{"id":947,"date":"2026-04-17T05:52:26","date_gmt":"2026-04-17T05:52:26","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-network-load-balancer-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-networking-edge-and-connectivity\/"},"modified":"2026-04-17T05:52:26","modified_gmt":"2026-04-17T05:52:26","slug":"oracle-cloud-network-load-balancer-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-networking-edge-and-connectivity","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-network-load-balancer-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-networking-edge-and-connectivity\/","title":{"rendered":"Oracle Cloud Network Load Balancer Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Networking, Edge, and Connectivity"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Networking, Edge, and Connectivity<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>Oracle Cloud <strong>Network Load Balancer<\/strong> is a managed, Layer 4 (transport-layer) load balancing service designed to distribute <strong>TCP and UDP<\/strong> traffic across backend servers with <strong>low latency<\/strong> and <strong>high throughput<\/strong>.<\/p>\n\n\n\n<p>In simple terms: you place a Network Load Balancer in front of multiple servers (VMs, bare metal, or IP-based targets), and clients connect to a single IP address. The service then forwards each connection to a healthy backend so your application can scale and survive failures.<\/p>\n\n\n\n<p>Technically, Network Load Balancer operates at Layer 4: it does not understand HTTP paths, headers, or cookies. Instead, it balances traffic based on transport information (such as destination port and connection flows). It integrates natively with Oracle Cloud networking constructs like <strong>VCNs, subnets, route tables, security lists, and Network Security Groups (NSGs)<\/strong> and is managed via the Console, API, CLI, and Terraform.<\/p>\n\n\n\n<p><strong>What problem it solves:<\/strong> it provides a highly available front door for TCP\/UDP services (APIs over TCP, gaming, IoT protocols, DNS, syslog, custom protocols, database proxies) without the overhead of application-layer (Layer 7) processing\u2014and without you having to operate your own HAProxy\/Nginx\/LVS fleet.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Network Load Balancer?<\/h2>\n\n\n\n<p><strong>Official purpose (OCI service intent):<\/strong> Network Load Balancer in Oracle Cloud Infrastructure (Oracle Cloud) provides <strong>Layer 4<\/strong> load balancing for <strong>TCP and UDP<\/strong> traffic, distributing connections across multiple backends while performing health checks to route traffic only to healthy targets.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Load balancing for TCP and UDP<\/strong> workloads (transport-layer).<\/li>\n<li><strong>Public or private<\/strong> load balancer deployment, depending on whether you need internet-facing or internal-only traffic.<\/li>\n<li><strong>Backend health checks<\/strong> to detect failures and stop sending traffic to unhealthy servers.<\/li>\n<li><strong>Highly available managed service<\/strong> so you don\u2019t manage load balancer nodes, failover, patching, or scaling of the load balancer infrastructure.<\/li>\n<li><strong>Native Oracle Cloud networking integration<\/strong> with VCNs, subnets, NSGs\/security lists, and routing.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Major components (conceptual model)<\/h3>\n\n\n\n<p>While exact UI labels may evolve, Network Load Balancer implementations typically include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Network Load Balancer (NLB)<\/strong>: the load balancer resource itself, attached to a subnet, providing one or more front-end addresses.<\/li>\n<li><strong>Listener<\/strong>: a front-end protocol\/port that accepts client connections (for example TCP\/80 or UDP\/53).<\/li>\n<li><strong>Backend set<\/strong>: a logical group of backend servers and a health check policy.<\/li>\n<li><strong>Backends<\/strong>: the actual targets (commonly private IP:port combinations) that receive forwarded traffic.<\/li>\n<li><strong>Health check<\/strong>: the probe configuration that determines whether a backend is healthy for receiving traffic.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Service type and scope<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Service type:<\/strong> Managed load balancer (LBaaS) focused on <strong>Layer 4<\/strong>.<\/li>\n<li><strong>Scope:<\/strong> Network Load Balancer is created within an Oracle Cloud <strong>compartment<\/strong> and attached to a <strong>VCN subnet<\/strong> in a region.<\/li>\n<li><strong>Regional vs. zonal:<\/strong> Oracle Cloud networking resources are generally regional in nature (VCNs and regional subnets). Network Load Balancer is designed for <strong>regional high availability<\/strong>. Availability and implementation details can vary by region\u2014<strong>verify in official docs<\/strong> for any region-specific constraints.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into the Oracle Cloud ecosystem<\/h3>\n\n\n\n<p>Network Load Balancer is part of Oracle Cloud\u2019s <strong>Networking, Edge, and Connectivity<\/strong> portfolio, complementing:\n&#8211; <strong>Oracle Cloud Load Balancer<\/strong> (application-capable load balancing and more advanced L7-style features)\n&#8211; <strong>VCN<\/strong> primitives (subnets, route tables, gateways, NSGs)\n&#8211; <strong>Compute<\/strong> (VMs\/bare metal backends)\n&#8211; <strong>Monitoring &amp; Alarms<\/strong> (operational metrics)\n&#8211; <strong>Logging &amp; Audit<\/strong> (governance; access logging availability depends on service capabilities\u2014<strong>verify in official docs<\/strong>)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Network Load Balancer?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Higher availability without custom engineering:<\/strong> you avoid building\/operating a redundant load balancer layer.<\/li>\n<li><strong>Faster time to production:<\/strong> an NLB can be provisioned in minutes with consistent patterns across environments.