Gateway Load Balancer (GWLB)
- What it is
- Layer 3 load balancer that deploys, scales, and manages fleets of third-party virtual network appliances: firewalls, IDS/IPS, deep packet inspection.
- The newest of the four ELB types.
- How it works
- Acts as a single entry and exit point (“bump in the wire”) for traffic you want inspected.
- Uses the GENEVE protocol on port 6081 to encapsulate traffic and hand it to appliances transparently — the original packet is preserved, so appliances see unmodified source and destination.
- GWLB Endpoints (GWLBE) in the VPC redirect traffic to the appliance fleet, which can live in a different account.
- Why it exists
- Before GWLB, inserting a vendor firewall meant hand-built routing, and scaling or replacing an unhealthy appliance dropped connections.
- Not to be confused with
- AWS Network Firewall — AWS’s own managed firewall service. GWLB is the plumbing for running someone else’s appliance (Palo Alto, Fortinet, Check Point), typically bought through AWS Marketplace.
- Application Load Balancer (ALB) / Network Load Balancer (NLB) — distribute application traffic to your servers. GWLB distributes traffic to inspection appliances and sends it onward.