What is the difference between L4 and L7 load balancing, and forward vs reverse proxies?

Question

IT Interview Practice · Accepted Answer

A **load balancer** spreads incoming traffic across a pool of backend servers so no single one is overwhelmed and the system stays available if a server dies. The core distinction is the *layer* it operates at:

```text
        L4 (Transport)                        L7 (Application)
  routes by IP + port only            reads HTTP: path, headers, cookies, host
  ┌──────────────┐                    ┌──────────────┐
  │ balancer     │──▶ server A        │ balancer     │  /api/*   ──▶ API pool
  │ (TCP/UDP)    │──▶ server B        │ (HTTP-aware) │  /img/*   ──▶ static pool
  └──────────────┘──▶ server C        └──────────────┘  cookie=X ──▶ sticky backend
  fast, opaque, protocol-agnostic     smart routing, TLS termination, can inspect
```

**L4 load balancing** works at the Transport layer: it forwards TCP/UDP connections based only on IP and port, without looking inside the packets. It's fast and cheap and works for any protocol, but it can't make content-based decisions. **L7 load balancing** works at the Application layer: it terminates the connection, parses HTTP, and can route by URL path, host, headers, or cookies — enabling path-based routing (`/api` vs `/static`), sticky sessions, TLS termination, compression, and per-request retries. The cost is more processing per request.

A **proxy** is an intermediary, and the direction defines the type:

```text
FORWARD proxy: sits in front of CLIENTS, acts on their behalf (outbound)
   clients ──▶ [forward proxy] ──▶ internet    (corp filtering, caching, anonymity)

REVERSE proxy: sits in front of SERVERS, acts on their behalf (inbound)
   internet ──▶ [reverse proxy] ──▶ backend servers  (LB, TLS, cache, WAF)
```

A **forward proxy** represents the *client* — it sits between users and the internet for filtering, caching, or hiding client identity (corporate proxies, VPN-like egress). A **reverse proxy** represents the *server* — clients think they're talking to it, while it fronts a fleet of backends (nginx, Envoy, a CDN edge). An L7 load balancer *is* a specialized reverse proxy; it also naturally handles TLS termination, caching, rate limiting, and acting as a WAF.

## Why it matters

Load balancers and reverse proxies are the entry point of virtually every scalable system, so senior engineers are expected to reason about them fluently. The L4-vs-L7 trade-off is a real design decision — raw throughput and protocol-agnosticism versus content-aware routing and features — and choosing wrong means either a dumb balancer where you needed routing, or paying L7 overhead where L4 sufficed. The forward-vs-reverse distinction clarifies architecture discussions and appears constantly in system design interviews, where terminating TLS, adding a cache, doing health checks, and enabling zero-downtime deploys all hang off getting this layer right.

Why it matters

Related questions