<\/li>\n<li><strong>Cost control via managed service:<\/strong> reduces operational overhead compared to self-managed HAProxy\/Nginx fleets.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Layer 4 performance:<\/strong> ideal when you need minimal overhead and high throughput for TCP\/UDP.<\/li>\n<li><strong>Protocol flexibility:<\/strong> works for non-HTTP protocols where a Layer 7 proxy is unnecessary or harmful.<\/li>\n<li><strong>Health-based routing:<\/strong> keeps traffic away from failed or overloaded instances when health checks fail.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Managed lifecycle:<\/strong> patching and scaling of the load balancer infrastructure is handled by Oracle Cloud.<\/li>\n<li><strong>Automation:<\/strong> infrastructure-as-code support via OCI APIs, CLI, and Terraform makes it CI\/CD-friendly.<\/li>\n<li><strong>Clear separation:<\/strong> NLB provides a stable front-end endpoint while backends scale up\/down behind it.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Network segmentation:<\/strong> place backends in private subnets; expose only the NLB.<\/li>\n<li><strong>Policy-based access control:<\/strong> compartment-level IAM policies can strictly control who can create\/modify NLBs.<\/li>\n<li><strong>Reduced attack surface:<\/strong> backends do not need public IPs; only NLB subnet must be exposed (for public use cases).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Horizontal scaling:<\/strong> add\/remove backends without changing the client endpoint.<\/li>\n<li><strong>High availability:<\/strong> reduces single points of failure at the entry point.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<p>Choose Network Load Balancer when:\n&#8211; You need <strong>TCP or UDP<\/strong> load balancing.\n&#8211; You want <strong>low latency<\/strong> and minimal proxy overhead.\n&#8211; You don\u2019t need HTTP-aware features like host\/path routing.\n&#8211; You want to keep servers private and present a single stable IP endpoint.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When they should not choose it<\/h3>\n\n\n\n<p>Avoid Network Load Balancer when:\n&#8211; You need <strong>Layer 7<\/strong> features (HTTP header routing, URL path routing, cookie-based session persistence, header manipulation).\n&#8211; You need integrated <strong>WAF<\/strong>-style HTTP protections at the load balancer layer (generally Layer 7).\n&#8211; You require application-level observability (detailed HTTP access logs, request tracing at the proxy) and NLB doesn\u2019t provide it for your needs (capabilities vary\u2014<strong>verify in official docs<\/strong>).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Network Load Balancer used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SaaS and B2B platforms serving TCP-based APIs<\/li>\n<li>Financial services (internal services, trading gateways, risk engines using TCP)<\/li>\n<li>Telecom and media (streaming control planes, signaling, UDP-based services)<\/li>\n<li>Gaming (real-time multiplayer backends over UDP\/TCP)<\/li>\n<li>Manufacturing\/IoT (MQTT-like TCP traffic, custom telemetry protocols)<\/li>\n<li>Education and research (HPC control services, internal registries)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Platform engineering teams standardizing entry points<\/li>\n<li>DevOps\/SRE teams improving reliability and scaling<\/li>\n<li>Network\/security teams enforcing segmentation and exposure controls<\/li>\n<li>Application teams exposing TCP services without rewriting<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>TCP APIs (including gRPC-over-TCP patterns where L7 routing isn\u2019t needed)<\/li>\n<li>UDP services (DNS, telemetry ingestion, some real-time protocols)<\/li>\n<li>Custom binary protocols<\/li>\n<li>Internal east-west traffic load balancing (private NLB)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Multi-tier VCN architectures with public edge + private application tiers<\/li>\n<li>Hub-and-spoke networks where shared services are fronted by internal NLBs<\/li>\n<li>Hybrid connectivity where on-prem clients reach OCI backends via FastConnect\/VPN and a private NLB<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Production vs dev\/test usage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Production:<\/strong> stable endpoint, health checks, controlled exposure, and operational metrics are strong drivers.<\/li>\n<li><strong>Dev\/test:<\/strong> useful for validating scaling and failure behavior; but be cost-aware since load balancers can accrue hourly usage charges (pricing varies\u2014see the Pricing section).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic scenarios where Oracle Cloud Network Load Balancer is a strong fit.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Internet-facing TCP API endpoint<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> You run multiple stateless API servers and need one stable IP\/port for clients.<\/li>\n<li><strong>Why NLB fits:<\/strong> Layer 4 TCP balancing is fast and doesn\u2019t require HTTP awareness.<\/li>\n<li><strong>Example:<\/strong> Mobile apps connect to <code>api.example.com:443<\/code> which resolves to an NLB public IP forwarding to multiple API VMs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Internal service load balancing (private endpoint)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Many internal microservices need a stable endpoint for a TCP service in a private subnet.<\/li>\n<li><strong>Why NLB fits:<\/strong> Private NLB exposes a single internal IP and keeps traffic within the VCN.<\/li>\n<li><strong>Example:<\/strong> Internal \u201cauth\u201d service listens on TCP\/8443; private NLB forwards requests from app tier to auth backends.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) UDP-based DNS forwarding tier<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> You need resilient DNS forwarding\/recursor endpoints with scaling and health checks.<\/li>\n<li><strong>Why NLB fits:<\/strong> Supports UDP load balancing for DNS traffic.<\/li>\n<li><strong>Example:<\/strong> Clients send UDP\/53 to an NLB which forwards to multiple DNS resolvers in private subnets.