Gateway Load Balancer (GWLB)
A Gateway Load Balancer deploys, scales and manages a fleet of third-party virtual appliances — firewalls, intrusion detection and prevention systems, deep packet inspection — and puts them in a traffic path without the application knowing they are there.
It operates at layer 3 and acts as a transparent network gateway: traffic goes in, is inspected, and comes out with source and destination intact.
How it works
Section titled “How it works”The Gateway Load Balancer distributes flows across the appliance fleet. It uses a five-tuple flow hash so that every packet in a flow reaches the same appliance, and exchanges traffic with the appliances using the GENEVE protocol on port 6081, which encapsulates the original packet rather than rewriting it. That is what makes the inspection transparent: the appliance sees the original source and destination addresses.
A Gateway Load Balancer endpoint is the entry and exit point in the VPC whose traffic is being inspected. It is a type of VPC endpoint, and it appears as a route table target. Traffic routed to the endpoint travels to the Gateway Load Balancer in the inspection VPC and returns the same way.
The result is a clean separation: appliances live in an inspection VPC owned by a security team, and application VPCs reference them through an endpoint. Application teams do not run the appliances, and the security team does not need access to the application VPCs.
Why it replaces the older patterns
Section titled “Why it replaces the older patterns”Before Gateway Load Balancer, inserting an appliance meant either making it the default route — turning a security appliance into a router and a single point of failure — or building a transit VPC of appliance instances with the routing to match.
Gateway Load Balancer scales the fleet automatically, distributes across it, removes unhealthy appliances, and keeps flows pinned so that stateful inspection works. The routing change in the application VPC is one route entry.
Where it is used
Section titled “Where it is used”- Centralised egress inspection: route 0.0.0.0/0 from application VPCs through the inspection VPC before it reaches a NAT gateway.
- Ingress inspection: inspect traffic arriving from an internet gateway before it reaches the application subnets.
- East-west inspection between VPCs, usually combined with a transit gateway.
Practice
Section titled “Practice”- The appliance must support GENEVE. Most commercial network appliances offered in AWS Marketplace do; check before designing around it.
- MTU: Gateway Load Balancers support 8,500 bytes, and GENEVE encapsulation adds overhead. Verify the appliance’s MTU handling.
- Cross-zone load balancing is off by default, so put appliances in every zone that has an endpoint or accept cross-zone charges and a cross-zone dependency.
- The endpoint is billed like other VPC endpoints — per hour and per gigabyte processed — in addition to the load balancer and the appliance instances.