L4 vs L7 Routing: Layer 4 and Layer 7 Load Balancing Explained

Understanding the difference between Layer 4 (transport) and Layer 7 (application) routing is fundamental to designing efficient cloud architectures. This guide explains when to use each, their performance characteristics, and implementation details.

OSI Model Quick Refresher

The OSI (Open Systems Interconnection) model divides network communication into seven layers. For load balancing discussions, two layers are critical:

Each layer offers different capabilities for traffic management, with important trade-offs in performance, flexibility, and complexity.

Layer 4 Load Balancing

How L4 Load Balancing Works

Layer 4 load balancers operate at the TCP/UDP level. They make routing decisions based on:

The load balancer doesn't inspect packet contents beyond Layer 4 headers. This makes it extremely efficient—decisions are made on the first packet of a connection, and subsequent packets follow the same path.

L4 Routing Modes

NAT Mode (Network Address Translation)

The load balancer rewrites packet headers to direct traffic to backends:

Pro: Works with any backend configuration. Con: Load balancer is in the data path for all traffic.

Direct Server Return (DSR)

The load balancer only handles inbound traffic; responses go directly to clients:

Pro: Massive throughput (load balancer doesn't handle response traffic). Con: Complex backend configuration.

L4 Cloud Implementations

Performance Characteristics

L4 load balancers typically offer:

Layer 7 Load Balancing

How L7 Load Balancing Works

Layer 7 load balancers terminate the TCP connection from clients and create new connections to backends. They can inspect application-level data:

L7 Routing Capabilities

Path-Based Routing

# Route configuration example
/api/v1/*       -> api-service-v1
/api/v2/*       -> api-service-v2  
/static/*       -> cdn-origin
/health         -> health-service
/*              -> frontend-service

Header-Based Routing

# Route by Host header (virtual hosting)
api.example.com    -> api-backends
www.example.com    -> web-backends
admin.example.com  -> admin-backends

# Route by custom header (canary deployments)
X-Canary: true     -> canary-backends (10% traffic)
*                  -> stable-backends (90% traffic)

Content Transformation

L7 load balancers can modify requests and responses:

L7 Cloud Implementations

Performance Characteristics

L7 load balancers have different performance profiles:

Detailed Comparison

Aspect Layer 4 Layer 7
Decision Data IP + Port only Full HTTP request
Protocol Support Any TCP/UDP HTTP, HTTPS, gRPC, WebSocket
TLS Termination Pass-through or terminate Always terminates (inspects content)
Connection Handling Forwards packets Proxy (two connections)
Latency Added Microseconds Milliseconds
Throughput Very high (line rate) Limited by CPU
Session Stickiness IP-based Cookie-based (more reliable)
Health Checks TCP connect, port check HTTP status, response content
WebSocket Support Native (just TCP) Requires specific support
Cost (Cloud) Lower Higher (more processing)

When to Use Layer 4

L4 load balancing is the right choice for:

Non-HTTP Protocols

Maximum Performance

TLS Passthrough

When backends must terminate TLS themselves (for mTLS, certificate pinning, or compliance), L4 passthrough preserves end-to-end encryption.

When to Use Layer 7

L7 load balancing is essential for:

Microservices Routing

Route requests to different services based on URL path:

Canary Deployments

Gradually shift traffic to new versions based on headers or percentage:

# 5% of traffic to new version
backends:
  - name: v1
    weight: 95
  - name: v2
    weight: 5

Authentication Offload

Validate JWTs, API keys, or OAuth tokens before traffic reaches backends, reducing backend complexity.

Rate Limiting

Apply rate limits per endpoint, user, or API key at the edge.

Header Manipulation

Add security headers (HSTS, CSP), request IDs, or client identification headers.

Combining L4 and L7

Production architectures often combine both layers:

Internet
    │
    ▼
┌─────────────────┐
│   L4 (NLB)      │  ← Global entry point, DDoS protection
│   TCP/443       │
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│   L7 (ALB)      │  ← HTTP routing, TLS termination
│   HTTPS         │
└────────┬────────┘
         │
    ┌────┴────┐
    ▼         ▼
┌───────┐ ┌───────┐
│ Svc A │ │ Svc B │
└───────┘ └───────┘

This pattern uses:

For more on global architectures, see our guide on global load balancing.

Real-World Example: E-Commerce Platform

Consider an e-commerce platform with these requirements:

Architecture

Key Takeaways

Need Help Designing Your Load Balancing Architecture?

Our engineers can help you choose the right approach for your workloads. Get in touch for a consultation.