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Telemetry ingestion over TCP (custom protocol)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Devices send telemetry over a proprietary TCP protocol; you need scaling and failover.<\/li>\n<li><strong>Why NLB fits:<\/strong> Works well for non-HTTP protocols without requiring L7 termination.<\/li>\n<li><strong>Example:<\/strong> Thousands of sensors connect to TCP\/9000 on an NLB distributing connections across ingestion nodes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Gaming backend (UDP sessions)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Real-time game servers need UDP load distribution and fast failover.<\/li>\n<li><strong>Why NLB fits:<\/strong> UDP support and low latency at Layer 4.<\/li>\n<li><strong>Example:<\/strong> Players connect to UDP\/27015 on an NLB; sessions distribute across game server fleet.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Database proxy tier (TCP)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> You operate database proxies (or read-only replicas behind a proxy layer) and want a stable endpoint.<\/li>\n<li><strong>Why NLB fits:<\/strong> TCP load balancing and health checks can keep traffic away from failed proxies.<\/li>\n<li><strong>Example:<\/strong> Apps connect to NLB TCP\/6432 which forwards to pgBouncer instances.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Syslog \/ log forwarding collectors (UDP\/TCP)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Many systems send syslog to a central endpoint; collectors must scale.<\/li>\n<li><strong>Why NLB fits:<\/strong> Supports UDP\/TCP; keeps collectors private.<\/li>\n<li><strong>Example:<\/strong> Syslog over UDP\/514 hits NLB and distributes to collectors; collectors forward to a SIEM.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Blue\/green deployments for TCP services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> You want to roll out a new version of a TCP service with minimal client disruption.<\/li>\n<li><strong>Why NLB fits:<\/strong> Move traffic by adding\/removing backends or switching backend sets (capabilities vary by configuration).<\/li>\n<li><strong>Example:<\/strong> Add new backend pool \u201cgreen,\u201d validate health, then gradually drain \u201cblue.\u201d<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Hybrid access to OCI backends (FastConnect\/VPN)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> On-prem clients need to reach OCI services through private connectivity.<\/li>\n<li><strong>Why NLB fits:<\/strong> Private NLB provides a stable private endpoint for on-prem routing.<\/li>\n<li><strong>Example:<\/strong> ERP on-prem connects over FastConnect to private NLB IP that fronts TCP application servers in OCI.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Inbound TLS passthrough to service mesh\/gateway<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> You terminate TLS inside your cluster or gateway and want the load balancer to just forward TCP.<\/li>\n<li><strong>Why NLB fits:<\/strong> As Layer 4, it can forward TCP connections without HTTP termination.<\/li>\n<li><strong>Example:<\/strong> NLB forwards TCP\/443 to an internal ingress gateway that handles TLS and routing.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>The exact feature set can evolve by region and release. The items below reflect core, widely expected capabilities of Oracle Cloud Network Load Balancer; confirm any region-specific details in the official documentation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Layer 4 load balancing for TCP and UDP<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Distributes transport connections\/flows to backends.<\/li>\n<li><strong>Why it matters:<\/strong> Keeps latency low and supports non-HTTP protocols.<\/li>\n<li><strong>Practical benefit:<\/strong> Works for DNS (UDP), telemetry protocols, database proxies, and generic TCP services.<\/li>\n<li><strong>Caveats:<\/strong> No HTTP header\/path routing; not a WAF; not an application gateway.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Public and private load balancer options<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Allows internet-facing (public) or internal-only (private) endpoints.<\/li>\n<li><strong>Why it matters:<\/strong> Supports both edge and east-west use cases.<\/li>\n<li><strong>Practical benefit:<\/strong> Keep backends private while exposing only the NLB.<\/li>\n<li><strong>Caveats:<\/strong> Public endpoints must be protected by security rules; private endpoints require correct routing from clients (VCN peering\/FastConnect\/VPN).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Backend sets and health checks<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Groups backends and probes them for availability.<\/li>\n<li><strong>Why it matters:<\/strong> Automated failover; prevents blackholing traffic to dead instances.<\/li>\n<li><strong>Practical benefit:<\/strong> You can patch or replace instances and rely on health checks to gate traffic.<\/li>\n<li><strong>Caveats:<\/strong> Health check types\/behavior (TCP vs higher-layer checks) depend on service implementation\u2014use TCP checks if you want the most universally supported approach.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Listener configuration per protocol\/port<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Exposes one or more front-end ports (e.g., TCP\/80, TCP\/443, UDP\/53).<\/li>\n<li><strong>Why it matters:<\/strong> One NLB can represent multiple service entry points if supported.<\/li>\n<li><strong>Practical benefit:<\/strong> Reduce resource sprawl and simplify endpoint management.<\/li>\n<li><strong>Caveats:<\/strong> Listener count and port range limits are subject to OCI quotas\/limits.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) High availability (managed service)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Oracle Cloud runs redundant infrastructure so a single LB node failure doesn\u2019t take you down.<\/li>\n<li><strong>Why it matters:<\/strong> Load balancer HA is non-trivial to build correctly and consistently.<\/li>\n<li><strong>Practical benefit:<\/strong> You focus on backends and app logic rather than LB redundancy.<\/li>\n<li><strong>Caveats:<\/strong> Your architecture must still be HA: place backends across failure domains\/availability domains when possible.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Works with IP-based backends in VCN networking<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Targets are typically addressed by private IP and port.<\/li>\n<li><strong>Why it matters:<\/strong> Decouples backends from specific compute constructs; works across VMs and appliances.<\/li>\n<li><strong>Practical benefit:<\/strong> You can load balance to custom appliances, containers on VMs, or on-prem reachable IPs (subject to routing and security).<\/li>\n<li><strong>Caveats:<\/strong> Ensure routing and security rules permit the NLB to reach backend IPs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Native integration with security lists and Network Security Groups (NSGs)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Uses VCN subnet security and NSGs to control inbound\/outbound traffic.<\/li>\n<li><strong>Why it matters:<\/strong> Consistent security posture with the rest of Oracle Cloud networking.<\/li>\n<li><strong>Practical benefit:<\/strong> Least-privilege rules: only allow required ports from NLB subnet to backends.<\/li>\n<li><strong>Caveats:<\/strong> Misconfigured NSG\/security lists are the #1 cause of \u201cunhealthy backend\u201d issues.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Observability via metrics (Monitoring service)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Publishes LB metrics for traffic, backend health, and performance indicators (exact metric names vary).<\/li>\n<li><strong>Why it matters:<\/strong> Enables SRE practices: alerts, SLO tracking, and capacity planning.<\/li>\n<li><strong>Practical benefit:<\/strong> Alarm when healthy backend count drops or traffic spikes.<\/li>\n<li><strong>Caveats:<\/strong> Access logging\/flow logging availability varies by service\u2014use VCN Flow Logs where appropriate and <strong>verify<\/strong> NLB-specific logs in docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Automation via Console, API, CLI, and Terraform<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Fully manageable as code.<\/li>\n<li><strong>Why it matters:<\/strong> Repeatable environments, safe changes, and auditability.<\/li>\n<li><strong>Practical benefit:<\/strong> Use Terraform to create NLBs per environment with consistent naming and tagging.<\/li>\n<li><strong>Caveats:<\/strong> Apply change control; load balancers are critical shared infrastructure.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Compartment-based governance and tagging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Uses OCI compartments and tags for governance, billing, and access control.<\/li>\n<li><strong>Why it matters:<\/strong> Network services can sprawl quickly without governance.<\/li>\n<li><strong>Practical benefit:<\/strong> Allocate costs by project\/team; enforce policies per compartment.<\/li>\n<li><strong>Caveats:<\/strong> Tagging is only effective if enforced via policy and used consistently.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<p>A Network Load Balancer sits inside a VCN subnet and exposes one or more front-end addresses. Clients connect to the listener. The NLB selects a healthy backend from a backend set and forwards the connection (TCP) or flow (UDP).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane (management):<\/strong><\/li>\n<li>You create\/update the NLB using Console\/API\/CLI\/Terraform.<\/li>\n<li>IAM policies control who can manage the resource.<\/li>\n<li>Audit logs record API calls (via OCI Audit).<\/li>\n<li><strong>Data plane (traffic):<\/strong><\/li>\n<li>Client connects to NLB frontend IP:port.<\/li>\n<li>NLB forwards to a healthy backend IP:port.<\/li>\n<li>Health checks continually evaluate backend health; unhealthy backends are removed from rotation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>VCN &amp; Subnets:<\/strong> NLB is attached to a subnet (public or private). Route tables and gateways determine reachability.<\/li>\n<li><strong>NSGs\/Security Lists:<\/strong> Enforce inbound access to the NLB and backend access from the NLB to targets.<\/li>\n<li><strong>Compute (VM\/BM):<\/strong> Common backend targets.<\/li>\n<li><strong>Monitoring &amp; Alarms:<\/strong> Metrics-based alerting for backend health and traffic.<\/li>\n<li><strong>Logging\/Audit:<\/strong> Audit records management operations; traffic logging depends on features\u2014<strong>verify in official docs<\/strong>.<\/li>\n<li><strong>Terraform\/Resource Manager:<\/strong> Infrastructure as code provisioning and changes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services<\/h3>\n\n\n\n<p>At minimum, you need:\n&#8211; A <strong>VCN<\/strong>\n&#8211; A <strong>subnet<\/strong> (often regional)\n&#8211; <strong>Backend targets<\/strong> reachable from that subnet via VCN routing\n&#8211; Correct <strong>security rules<\/strong> (NLB ingress and backend ingress)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>IAM:<\/strong> Policies grant permissions to create and manage network load balancers and to use networking resources (subnets, NSGs).<\/li>\n<li><strong>Network security:<\/strong> Implemented through security lists\/NSGs and route tables.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model (practical view)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>For a <strong>public NLB<\/strong>, inbound client traffic comes from the internet to the NLB\u2019s public endpoint; backend traffic stays within the VCN to private IPs.<\/li>\n<li>For a <strong>private NLB<\/strong>, both clients and backends are internal; clients reach the NLB via VCN routing (local, peering, DRG, FastConnect, or VPN).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Track:<\/li>\n<li>Healthy backend count<\/li>\n<li>Connection\/packet\/byte rates (exact metrics vary)<\/li>\n<li>Error conditions (health check failures, backend resets)<\/li>\n<li>Use:<\/li>\n<li><strong>OCI Monitoring alarms<\/strong> for thresholds and anomaly indicators<\/li>\n<li><strong>OCI Audit<\/strong> to detect and investigate configuration changes<\/li>\n<li><strong>VCN Flow Logs<\/strong> (where enabled) to debug traffic patterns at subnet\/VNIC level (useful when access logs aren\u2019t available)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  C[Client] --&gt;|TCP\/80 or UDP\/53| NLB[Oracle Cloud\\nNetwork Load Balancer]\n  NLB --&gt; B1[Backend 1\\n10.0.1.10:80]\n  NLB --&gt; B2[Backend 2\\n10.0.1.11:80]\n  HC[Health Checks] -.-&gt; B1\n  HC -.-&gt; B2\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  Internet((Internet)) --&gt; Edge[Oracle Cloud Edge\\n(DDoS protections at edge)]\n  Edge --&gt; PubNLB[Public Network Load Balancer\\nSubnet: Public]\n\n  subgraph VCN[VCN 10.0.0.0\/16]\n    direction TB\n\n    subgraph PublicSubnet[Public Subnet]\n      PubNLB\n    end\n\n    subgraph PrivateAppSubnets[Private App Subnets (regional)]\n      App1[App VM 1\\nNSG: app-nsg]\n      App2[App VM 2\\nNSG: app-nsg]\n      AutoScale[Instance Pool \/ Autoscaling\\n(optional)]\n    end\n\n    subgraph DataSubnet[Private Data Subnet]\n      DB[(Database \/ Service)]\n    end\n\n    PubNLB --&gt;|Forward TCP| App1\n    PubNLB --&gt;|Forward TCP| App2\n    App1 --&gt; DB\n    App2 --&gt; DB\n  end\n\n  Ops[Monitoring + Alarms] --- PubNLB\n  Audit[OCI Audit] --- PubNLB\n  Bastion[OCI Bastion\\n(Admin SSH)] --&gt; App1\n  Bastion --&gt; App2\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<p>Before you start, confirm the following.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Tenancy and compartment requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An active <strong>Oracle Cloud<\/strong> tenancy.<\/li>\n<li>Access to a <strong>compartment<\/strong> where you can create networking and compute resources.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM policies<\/h3>\n\n\n\n<p>You typically need permissions to:\n&#8211; Create\/manage <strong>Network Load Balancer<\/strong>\n&#8211; Use\/manage <strong>VCNs, subnets, NSGs\/security lists<\/strong>\n&#8211; Read instances and private IPs (if needed for backend discovery)<\/p>\n\n\n\n<p>OCI IAM policy syntax and exact resource-type names can vary by service family. Use the official IAM policy reference and Network Load Balancer documentation to confirm the correct policy statements for your environment:\n&#8211; https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm\n&#8211; https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/NetworkLoadBalancer\/home.htm<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Network Load Balancer is generally a <strong>paid service<\/strong> (usage-based). Oracle Cloud Free Tier\/Always Free eligibility varies by resource type and region\u2014<strong>verify in official docs and pricing<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Tools (recommended)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Oracle Cloud Console (web UI)<\/li>\n<li>OCI CLI (optional but useful): https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/API\/SDKDocs\/cliinstall.htm<\/li>\n<li>SSH client to connect to compute instances<\/li>\n<li>Optional: Terraform OCI provider for IaC: https:\/\/registry.terraform.io\/providers\/oracle\/oci\/latest\/docs<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Network Load Balancer is not necessarily available in all regions or may have region-specific constraints. <strong>Verify region availability<\/strong> in the official documentation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<p>Plan for limits such as:\n&#8211; Maximum number of load balancers per compartment\n&#8211; Maximum listeners\/backend sets\/backends\n&#8211; Bandwidth\/throughput shaping constraints (service-defined)<\/p>\n\n\n\n<p>Check current limits here:\n&#8211; https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/General\/Concepts\/servicelimits.htm<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services<\/h3>\n\n\n\n<p>For the hands-on lab you will need:\n&#8211; VCN with at least:\n  &#8211; One <strong>public subnet<\/strong> (for a public NLB)\n  &#8211; One <strong>private subnet<\/strong> (for backend instances)\n&#8211; Two compute instances (VMs) in the private subnet (or public if you simplify, though private is recommended)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<p>Oracle Cloud Network Load Balancer pricing is <strong>usage-based<\/strong>. Exact prices vary by region and can change, so do not rely on static numbers in a tutorial.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (typical model)<\/h3>\n\n\n\n<p>From Oracle Cloud pricing patterns for networking services, Network Load Balancer costs commonly depend on some combination of:\n&#8211; <strong>Load balancer hours<\/strong> (how long the NLB exists\/provisions)\n&#8211; <strong>Bandwidth\/throughput capacity<\/strong> or <strong>data processed<\/strong> (GB in\/out through the NLB)\n&#8211; Possibly <strong>additional features<\/strong> (if applicable in your region)<\/p>\n\n\n\n<p>For authoritative pricing, use:\n&#8211; Official Oracle Cloud price list (Networking section): https:\/\/www.oracle.com\/cloud\/price-list\/\n&#8211; OCI cost estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html\n&#8211; Network Load Balancer documentation: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/NetworkLoadBalancer\/home.htm<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Free tier<\/h3>\n\n\n\n<p>Oracle Cloud Free Tier includes some Always Free resources, but <strong>load balancer free usage is not guaranteed<\/strong> and varies by service and region. <strong>Verify<\/strong> current Free Tier coverage:\n&#8211; https:\/\/www.oracle.com\/cloud\/free\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Main cost drivers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Number of NLBs<\/strong> and how long they run (dev\/test environments often forget to delete them).<\/li>\n<li><strong>Traffic volume<\/strong> (GB processed) in production.