--- title: "What is a layer 4 load balancer?" canonical: https://enum.co/learn/what-is-a-layer-4-load-balancer locale: en topic: Network publishedAt: 2026-11-11 updatedAt: 2026-11-11 author: "Max Heyer" summary: "A layer 4 load balancer spreads TCP and UDP connections across backend servers using IP addresses and ports, without reading the application data inside." --- # What is a layer 4 load balancer? A layer 4 load balancer spreads TCP and UDP connections across backend servers using IP addresses and ports, without reading the application data inside. After reading this you will be able to: - Explain what a layer 4 load balancer sees and decides - Compare layer 4 and layer 7 load balancing - Keep client IP addresses visible behind a load balancer ## What is a layer 4 load balancer? A layer 4 load balancer is a network component that receives TCP or UDP traffic on one public address and spreads it across several backend servers. It decides where each connection goes from the IP addresses and ports alone. It never parses HTTP, so it works the same for web traffic, databases, game servers or DNS. Think of a post office sorting room. Clerks read the address on each envelope and drop it into the right bag, but they never open the letter. A layer 4 load balancer handles packets the same way: it reads the outside and leaves the contents alone. ## How does a layer 4 load balancer pick a backend? It picks a backend once, when a TCP connection or UDP flow starts, and then sends every later packet of it to the same server. Common rules are: - Round robin: each new connection goes to the next server in turn. - Least connections: the server with the fewest open connections wins, which suits long-lived sessions. - Source hashing: a hash of the client address picks the server, so one client keeps landing on the same backend. ### Health checks The load balancer probes each backend at regular intervals and stops sending traffic to servers that fail. The probe has to match the failure you care about. A ping proves the machine is up, but not that the service still listens on its port, so a TCP connect or an HTTP check catches more. ## How is layer 4 different from layer 7? The numbers come from the OSI model. Layer 4 is the transport layer with TCP and UDP. Layer 7 is the application layer, where protocols such as HTTP live. ### What layer 4 does well It is fast and protocol-agnostic, because it only forwards packets or streams. TLS can pass straight through to your servers, so certificates and private keys stay with your application. Any TCP or UDP protocol works, including ones a web proxy does not understand. ### What needs layer 7 Routing by URL path, rewriting headers and cookie-based stickiness need the load balancer to read the request, which usually means terminating TLS first. That is the job of a layer 7 proxy. In Kubernetes, the usual pattern is one layer 4 load balancer in front of an ingress controller or Gateway API proxy, which then does the HTTP routing. ## Does the backend see the client IP address? Not always. If the load balancer or the node in between rewrites the source address, your logs show an internal IP instead of the real client. In Kubernetes, a Service of type LoadBalancer uses `externalTrafficPolicy: Cluster` by default. Any node may forward traffic to a pod on another node, and the source address is replaced on the way. Setting `externalTrafficPolicy: Local` keeps the client address and skips the second hop. Most load balancers then health-check each node and skip nodes without a local pod, so load can be uneven when pods are spread unevenly. Outside Kubernetes, the PROXY protocol solves the same problem. The load balancer sends a short header with the original addresses at the start of each connection. The backend has to be configured to expect it, and should accept it only from the load balancer. ## How enum handles layer 4 load balancing On enum you create a Kubernetes Service of type LoadBalancer and get an L4 load balancer for TCP and UDP from [enum Networking](/networking), with automatic failover and an IPv4 address included. Nodes have no public IP addresses, so all inbound traffic enters through load balancers. The 99.9% SLA covers load balancers and NAT. ## FAQ **Can a layer 4 load balancer handle HTTPS?** Yes. It forwards the encrypted TCP stream without decrypting it, and your servers or an ingress controller terminate TLS. It cannot route by URL path or rewrite headers, because it never sees the decrypted request. **Is a layer 4 load balancer faster than layer 7?** Usually, because it does less work per connection. It does not reassemble or parse requests, so it adds little latency. The difference matters most for high connection rates and protocols that are not HTTP. **Do I still need an ingress controller?** Only if you want HTTP features such as host or path routing, redirects and certificate handling in the cluster. For a single TCP or UDP service, a LoadBalancer Service pointing straight at your pods is enough.