External passthrough Network Load Balancers (NLBs) in 2025 offer notable benefits, especially for cloud-native and hybrid environments. Operating at Layer 4, these load balancers forward traffic directly to backend servers without terminating connections, preserving client source IP addresses essential for security and logging. Their support for diverse protocols like TCP, UDP, ESP, and GRE makes them versatile beyond standard HTTP/S load balancers. With Direct Server Return reducing latency and CPU usage on the balancer itself, performance improves significantly. While SSL termination falls on backend VMs, this approach allows greater control over certificates and security policies. Overall, passthrough NLBs suit applications needing low latency with multi-protocol support but require careful health monitoring configurations.
Overview of External Passthrough Network Load Balancers
External passthrough Network Load Balancer (NLBs) operate at Layer 4 of the OSI model, focusing on forwarding traffic based on transport layer information without inspecting the payload. They distribute incoming connections evenly among backend instances located within the same region, which helps to reduce latency by keeping traffic local. Unlike proxy load balancers, passthrough NLBs do not terminate client connections; instead, they forward packets directly to backend virtual machines while preserving the original packet structure and client source IP addresses. This transparency is crucial for backend applications that rely on client IP information for logging, security policies, or geolocation.
One key feature of passthrough NLBs is their use of Direct Server Return (DSR). In this mode, backend servers respond directly to clients, bypassing the load balancer on the return path. This reduces the load balancer’s CPU and memory usage and improves response times, making passthrough NLBs well-suited for large-scale, high-connection workloads. They support a wide range of protocols beyond just TCP and UDP, including ESP, GRE, ICMP, and ICMPv6, which broadens their applicability to various network scenarios such as VPNs and real-time communications.
Technical Advantages of Passthrough NLBs
External passthrough Network Load Balancers (NLBs) offer several technical benefits that make them well suited for modern cloud architectures. One key advantage is their ability to preserve the client source IP address by forwarding packets without modification. This is crucial for backend services that rely on accurate client identification for logging, security policies, or geo-restriction. Unlike proxy load balancers, passthrough NLBs do not terminate connections, eliminating the overhead of payload inspection and proxy processing. This results in reduced latency, enabling faster response times which is vital for real-time applications such as gaming or financial services.
Passthrough NLBs also support a broad range of protocols beyond the common HTTP/S and TCP, including UDP, GRE, and ESP. This versatility allows organisations to load balance diverse workloads such as VPN tunnels, VoIP, or custom network protocols without additional translation layers. Their architecture enables high throughput, efficiently managing millions of simultaneous connections, thus supporting volatile or large-scale traffic demands.
Security and Traffic Management Features
External passthrough Network Load Balancers (NLBs) offer distinctive security and traffic management benefits by forwarding encrypted traffic directly to backend servers without decrypting SSL or TLS sessions. This design shifts the encryption workload to backend instances, allowing them to retain full control over SSL certificates and security policies, which is crucial for organisations seeking granular certificate management and compliance. Operating at Layer 4, passthrough NLBs fit well within zero trust security frameworks by functioning inside private networks and leveraging Network Security Groups (NSGs) or firewalls to restrict traffic flows. This approach enables strict traffic segmentation without needing to inspect packet contents, reducing exposure while preserving confidentiality.
Health probes are an integral security feature, continuously monitoring backend service availability and enabling automatic failover if an instance becomes unhealthy, thereby maintaining resilience without human intervention. Additionally, passthrough NLBs can serve as next-hop gateways in complex network topologies, such as hub-and-spoke models, facilitating the integration of firewall appliances and advanced routing policies. This capability grants network architects fine-grained control over routing and firewall rules, fostering an environment where traffic is tightly regulated and flows are predictable.