<\/li>\n<li><strong>Cross-zone\/region\/hybrid network patterns<\/strong> (if traffic traverses gateways or DRG, additional networking charges may apply).<\/li>\n<li><strong>Backend compute<\/strong> costs (VMs\/bare metal), which usually exceed LB cost for heavy workloads.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden or indirect costs to watch<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Data egress to the internet<\/strong>: Public internet egress is commonly billed separately.<\/li>\n<li><strong>Inter-region traffic<\/strong>: If you front multi-region architectures, inter-region data transfer can become a major cost.<\/li>\n<li><strong>Logging\/monitoring ingestion<\/strong>: If you enable VCN flow logs or other logs at high volume, Logging ingestion\/storage can add costs.<\/li>\n<li><strong>NAT Gateway \/ Bastion<\/strong>: If used for patching or admin access, they may have their own costs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost optimization tips<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>private NLBs<\/strong> for internal traffic when possible (can reduce exposure and may reduce egress-related costs depending on architecture).<\/li>\n<li>Right-size environments:<\/li>\n<li>For dev\/test, keep NLB lifetime short and automate cleanup.<\/li>\n<li>Prefer <strong>regional subnets<\/strong> and keep traffic inside the region\/VCN when possible.<\/li>\n<li>Set <strong>Monitoring alarms<\/strong> on unusual traffic spikes and on \u201cresource exists\u201d checks (tag-based governance helps).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (no fabricated numbers)<\/h3>\n\n\n\n<p>A low-cost lab environment typically includes:\n&#8211; 1 Network Load Balancer running for a few hours\n&#8211; 2 small compute instances\n&#8211; Minimal traffic (curl tests)<\/p>\n\n\n\n<p>To estimate:\n1. In the cost estimator, add <strong>Network Load Balancer<\/strong> for your region and specify the smallest practical usage duration.\n2. Add <strong>Compute<\/strong> for the instances and any boot volume\/storage.\n3. Add any <strong>internet egress<\/strong> if you expect significant external traffic.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>In production, estimate and track:\n&#8211; Expected sustained throughput and peak traffic windows\n&#8211; Number of environments (prod, staging, DR)\n&#8211; Multi-region strategy (active-active doubles LB footprint)\n&#8211; Logging and monitoring ingestion volume\n&#8211; Egress patterns (internet vs private circuits)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab deploys a <strong>public Network Load Balancer<\/strong> that distributes <strong>TCP\/80<\/strong> traffic to two private backend VMs running NGINX. You\u2019ll verify traffic distribution and backend health, then clean up.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Create an Oracle Cloud <strong>Network Load Balancer<\/strong> with:\n&#8211; One <strong>TCP listener<\/strong> on port 80\n&#8211; One backend set with <strong>two backend servers<\/strong>\n&#8211; Health checks so only healthy backends receive traffic\n&#8211; A public endpoint for testing with <code>curl<\/code><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Create networking (VCN + subnets + NSGs\/security rules).\n2. Launch two backend compute instances and install NGINX.\n3. Create a Network Load Balancer, listener, backend set, and backends.\n4. Validate load balancing behavior.\n5. Troubleshoot common issues.\n6. Clean up all resources to stop billing.<\/p>\n\n\n\n<blockquote>\n<p>Cost note: This lab may incur charges for the load balancer, compute, and data transfer. Use a short duration and delete resources afterward.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Create a compartment and choose a region<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the Oracle Cloud Console, confirm the <strong>region<\/strong> you will use.<\/li>\n<li>Create or select a <strong>compartment<\/strong> for the lab (recommended).<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You have a dedicated compartment and region selected for all lab resources.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create a VCN with public and private subnets<\/h3>\n\n\n\n<p>You can use the VCN wizard or create manually. The key is to have:\n&#8211; A <strong>public subnet<\/strong> for the public NLB\n&#8211; A <strong>private subnet<\/strong> for backend instances<\/p>\n\n\n\n<p><strong>Console path:<\/strong> Networking \u2192 Virtual Cloud Networks \u2192 Create VCN<\/p>\n\n\n\n<p>Recommended (example) CIDRs:\n&#8211; VCN: <code>10.0.0.0\/16<\/code>\n&#8211; Public subnet: <code>10.0.0.0\/24<\/code>\n&#8211; Private subnet: <code>10.0.1.0\/24<\/code><\/p>\n\n\n\n<p>Ensure:\n&#8211; Public subnet has a route to an <strong>Internet Gateway<\/strong>\n&#8211; Private subnet has no direct route to the Internet Gateway (optional NAT gateway if you need outbound patching)<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> VCN created with one public subnet and one private subnet.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Create Network Security Groups (recommended)<\/h3>\n\n\n\n<p>Use NSGs for clearer, least-privilege rules.<\/p>\n\n\n\n<p>Create two NSGs:\n1. <code>nlb-public-nsg<\/code> (attached to the NLB, if supported by the NLB configuration in your region)\n2. <code>app-backend-nsg<\/code> (attached to backend VMs)<\/p>\n\n\n\n<p><strong>Rules to add:<\/strong><\/p>\n\n\n\n<p><strong>A) NLB ingress rule<\/strong> (allow clients to reach the NLB)\n&#8211; Ingress to <code>nlb-public-nsg<\/code>:\n  &#8211; Source: <code>0.0.0.0\/0<\/code>\n  &#8211; Protocol: TCP\n  &#8211; Destination port: 80<\/p>\n\n\n\n<p><strong>B) Backend ingress rule<\/strong> (allow NLB to reach backends on 80)\n&#8211; Ingress to <code>app-backend-nsg<\/code>:\n  &#8211; Source: the <strong>public subnet CIDR<\/strong> (example <code>10.0.0.0\/24<\/code>) or the NLB subnet CIDR\n  &#8211; Protocol: TCP\n  &#8211; Destination port: 80<\/p>\n\n\n\n<blockquote>\n<p>If NSG attachment to NLB is not available in your region\/tenant, apply equivalent rules using <strong>security lists<\/strong> on the subnets. Always follow current OCI documentation for the NLB networking model.