Network load balancer software falls into three camps: L4 balancers (HAProxy, nginx, Envoy) for raw TCP/UDP, L7 balancers (nginx, Envoy, Traefik) for HTTP routing, and managed services for hands-off. Pick by what you’re load-balancing.
Table of contents
- L4 vs L7
- HAProxy
- nginx
- Envoy
- Traefik
- Managed services
- The decision
- The algorithm choices
- The health check patterns
- FAQ
L4 vs L7
The architectural difference:
- L4 (transport layer). Routes TCP/UDP packets based on IP and port. Doesn’t look inside the protocol. Fastest, lowest latency.
- L7 (application layer). Routes HTTP requests based on URL, headers, cookies. Can do path-based routing, header-based routing, A/B testing. Higher latency than L4.
The team that needs raw TCP load balancing (databases, game servers, custom protocols) uses L4. The team that needs HTTP routing (web apps, APIs) uses L7.
HAProxy
The right tool for L4 and L7 load balancing. HAProxy has been the standard for 20+ years; it’s battle-tested at scale.
Pros: Fast, mature, well-documented. The right tool for high-traffic production.
Cons: Configuration file syntax is dated. The team that uses the modern data-plane APIs (Consul, etc.) has a harder time than with Envoy.
nginx
The right tool for L7 (and L4 with the stream module). Most teams already have nginx for TLS termination; adding load balancing is a small extension.
Pros: Familiar, well-documented, ubiquitous. The right tool for “I already have nginx for TLS, let me also use it for load balancing”.
Cons: The L4 support is in the (less common) stream module. The team’s nginx configurations tend to grow into unmaintainable sprawl.
Envoy
The right tool for modern service-mesh load balancing. Envoy is the data plane for Istio, Consul, and most service meshes.
Pros: Modern API, dynamic configuration, xDS support. The right tool for service-mesh architectures.
Cons: Steeper learning curve than HAProxy or nginx. The team that uses Envoy outside a service mesh has a steeper setup than HAProxy.
Traefik
The right tool for automatic service discovery. Traefik integrates with Docker, Kubernetes, and Consul to auto-configure load balancing.
Pros: Auto-discovery from labels/annotations. The right tool for “I have a Kubernetes cluster and I don’t want to write Ingress rules by hand”.
Cons: Less battle-tested at massive scale than HAProxy or nginx. The team that needs HAProxy-class performance may find Traefik insufficient.
Managed services
For the team that doesn’t want to operate the load balancer:
- AWS NLB / ALB. The right tool for AWS workloads.
- GCP Cloud Load Balancing. The right tool for GCP workloads.
- Azure Load Balancer. The right tool for Azure workloads.
- Cloudflare Load Balancing. The right tool for multi-cloud or anycast.
- RunxBuild’s managed load balancer. The right tool for RunxBuild apps.
The team that picks a managed service gives up some control but avoids the operational overhead of running the load balancer.
The decision
The right pick:
- L4 TCP/UDP, high traffic: HAProxy or AWS NLB.
- L7 HTTP, standard web app: nginx or Traefik.
- L7 HTTP, service mesh: Envoy.
- Multi-cloud or anycast: Cloudflare.
- Don’t want to operate it: Managed service from your cloud.
The algorithm choices
The load balancing algorithms:
Round Robin. Requests distributed in order. Simple; doesn’t account for server load. The right choice for equally-capable servers.
Least Connections. Requests go to the server with the fewest active connections. The right choice for long-lived connections.
Least Response Time. Requests go to the server with the lowest response time. The right choice for variable request processing times.
Weighted. Each server has a weight; requests are distributed proportionally. The right choice for mixed-capacity servers.
IP Hash. The same client IP always goes to the same server. The right choice for session affinity without sticky sessions.
Random. Requests distributed randomly. The right choice for very large fleets where the other algorithms have overhead.
The team that picks the right algorithm for the workload has the best performance. The team that uses round-robin for everything has uneven load distribution.
The health check patterns
The right way to health-check load-balanced services:
HTTP health check. The load balancer sends GET /health, expects 200 OK. The right choice for HTTP services.
TCP health check. The load balancer opens a TCP connection. The right choice for non-HTTP services (databases, custom protocols).
Custom health check. The load balancer runs a script or command. The right choice for services with complex health logic.
The team that uses health checks aggressively (every 5-10 seconds) catches failures fast. The team that uses passive checks (only check on new connections) has slower failure detection.
The team that has a /health endpoint that actually checks the service (not just returns 200) has meaningful health checks. The team that returns 200 always has a load balancer sending traffic to broken servers.
FAQ
What’s the best open source load balancer?
HAProxy for raw performance and L4. nginx for L7 if you already use it. Envoy for service mesh. Traefik for automatic discovery. None is universally best.
Is HAProxy faster than nginx?
Slightly, at high connection rates. For most workloads, the difference is negligible. The team that picks HAProxy for raw performance is right; the team that picks nginx for convenience is also right.
Do I need a load balancer?
If you have multiple instances of the same service, yes. If you have a single instance, no. The team that runs multiple instances without a load balancer is the team that has uneven traffic and no health checks.
What’s the difference between NLB and ALB on AWS?
NLB is L4 (TCP/UDP). ALB is L7 (HTTP/HTTPS). Use NLB for non-HTTP protocols, ALB for HTTP. The team that uses ALB for everything is fine; the team that needs TCP load balancing uses NLB.
What’s the best L7 load balancer?
NGINX is the standard for most teams. Envoy is the right choice for service mesh and Kubernetes. Traefik is the right choice for automatic discovery.
Do I need a load balancer if I have one server?
No. The team that has one server doesn’t need a load balancer. The team that has one server but expects to scale should design the service to be load-balanced even if not currently using it.
Can I use multiple load balancers in front of the same service?
Yes, with DNS-based load balancing. Each load balancer handles a subset of traffic; DNS resolves to different IPs based on health, geography, or other factors. The right pattern for multi-region deployments.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: