---
title: "Load Balancer FAQ"
description: "Short answers about E2E load balancers, ALB or NLB, IPs, health checks, routing, listening ports and target ports, SSL, Kubernetes, BitNinja, and billing."
content_type: "faq"
product: "load-balancer"
platform: "MyAccount"
url: "/myaccount/load-balancer/faq/"
---

# Load Balancer FAQ

## Which regions can I create a load balancer in?

Delhi and Chennai. Each load balancer belongs to one region and one project. See
[Create an Application Load Balancer](/myaccount/load-balancer/how-to/create-an-application-load-balancer/#before-you-begin).

## Should I choose an ALB or an NLB?

An Application Load Balancer (ALB) for HTTP and HTTPS: it holds your SSL certificate, routes
requests by path, host, and more, and can use a scale group. A Network Load Balancer (NLB) for any
other TCP service, forwarded by port. You choose the type when you create the load balancer, and it
stays that type. See [Choose an ALB or an NLB](/myaccount/load-balancer/#choose-an-alb-or-an-nlb).

## Should I choose an external or an internal load balancer?

External, for users on the internet: it gets a public IP. Internal, for traffic from inside your
VPCs: it has no public IP, and resources in its VPC reach it at its VPC address. See
[Choose external or internal](/myaccount/load-balancer/#choose-external-or-internal).

## How do I give the load balancer an address in my VPC?

Attach the VPC on the load balancer's **Network** tab, under **Associated VPC**, or pick it under
**VPC** when you create the load balancer. The VPC address then shows in the list's **Private IP**
column and on the **Network** tab, and **Private IP** on the **Info** tab reads **Not Assigned**.

The first VPC you attach takes the place of the load balancer's **Private IP**. Then change each
**Server IP** to the server's address in the VPC, and allow the server port from the load
balancer's VPC address in each server's security group. See
[Attach a VPC](/myaccount/load-balancer/how-to/manage-network-and-security-groups/#attach-a-vpc).

## How do I point my domain at the load balancer?

Add an A record for your domain at your DNS provider, with the load balancer's **Public IP** as its
value. An external load balancer gets its public IP when you create it. See
[Get started with Load Balancer](/myaccount/load-balancer/get-started/#optional-point-your-domain-at-the-load-balancer).

## Do I need a reserved IP for my domain?

No. A load balancer keeps the same public IP when you power it off, start it, or upgrade its plan.
Reserve the IP to keep the address after you delete the load balancer, or choose a reserved IP you
already own when you create the load balancer. See
[Reserve the public IP](/myaccount/load-balancer/how-to/manage-network-and-security-groups/#reserve-the-public-ip).

## Can a load balancer have more than one public IP?

No. It has one public IPv4 address and takes no add-on IP. See
[Manage a load balancer's network and security groups](/myaccount/load-balancer/how-to/manage-network-and-security-groups/).

## Can two load balancers share a Floating IP for failover?

No. A Floating IP attaches only to nodes. See
[Reserve the public IP](/myaccount/load-balancer/how-to/manage-network-and-security-groups/#reserve-the-public-ip).

## What does Backend Connection Failure mean?

At least one server fails its checks, and the others keep serving. It can also show while every
server passes, when MyAccount receives no health data for the load balancer.
[The load balancer shows Backend Connection Failure](/myaccount/load-balancer/troubleshooting/load-balancer/#the-load-balancer-shows-backend-connection-failure)
explains what it means and what to check.

## What does the health check test?

An ALB with **Health Check** ticked sends each server an HTTP `HEAD` request for `/`, with the host
name `localhost`, and a status in the 200s or 300s passes. Without **Health Check**, and on a
Network Load Balancer, it checks that it can connect to the server's port. See
[Choose the health check](/myaccount/load-balancer/how-to/manage-backend-groups/#choose-the-health-check).

## Can I change the health check path?

No. On an ALB, the health check always requests `/` with the host name `localhost`. See
[Choose the health check](/myaccount/load-balancer/how-to/manage-backend-groups/#choose-the-health-check).