<\/p>\n<\/blockquote>\n\n\n\n<p><strong>Expected outcome:<\/strong> Security rules exist for inbound TCP\/80 to the NLB and from the NLB subnet to backend servers.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Launch two backend compute instances in the private subnet<\/h3>\n\n\n\n<p>Launch two VMs (Oracle Linux is a common choice).<\/p>\n\n\n\n<p><strong>Console path:<\/strong> Compute \u2192 Instances \u2192 Create instance<\/p>\n\n\n\n<p>For each instance:\n&#8211; Subnet: <strong>Private subnet<\/strong>\n&#8211; Assign public IP: <strong>No<\/strong> (keep private)\n&#8211; NSG: attach <code>app-backend-nsg<\/code>\n&#8211; Add an SSH key you control<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Install NGINX and set unique index pages<\/h4>\n\n\n\n<p>Connect through a bastion, private access method, or temporarily assign a public IP for lab purposes (least secure). A safer approach is OCI Bastion:\n&#8211; https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Bastion\/home.htm<\/p>\n\n\n\n<p>Once connected via SSH, run:<\/p>\n\n\n\n<pre><code class=\"language-bash\">sudo dnf -y install nginx\nsudo systemctl enable --now nginx\n\necho \"Hello from $(hostname) - $(hostname -I)\" | sudo tee \/usr\/share\/nginx\/html\/index.html\nsudo firewall-cmd --permanent --add-service=http || true\nsudo firewall-cmd --reload || true\n<\/code><\/pre>\n\n\n\n<p>Repeat on both instances.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; Both VMs run NGINX and respond on TCP\/80.\n&#8211; Each serves a slightly different page so you can see load distribution.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Create the Network Load Balancer (public)<\/h3>\n\n\n\n<p><strong>Console path:<\/strong> Networking \u2192 Network Load Balancers \u2192 Create Network Load Balancer<\/p>\n\n\n\n<p>Configure:\n&#8211; Type: <strong>Public<\/strong>\n&#8211; Subnet: <strong>Public subnet<\/strong>\n&#8211; (Optional) NSG: attach <code>nlb-public-nsg<\/code> if the UI supports it for NLB in your region<\/p>\n\n\n\n<p>When the NLB is created, note:\n&#8211; The <strong>public IP address<\/strong> (or public endpoint information)<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> NLB exists with a public endpoint.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Create a backend set and add backends<\/h3>\n\n\n\n<p>In the NLB configuration:\n1. Create a <strong>backend set<\/strong> (name example: <code>web-bes<\/code>)\n2. Add <strong>backends<\/strong> using the private IPs of the two VMs:\n   &#8211; Backend 1: <code>10.0.1.10:80<\/code> (example)\n   &#8211; Backend 2: <code>10.0.1.11:80<\/code> (example)<\/p>\n\n\n\n<p>Configure a <strong>health check<\/strong>:\n&#8211; Use a simple <strong>TCP<\/strong> health check to port 80 (most universally supported for Layer 4).\n&#8211; Interval\/timeout\/retries: use defaults unless you have a reason to tune.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; Backends appear in the backend set.\n&#8211; After a short time, backend health should become <strong>Healthy<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Create a TCP listener on port 80<\/h3>\n\n\n\n<p>Create a listener:\n&#8211; Protocol: <strong>TCP<\/strong>\n&#8211; Port: <strong>80<\/strong>\n&#8211; Default backend set: <code>web-bes<\/code><\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> Listener becomes active; NLB starts accepting connections on port 80.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Validate from your local machine<\/h3>\n\n\n\n<p>From your laptop\/terminal:<\/p>\n\n\n\n<pre><code class=\"language-bash\">NLB_IP=\"&lt;your_nlb_public_ip&gt;\"\ncurl -s \"http:\/\/$NLB_IP\/\"\ncurl -s \"http:\/\/$NLB_IP\/\"\ncurl -s \"http:\/\/$NLB_IP\/\"\n<\/code><\/pre>\n\n\n\n<p>You should see alternating responses such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>Hello from web-1 - 10.0.1.10 ...<\/code><\/li>\n<li><code>Hello from web-2 - 10.0.1.11 ...<\/code><\/li>\n<\/ul>\n\n\n\n<p><strong>Expected outcome:<\/strong> Requests succeed and rotate across both backends over multiple attempts.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Use this checklist:\n&#8211; NLB shows the listener as <strong>Active<\/strong>\n&#8211; Backend set shows <strong>2 healthy backends<\/strong>\n&#8211; <code>curl http:\/\/&lt;NLB_IP&gt;\/<\/code> returns content\n&#8211; If one backend is stopped, traffic still succeeds (after health check detects failure)<\/p>\n\n\n\n<p>To test failover:\n1. Stop NGINX on one backend:\n   <code>bash\n   sudo systemctl stop nginx<\/code>\n2. Wait for the health check interval to mark it unhealthy.\n3. Run <code>curl<\/code> several times again.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> Only the healthy backend responds.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p>Common issues and fixes:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Backends show \u201cUnhealthy\u201d<\/strong>\n   &#8211; Check backend VM is listening on port 80:\n     <code>bash\n     sudo ss -lntp | grep ':80'<\/code>\n   &#8211; Check OS firewall allows TCP\/80 (Oracle Linux firewall-cmd steps above).\n   &#8211; Check <code>app-backend-nsg<\/code> ingress allows TCP\/80 <strong>from the NLB subnet CIDR<\/strong>.\n   &#8211; Verify route tables allow traffic within the VCN (usually automatic for intra-VCN).<\/p>\n<\/li>\n<li>\n<p><strong>NLB public IP doesn\u2019t respond<\/strong>\n   &#8211; Confirm the NLB is in a <strong>public subnet<\/strong> with a route to an Internet Gateway.\n   &#8211; Confirm NLB ingress security rule allows TCP\/80 from <code>0.0.0.0\/0<\/code>.\n   &#8211; Check any local corporate firewall restrictions.<\/p>\n<\/li>\n<li>\n<p><strong>Only one backend ever responds<\/strong>\n   &#8211; Confirm both backends are healthy.\n   &#8211; Ensure both are in the backend set and port is correct.\n   &#8211; Some load distribution behaviors can be connection\/flow-based; try closing connections between tests (curl does this by default) and repeat.