Load Balancer Types — L4 vs L7
Also Known As
TL;DR
Explanation
An L4 (transport-layer) load balancer operates at TCP/UDP: it sees source IP, destination IP, and ports, and forwards connections without inspecting their contents. This makes it fast, protocol-agnostic and cheap (AWS NLB, GCP TCP/UDP LB). An L7 (application-layer) load balancer terminates the application protocol — almost always HTTP(S) — so it can read URLs, headers, cookies and body content. That lets it do path-based routing, host-based routing, header-based A/B testing, sticky sessions by cookie, and request rewriting (AWS ALB, GCP HTTPS LB, Nginx, HAProxy in HTTP mode, Envoy). L7 is slower per packet and costs more, but unlocks the routing features modern microservices need. Service meshes add L7 sidecars on every pod, which is why a mesh's data plane needs careful tuning. Choosing between them is a question of: do you need protocol-aware routing, and can you afford to terminate TLS at the LB?
Common Misconception
Why It Matters
Common Mistakes
- Using an L7 load balancer for a raw TCP protocol — you either lose features or pay for routing you never use; prefer L4 for MySQL, Redis, gaming servers.
- Forgetting that L4 does not preserve the client IP by default — enable PROXY protocol and configure the backend to parse it.
- Terminating TLS at L7 without handling the re-encryption to the backend — internal traffic ends up in cleartext; set up an upstream TLS context or use the mesh.
- Relying on sticky-session cookies on an L4 LB — it cannot see cookies; use source-IP hashing or move to L7.
- Configuring both L4 and L7 in line without a plan — every additional hop is another timeout, retry and failure mode to debug.
Avoid When
- Mixing them without a clear boundary — if you need both, terminate L7 behind an L4 tier, not the other way around.
When To Use
- L7 — HTTP-based microservices needing path/host routing, sticky sessions by cookie, or centralised TLS termination.
- L4 — pure TCP/UDP workloads, very high throughput with minimal CPU, or preserving the exact client connection to the backend.