## How do I turn the health check off to test?

On an ALB, edit the backend group on **Backend Mapping**, untick **Health Check**, click
**Submit**, and then click **Save and Deploy**. The load balancer then checks only that it can
connect to each server's port. See
[The load balancer shows Backend Connection Failure](/myaccount/load-balancer/troubleshooting/load-balancer/#the-load-balancer-shows-backend-connection-failure).

## Which routing policy should I choose?

**Source IP Hash** when a user's session lives on one server, **Round Robin** when any server can
answer any request, and **Least Connection** for long-lived connections. See
[Choose a routing policy](/myaccount/load-balancer/how-to/manage-backend-groups/#choose-a-routing-policy).

## What happens when a backend server goes down?

The load balancer stops sending it traffic about six seconds after it starts failing its checks, and
the other servers in the group take it. Under **Source IP Hash**, the down server's clients move to
the others. When no server passes, an Application Load Balancer answers
**503 Service Unavailable**, and a Network Load Balancer closes each connection without sending any
data. A server that recovers gets traffic again about four seconds after it starts answering its
checks again. See
[Choose a routing policy](/myaccount/load-balancer/how-to/manage-backend-groups/#choose-a-routing-policy).

## Can I set up primary and standby servers?

No. Every server in a backend group takes traffic. See
[Choose a routing policy](/myaccount/load-balancer/how-to/manage-backend-groups/#choose-a-routing-policy).

## Does the load balancer support sticky sessions?

Yes, through **Source IP Hash**, which keeps each client on one server by its IP address. The load
balancer sets no session cookie, and clients behind one shared address all reach the same server.
See
[Choose a routing policy](/myaccount/load-balancer/how-to/manage-backend-groups/#choose-a-routing-policy).

## How does my application see the client's real IP address?

Read it from the `X-Forwarded-For` header. Over HTTP, an ALB passes the client's IP address to
your application in that header, while the connection itself comes from the load balancer. See
[Requests your servers receive (ALB)](/myaccount/load-balancer/how-to/manage-backend-groups/#requests-your-servers-receive-alb).

## How do I run several sites or applications behind one load balancer?

Put each application's servers in its own backend group on an ALB, and add an ACL rule for each: by
path, host name, query parameter, HTTP method, or client IP. Requests that match no rule go to the
first backend group. See
[Route requests with ACL rules](/myaccount/load-balancer/how-to/route-requests-with-acl-rules/).

## Does path routing work on an internal load balancer?

Yes, on an ALB. ACL rules work the same on internal and external load balancers, for HTTP and
HTTPS requests alike. See
[Route requests with ACL rules](/myaccount/load-balancer/how-to/route-requests-with-acl-rules/).

## What can an ACL rule's name contain?

Letters, digits, underscores, and hyphens, up to 32 characters, and each rule on the load balancer
needs its own name. See
[Add a rule](/myaccount/load-balancer/how-to/route-requests-with-acl-rules/#add-a-rule).

## Why does all my traffic go to one backend group?

Because an ALB sends requests to the first backend group unless an ACL rule sends them to another.
To spread traffic across all your servers, put them in one group. See
[All traffic goes to one group or one server](/myaccount/load-balancer/troubleshooting/load-balancer/#all-traffic-goes-to-one-group-or-one-server).

## Can I edit a backend group in place?

Yes. Edit the group's row on **Backend Mapping**, click **Submit**, and then click
**Save and Deploy**. See
[Add or change servers](/myaccount/load-balancer/how-to/manage-backend-groups/#add-or-change-servers).

## Can a node and a scale group share a backend group?

No. On an ALB, a backend group takes either a list of servers or one scale group. Put them in
separate groups, and use ACL rules to send requests to the second one. See
[Use a scale group (ALB)](/myaccount/load-balancer/how-to/manage-backend-groups/#use-a-scale-group-alb).

## Which files do I need to add my certificate?

Three: the certificate, its private key, and the certificate chain. Import all three in
**SSL Certificates**. Then, on an ALB, set **Frontend Protocol** to **HTTPS** or
**Both (HTTP and HTTPS)** and choose the certificate under **SSL**. See
[Add an SSL certificate](/myaccount/load-balancer/how-to/add-an-ssl-certificate/).

## Can a load balancer hold several SSL certificates?

No. An ALB holds one certificate. For several domains, use one wildcard or multi-domain
certificate that covers them all. See
[Add an SSL certificate](/myaccount/load-balancer/how-to/add-an-ssl-certificate/).