Performance Benefits and Efficiency Gains
External passthrough Network Load Balancers (NLBs) offer significant performance advantages by eliminating proxy overhead, forwarding traffic directly to backend servers. This approach reduces CPU and memory usage on the load balancer itself, freeing resources to handle more connections or other critical tasks. By using Direct Server Return (DSR), backend servers can respond straight to clients without routing traffic back through the load balancer, which improves throughput and lowers response times. This is particularly beneficial for real-time applications such as gaming, VoIP, and VPNs, where low latency is crucial. Moreover, passthrough NLBs avoid deep packet inspection or connection termination, cutting down on connection setup delays and enabling faster session establishment. Their ability to scale efficiently allows handling millions of simultaneous connections with minimal impact on latency or resource consumption, making them suitable for large-scale cloud-native and hybrid environments. Supporting multi-protocol traffic including TCP, UDP, and GRE means these load balancers optimise performance across diverse workloads. Regional traffic distribution minimises bottlenecks by keeping data flows local, reducing cross-region latency and costs. Additionally, health checks and automatic rerouting from unhealthy backend instances help maintain high availability without compromising speed. The combination of these features ensures efficient load balancing for both stateless and stateful protocols, leveraging cloud provider infrastructure optimisations to balance fault tolerance and network performance effectively.
Common Use Cases and Deployment Models
External passthrough Network Load Balancers (NLBs) find their strength in scenarios where preserving the original client IP is crucial, such as security analytics and IP-based access control systems. This capability is indispensable for organisations that rely on accurate client identification for auditing or enforcing network policies. They are also well suited to UDP-based services, including real-time communications like VoIP or video conferencing, and VPNs utilising IPSec (ESP) or GRE tunnels, where protocol transparency and minimal packet handling are essential.
In cloud-native environments, passthrough NLBs integrate seamlessly with Kubernetes Service type LoadBalancer resources, enabling straightforward exposure of containerised workloads without compromising on latency or protocol support. This is particularly beneficial for microservices architectures that demand rapid scaling and consistent client IP visibility across pods.
Emerging Trends for Passthrough NLBs in 2025
In 2025, passthrough Network Load Balancers (NLBs) are increasingly vital in multi-cloud and hybrid cloud environments, offering seamless traffic distribution while preserving client IP addresses, a critical factor for security and analytics. The expansion of supported protocols now includes emerging encapsulations, enabling organisations to handle a broader range of applications beyond traditional TCP and UDP. There is also a stronger focus on integrating passthrough NLBs with container orchestration platforms like Kubernetes, which facilitates automated scaling and dynamic backend management, making them well-suited for cloud-native workloads.
Security remains a priority, with passthrough NLBs playing a key role in zero trust frameworks by operating within private networks and enforcing strict access controls. This aligns well with cloud providers encouraging the migration from legacy target pools to backend service models, which offer enhanced traffic management features such as weighted load balancing and advanced health checks. Automation through infrastructure-as-code tools has improved, ensuring consistent and repeatable provisioning that reduces manual errors and accelerates deployment.
Cloud Provider Approaches to Passthrough Load Balancing
Cloud providers adopt distinct strategies to deliver external passthrough Network Load Balancers (NLBs) that balance performance, scalability, and security. Google Cloud employs its proprietary Maglev and Andromeda network stacks to offer highly scalable, low-latency passthrough load balancing. These technologies underpin Google's ability to support both IPv4 and IPv6 protocols while offering flexible backend configurations through modern backend services and legacy target pools. This versatility ensures smooth migration paths and enhanced traffic management features such as weighted load distribution and failover. Microsoft Azure’s Standard Load Balancer aligns closely with zero trust security principles, enabling passthrough load balancing within private virtual networks secured by Network Security Groups. Azure supports multi-port and multi-IP scenarios, health probes, and inbound/outbound traffic flows, making it suitable for complex enterprise applications requiring strict security postures. Oracle and VMware take a performance-centric approach, focusing on ultra-low latency, high throughput, and transit routing capabilities tailored for demanding enterprise environments. Their offerings integrate seamlessly with existing enterprise network topologies, supporting millions of connections per second and enabling next-hop load balancing for firewall or NAT gateway traffic management. Across the board, providers implement health checks that match the traffic type, ensuring backend servers are available before directing traffic. This proactive health monitoring, combined with failover and weighted load balancing features, fosters high availability and traffic distribution tuned to custom policies.
