Your organisation must send all VPC traffic through a fleet of third-party firewall appliances that need to inspect the original, unmodified packets. Why is an AWS Gateway Load Balancer the right component here rather than a Network Load Balancer?

## The shape of the requirement "Everything must pass through inspection" is not a load balancing problem in the usual sense. The traffic in question is not addressed to the security fleet at all — it is a client talking to a server, and the appliances have to be inserted between them without either endpoint changing anything. That is a *bump in the wire*, and it is a fundamentally different insertion model from a load balancer that clients dial. ## Why NLB cannot do it An NLB is a destination. It has addresses, it has listeners on ports, and a client reaches a service by connecting to it. The load balancer then picks a target and forwards. Two properties make this unsuitable for transparent inspection: - **It must be addressed.** Nothing forwards traffic through an NLB on the way to a different destination. You cannot point a route table at it. - **It rewrites the destination.** The packet that arrives at the target is destined for the target. An inspection appliance that needs to know the original destination — the whole point of a firewall decision — has lost it. ## How Gateway Load Balancer works GWLB combines two roles in one component: **A layer-3 gateway.** You create a *Gateway Load Balancer endpoint* — a VPC endpoint type — in a subnet, and you make it the target of routes. Traffic sent toward a destination whose route points at that endpoint is diverted into the GWLB. Neither the client nor the server knows: this is expressed entirely in routing, which is why it can be imposed centrally on workloads that are never modified. **A layer-4 load balancer.** It distributes those diverted flows across a fleet of appliance targets, health-checks them, and adds and removes capacity like any other load balancer. The connective tissue is **GENEVE encapsulation on UDP port 6081**. GWLB wraps the entire original packet — headers and all — in a GENEVE tunnel to the chosen appliance. The appliance decapsulates, sees the packet exactly as the client sent it, applies its policy, and if it permits the traffic, re-encapsulates and hands it back. GWLB then releases the packet toward its real destination. Nothing about the packet's addressing has changed along the way. **Flow stickiness** matters as much as encapsulation. Stateful inspection only works if both directions of a conversation, and every packet within it, reach the same appliance — an appliance that saw only half a handshake has no basis for a decision. GWLB pins a flow to one appliance for its lifetime. ## The architecture that follows The usual production shape is a dedicated **inspection VPC** holding the GWLB and the appliance fleet, connected to workload VPCs through Transit Gateway or through GWLB endpoints placed in the workload VPCs themselves. Route tables in the spokes direct the traffic classes that must be inspected — often all egress, sometimes east-west between environments — at the endpoint. Security teams gain a single enforcement point that application teams cannot bypass, and appliance capacity scales horizontally instead of being a pair of hand-managed boxes. The costs are real and worth naming: extra hops add latency, the inspection fleet is a hard dependency in the path of production traffic, and you are paying both for the load balancer and for the appliance licences. The failure mode of an inspection layer is that everything stops, so its capacity and health-checking deserve the same care as the workloads it protects. ## Answering the interview version The crisp discriminator to state is insertion model. NLB is *addressed* — traffic goes to it. GWLB is *routed through* — traffic passes it on the way elsewhere, encapsulated so the appliance sees the original packet. If the requirement contains the words "transparent", "inline" or "the appliance must see the real addresses", the answer is GWLB. If clients can simply be pointed at an endpoint, you never needed it.