## Why is the certificate I bought from E2E missing from the SSL list?

The list shows only imported certificates. Import the certificate with its private key and the
certificate chain, and it appears. See
[Import the certificate](/myaccount/load-balancer/how-to/add-an-ssl-certificate/#import-the-certificate).

## Can I use one certificate in Delhi and in Chennai?

Yes. An imported certificate belongs to the project rather than to a region, so load balancers in
both regions can choose it under **SSL**. See
[Import the certificate](/myaccount/load-balancer/how-to/add-an-ssl-certificate/#import-the-certificate).

## How do I renew the certificate?

Import the renewed certificate, then choose it under **SSL** on the ALB's **Info** tab and save.
See
[Renew or replace the certificate](/myaccount/load-balancer/how-to/add-an-ssl-certificate/#renew-or-replace-the-certificate).

## How do I redirect HTTP to HTTPS?

With an ALB, set **Frontend Protocol** to **Both (HTTP and HTTPS)**, and tick
**HTTP Redirect**, on the **Details** step when you create the load balancer or in the edit form on
its **Info** tab. See
[Add an SSL certificate: Redirect HTTP to HTTPS](/myaccount/load-balancer/how-to/add-an-ssl-certificate/#redirect-http-to-https).

## Can one path stay on HTTP while the rest is redirected?

No. The redirect applies to every request on port 80, whatever the path, and ACL rules do not
change it. See
[Add an SSL certificate: Redirect HTTP to HTTPS](/myaccount/load-balancer/how-to/add-an-ssl-certificate/#redirect-http-to-https).

## Can traffic stay encrypted from the load balancer to my servers?

Yes, on an ALB. Set the backend group's **Backend Protocol** to **HTTPS**, and the load balancer
connects to your servers over HTTPS. See
[Choose the backend protocol (ALB)](/myaccount/load-balancer/how-to/manage-backend-groups/#choose-the-backend-protocol-alb).

## Does the load balancer support HTTP/2?

Yes, over HTTPS on an ALB, along with HTTP/1.1. See
[Add an SSL certificate](/myaccount/load-balancer/how-to/add-an-ssl-certificate/).

## On an NLB, what is the difference between LB Listening Port and Server Port?

**LB Listening Port** is the port clients connect to on the load balancer. **Server Port** is the
port your service listens on in each server. They can differ. Some call these the target port and
the backend port. See
[Set up a backend group for each port](/myaccount/load-balancer/how-to/create-a-network-load-balancer/#set-up-a-backend-group-for-each-port).

## Which ports can an NLB listen on?

443, and 1024 to 65535, apart from 8080, 10050, and 9101. Each backend group listens on its own
port. Port 80 is also accepted, but keep NLB groups off it: about half of the connections to a group
there get **503 Service Unavailable**. See
[Create a Network Load Balancer](/myaccount/load-balancer/how-to/create-a-network-load-balancer/).

## Can one NLB serve several ports?

Yes. Add a backend group for each port, each with its own **LB Listening Port** and at least one
server. See
[Add a backend group](/myaccount/load-balancer/how-to/manage-backend-groups/#add-a-backend-group).

## Does an NLB decrypt TLS?

No. A Network Load Balancer forwards encrypted traffic unchanged, and your servers handle the
certificate. For HTTPS handled on the load balancer, use an Application Load Balancer. See
[Add an SSL certificate](/myaccount/load-balancer/how-to/add-an-ssl-certificate/).

## Can an NLB forward UDP?

No. A Network Load Balancer forwards TCP only. See
[Create a Network Load Balancer](/myaccount/load-balancer/how-to/create-a-network-load-balancer/).

## Can I sign in to the load balancer?

No. You set up the load balancer from MyAccount or the API. See
[Load Balancer](/myaccount/load-balancer/).

## Can I ping the load balancer?

No. To check that the load balancer is reachable, connect to one of its listening ports instead,
for example `curl -I http://<load-balancer-ip>/`. See
[The load balancer does not answer ping](/myaccount/load-balancer/troubleshooting/load-balancer/#the-load-balancer-does-not-answer-ping).