Challenges and Limitations in Deployment
External passthrough Network Load Balancers (NLBs) offer several advantages but come with notable challenges that affect their deployment. One key limitation is that SSL termination is offloaded entirely to backend virtual machines, which increases CPU and memory demands on those instances. This requires careful planning to ensure backend resources are adequately provisioned for encryption tasks, especially in high-traffic environments. Additionally, passthrough NLBs operate within a regional scope, lacking built-in global load balancing capabilities. Organisations aiming for worldwide traffic distribution must therefore integrate complementary global load balancers, adding complexity to their network architecture.
Health monitoring with passthrough NLBs can be complicated, particularly for stateful or non-standard applications. Configuring accurate health probes demands a deep understanding of backend service behaviour to avoid false positives or negatives, which could disrupt traffic flow. Furthermore, these load balancers do not support advanced Layer 7 features such as content-based routing or HTTP inspection, limiting their use in scenarios where application-level intelligence is required. The inability to modify packet headers also restricts advanced traffic manipulation or routing decisions at the load balancer level, placing greater responsibility on backend services.
Frequently Asked Questions
1. How do external passthrough network load balancers improve traffic management in complex systems?
External passthrough network load balancers direct incoming traffic to backend servers without altering the data, maintaining end-to-end transparency. This approach helps in managing traffic loads efficiently across multiple servers while preserving the original client request headers, which is crucial for securing and tracking network communications in complex systems.
2. What are the advantages of using passthrough load balancers over traditional load balancers in cloud environments?
Passthrough load balancers offer lower latency since they do not terminate the SSL connection, allowing encrypted traffic to pass directly to the backend servers. This reduces processing overhead and can enhance performance in cloud environments, especially where encryption and security are vital, while still balancing traffic across multiple instances effectively.
3. Can external passthrough load balancers handle modern encryption protocols effectively?
Yes, external passthrough load balancers typically support the latest encryption standards by passing encrypted traffic transparently to backend servers that handle decryption. This ensures that security is maintained without compromising performance, as the load balancer itself does not need to decrypt and re-encrypt traffic, allowing backend systems to manage protocols such as TLS 1.3 efficiently.
4. How do passthrough network load balancers affect the scalability and resilience of network infrastructure?
By distributing traffic directly to backend servers without modifying requests, passthrough load balancers enable easier scaling of services as new servers can be added without complex configuration changes. Moreover, they contribute to resilience by reducing points of failure, since no termination occurs at the load balancer, potential performance bottlenecks are minimised, allowing the network to better handle spikes and failures.
5. What considerations are important when deploying an external passthrough load balancer in a multi-cloud setup?
In multi-cloud environments, maintaining consistent security and traffic policies across different platforms is crucial. When deploying passthrough load balancers, it is important to ensure compatibility of encryption methods and session persistence across clouds, as well as seamless integration with firewall and monitoring tools. Proper network design must also account for latency and reliable failover between cloud providers to maintain uninterrupted service.
TL;DR External passthrough Network Load Balancers (NLBs) in 2025 offer efficient, low-latency traffic distribution by forwarding packets directly to backend servers without terminating connections. They support a wide range of protocols, preserve client source IPs, and enable high throughput with direct server return for improved efficiency. Commonly used in cloud-native, hybrid, and multi-cloud setups, these NLBs integrate well with security models like zero trust and provide robust health checks and failover. Leading cloud providers offer distinct implementations focusing on scalability and advanced routing. Despite benefits, passthrough NLBs have limitations such as regional scope, backend SSL termination overhead, and lack of advanced Layer 7 features. Overall, they remain vital for performance-critical, protocol-diverse applications with future trends aimed at greater automation, security, and protocol support.
