:** You need to route /api/* and /images/* on the same hostname to different backend services. Which load balancer type fits?

- [ ] A layer-4 network load balancer
- [x] A layer-7 application load balancer
- [ ] A NAT gateway
- [ ] A gateway VPC endpoint

*Answer:* A layer-7 application load balancer. Path-based routing requires reading the HTTP request, which only a layer-7 load balancer does.