## Which security group rules does the load balancer need?

Two sets. The load balancer's security group must allow its listening ports from your users. Each
server's security group must allow the server port from the load balancer's private IP, or from its
VPC address once it is in a VPC. See
[Manage a load balancer's network and security groups](/myaccount/load-balancer/how-to/manage-network-and-security-groups/).

## Where are the request logs?

In your E2E Object Storage bucket, once you turn on access logs. The **Action Logs** tab lists
actions taken on the load balancer, not requests. See
[Save access logs to a bucket](/myaccount/load-balancer/how-to/save-access-logs-to-a-bucket/).

## Can I collect the load balancer's metrics in my own Prometheus?

No. You read the load balancer's metrics in MyAccount, on the **Stats** and **Prometheus Stats**
tabs. See
[Read the live statistics](/myaccount/load-balancer/how-to/monitor-a-load-balancer/#read-the-live-statistics).

## How do I use BitNinja on a load balancer?

Tick **Bitninja** when you create the load balancer, or click **Buy** beside **Bitninja** on its
**Info** tab. Ticking it also sets up a BitNinja account under your email; the load balancer is
created once that account is ready. Each load balancer has its own licence, billed while it is
active. See
[Turn BitNinja on or off](/myaccount/load-balancer/how-to/view-and-edit-details/#turn-bitninja-on-or-off).

## Is a Kubernetes Service of type LoadBalancer the same thing?

No. A Kubernetes Service of type LoadBalancer takes an IP from the cluster's **LB IP Pool**, and
nothing appears on the **Load Balancers** page. The node list in **Add Server** leaves Kubernetes
nodes out. See
[Expose a service with a load balancer](/myaccount/kubernetes/how-to/expose-a-service-with-a-load-balancer/).

## Can I change the type or turn on encryption later?

No. The type and the encryption setting are chosen when you create the load balancer. To change one,
create a new load balancer. See
[Create an Application Load Balancer](/myaccount/load-balancer/how-to/create-an-application-load-balancer/).

## Which timeouts can I set?

**Connection Timeout**, **Client Timeout**, and **Server Timeout**, each from 60 to 10000 seconds.
An ALB also has **HTTP Keep Alive Timeout**, with the same range, and a
**Web Socket Timeout** of 1 to 100 hours for each backend group. See
[Change the timeouts](/myaccount/load-balancer/how-to/view-and-edit-details/#change-the-timeouts).

## How do I choose a plan size?

Compare the plans in the plan table, which lists each plan's **vCPU**, **RAM**,
**Max Concurrent Connections**, and price. The four plans run from **E2E-LB-2**, with 4 vCPU and
6 GB RAM, to **E2E-LB-5**, with 24 vCPU and 48 GB RAM. On hourly billing, you can move to a larger
plan later. See
[Choose the plan](/myaccount/load-balancer/how-to/create-an-application-load-balancer/#choose-the-plan).

## Can I move a load balancer to a bigger plan?

Yes, on hourly billing. Power off the load balancer first. See
[Upgrade the plan](/myaccount/load-balancer/how-to/power-off-start-or-upgrade/#upgrade-the-plan).

## What does a load balancer cost?

It is billed by its plan, by the minute, from when you create it until you delete it. On a committed
plan, it is billed for a fixed period of 90, 183, or 365 days instead. For current prices, see
[E2E's pricing page](https://www.e2enetworks.com/pricing).

## Is a committed load balancer refunded if I delete it early?

No. The full price for the committed period is charged when you commit, and it stays charged if
you delete the load balancer before the period ends. See
[Use committed billing for a load balancer](/myaccount/load-balancer/how-to/use-committed-billing/).

## Am I billed while a load balancer is powered off?

Yes. The charges continue while it is powered off, until you delete it. See
[Delete a load balancer](/myaccount/load-balancer/how-to/delete-a-load-balancer/).

## Why am I still charged after deleting a load balancer?

A public IP you reserved when you deleted it is billed until you release it on the
**Reserved IP** page. The load balancer itself reads **Deleting** until it is gone. See
[A deleted load balancer is still listed or still billed](/myaccount/load-balancer/troubleshooting/load-balancer/#a-deleted-load-balancer-is-still-listed-or-still-billed).