Introduction
The Nutanix Flow Network Load Balancer solution is a high-performance Layer 4 load balancer built directly into the Nutanix AHV hypervisor, operating without the need for third-party hardware or VM based appliances. A key decision when deploying the Flow Network Load Balancer is determining the traffic scope whether the traffic originates from within the VPC (Internal Load Balancing) or outside the VPC (External Load Balancing). This blog breaks down the key differences, use cases, and packet flow for both approaches.
While the primary decision is based on whether traffic is internal or external to the VPC, this choice also determines whether the load balancing behavior is distributed across AHV hosts or centralized via VPC gateway nodes.
Why is Internal and External Load Balancing required?
Modern enterprise applications typically follow a multi-tier architecture involving web, application, and database layers. Deploying a load balancer without understanding the boundary of the Virtual IP (VIP) can lead to:
- Unintended exposure of internal backend services (e.g., databases) to the public internet.
- Inefficient routing of East-West (E-W) traffic, pushing internal communications through external NAT boundaries.
- Complex IPAM management when handling external networks or Floating IPs.
Customers need a clear methodology for intelligently steering traffic based on whether the source is a public client, a corporate network, or an internal workload inside the same VPC.
What is Internal and External Load Balancing?
Internal Load Balancing- Internal load balancing handles the distribution of East-West (E-W) traffic originating from within a VPC across a collection of backend virtual machines. In this configuration, the Virtual IP (VIP) is allocated directly from the overlay network and is intended for internal use, meaning it does not need to be accessible from outside the VPC. This makes the internal Load Balancer fully Distributed in nature.
External Load Balancing- External load balancing involves the distribution of traffic originating from outside a VPC across a designated group of backend virtual machines. In this scenario, the load balancer's Virtual IP (VIP) is requested from the external network connected to the VPC. This approach is commonly used for virtual machines hosting web applications that communicate directly with the external environment. This approach keeps the External Load Balancer Centralised per VPC.
Internal Load Balancing
Figure1- Internal Load Balancing for traffic inside the VPC
The traffic flow is as below:
- Client VM initiates traffic to the VIP.
- Load balancing decisions are made on the local AHV host.
- Our native SDN stack utilises linux connection tracking for storing the LB decision and creating the DNAT entry.
- Packet is tunneled (Geneve) to the AHV host of the selected backend VM.
- Response traffic returns to the originating host via Geneve tunnel.
- The same DNAT entry from the above step is used to reverse NAT the packet and deliver it back to the client.
External Load Balancing
Figure 2- External Load Balancing for traffic outside the VPC
The traffic flow is as below:
- External traffic arrives via VIP advertised through infra/BGP.
- Traffic is routed to a VPC gateway node.
- Gateway performs DNAT to a backend VM.
- Packet is tunneled (Geneve) to the destination host.
- Response follows the same gateway path back.
Conclusion
In modern architectures, effective load balancing is not just about distributing traffic; it’s about doing so intelligently across both external and internal layers of your system. External load balancing is designed to route incoming user traffic efficiently, optimizing availability, reducing latency, and protecting applications from overload. At the same time, internal load balancing plays an equally critical role by managing service-to-service communication within the system, enabling scalability, resilience, and smooth workload distribution across microservices or backend components.
Together, these two layers create a cohesive traffic management strategy. External load balancers act as the first line of defense and entry point, while internal load balancers help route traffic so that, once it enters the system, it flows seamlessly between services helping reduce the risk of bottlenecks or single points of failure.
By thoughtfully implementing both, organizations can achieve high availability, fault tolerance, and optimal performance at scale. Ultimately, the synergy between internal and external load balancing is what enables robust, cloud-native systems capable of handling dynamic workloads with confidence.
©2026 Nutanix, Inc. All rights reserved. Nutanix, the Nutanix logo and all Nutanix product and service names mentioned are registered trademarks or trademarks of Nutanix, Inc. in the United States and other countries. All other brand names mentioned are for identification purposes only and may be the trademarks of their respective holder(s).
