Intermediate
Open
Free
Layer 4 vs Layer 7 Routing
You are designing an API gateway for a SaaS product. You need to:
- Route
/api/v1/*to a fleet of API servers. - Route
/static/*to an S3 bucket origin. - Block requests containing a known malicious
User-Agentheader.
Can you accomplish all three with a Layer 4 load balancer? Why or why not? What would you use instead?
Solution
No, you cannot accomplish all three with a Layer 4 load balancer.
A Layer 4 load balancer operates only on TCP/UDP headers (IP addresses and ports). It has no visibility into HTTP content — it cannot inspect URL paths, HTTP headers, or cookies. Therefore:
- Routing by URL path (
/api/v1/*vs/static/*) requires HTTP awareness → L4 cannot do this. - Blocking by
User-Agentheader requires reading HTTP headers → L4 cannot do this.
You need a Layer 7 (application-layer) load balancer such as AWS ALB, nginx, or HAProxy. An L7 load balancer parses the full HTTP request and can:
- Route by path, hostname, or headers (listener rules in AWS ALB).
- Block requests using WAF rules or header inspection.
- Terminate TLS and forward plain HTTP to backends.
AWS ALB + WAF together handle all three requirements above.