<\/p>\n<\/li>\n<li>\n<p><strong>SSH access to private instances<\/strong>\n   &#8211; Use OCI Bastion or a jump host.\n   &#8211; Avoid assigning public IPs to private tier in real deployments.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To stop ongoing charges, delete resources in this order:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Delete the <strong>Network Load Balancer<\/strong> (and any reserved public IPs if separately billed\/managed).<\/li>\n<li>Terminate the two <strong>compute instances<\/strong>.<\/li>\n<li>Delete <strong>NSGs<\/strong> (optional if deleting the VCN).<\/li>\n<li>Delete the <strong>VCN<\/strong> (this will remove subnets, route tables, gateways\u2014confirm dependencies first).<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> All lab resources are removed, and billing stops for those resources.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>Network Load Balancer<\/strong> for TCP\/UDP and <strong>Oracle Cloud Load Balancer<\/strong> when you need HTTP-aware features.<\/li>\n<li>Keep backends in <strong>private subnets<\/strong>; expose only the load balancer.<\/li>\n<li>Distribute backend instances across <strong>fault domains\/availability domains<\/strong> where applicable.<\/li>\n<li>Design for failure:<\/li>\n<li>Health checks should reflect real service readiness<\/li>\n<li>Automate backend replacement (instance pools, autoscaling, or CI-driven rebuild)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use least privilege:<\/li>\n<li>Separate roles for network admins vs app operators.<\/li>\n<li>Use compartments to isolate environments:<\/li>\n<li><code>network-prod<\/code>, <code>app-prod<\/code>, <code>network-nonprod<\/code>, etc.<\/li>\n<li>Require tags (if your governance model supports tag defaults and tag enforcement).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Delete unused load balancers in dev\/test.<\/li>\n<li>Monitor traffic volume and egress patterns; optimize data flows (keep traffic within region\/VCN when possible).<\/li>\n<li>Use alarms to detect abnormal traffic spikes early.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prefer L4 load balancing for simple TCP\/UDP services where you don\u2019t need proxy behavior.<\/li>\n<li>Ensure backend instances have sufficient NIC throughput and OS tuning for expected concurrency.<\/li>\n<li>Validate health check intervals:<\/li>\n<li>Too frequent can add noise\/overhead<\/li>\n<li>Too slow delays failover<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use at least <strong>two backends<\/strong> for HA.<\/li>\n<li>Keep immutable infrastructure patterns (replace instances rather than patching in place, where feasible).<\/li>\n<li>Consider multi-region DR if the service is business critical (front with DNS failover \/ traffic management).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create dashboards and alarms:<\/li>\n<li>Healthy backends count<\/li>\n<li>Connection\/throughput anomalies<\/li>\n<li>Use change control for NLB listener\/backend changes.<\/li>\n<li>Record configuration in IaC (Terraform) to prevent drift.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Naming convention example:<\/li>\n<li><code>nlb-&lt;env&gt;-&lt;app&gt;-&lt;region&gt;-public<\/code><\/li>\n<li><code>bes-&lt;env&gt;-&lt;app&gt;-tcp80<\/code><\/li>\n<li>Tags:<\/li>\n<li><code>CostCenter<\/code>, <code>Owner<\/code>, <code>Environment<\/code>, <code>DataClassification<\/code><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI IAM controls who can:<\/li>\n<li>Create\/delete NLBs<\/li>\n<li>Modify listeners\/backend sets\/backends<\/li>\n<li>Attach NLBs to subnets\/NSGs<\/li>\n<li>Scope access by <strong>compartment<\/strong> and use separate compartments for prod vs non-prod.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Network Load Balancer is Layer 4; encryption strategy depends on your design:<\/li>\n<li>If your protocol is TLS, terminate TLS at the backend (TLS passthrough) or use a Layer 7\/termination-capable service when required.<\/li>\n<li>For any TLS termination features on NLB (if available in your region), <strong>verify in official docs<\/strong> and manage certificates properly.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Public NLB:<\/li>\n<li>Restrict inbound ports to the minimum required (e.g., TCP\/443 only).<\/li>\n<li>Consider IP allowlists where possible.<\/li>\n<li>Private NLB:<\/li>\n<li>Limit who can reach it via NSGs and routing (DRG route tables, security rules).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Avoid embedding secrets in instance user-data or images.<\/li>\n<li>Use <strong>OCI Vault<\/strong> for secrets\/keys where appropriate:<\/li>\n<li>https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/KeyManagement\/home.htm<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>OCI Audit<\/strong> to track configuration changes to the NLB and networking resources.<\/li>\n<li>For traffic troubleshooting, use <strong>VCN Flow Logs<\/strong> where appropriate; verify if NLB provides native traffic logs in your region.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ensure network segmentation meets compliance (PCI, HIPAA, SOC2) requirements:<\/li>\n<li>Backends in private subnet<\/li>\n<li>Strict ingress rules<\/li>\n<li>Controlled admin access (Bastion)<\/li>\n<li>Use tagging and compartments to support auditability and cost allocation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Leaving NLB listener open to <code>0.0.0.0\/0<\/code> on admin\/debug ports.<\/li>\n<li>Allowing backend instances to have public IPs \u201ctemporarily\u201d and forgetting to remove them.<\/li>\n<li>Overly broad NSG rules (e.g., allowing all VCN traffic to backend ports).<\/li>\n<li>No monitoring\/alarms on backend health, leading to silent partial outages.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Default to <strong>private subnets<\/strong> for backends.<\/li>\n<li>Use <strong>Bastion<\/strong> or private connectivity for administration.<\/li>\n<li>Enforce least-privilege NSG rules:<\/li>\n<li>NLB subnet \u2192 backend ports only<\/li>\n<li>Client sources \u2192 NLB listener ports only<\/li>\n<li>Use IaC with code review for NLB and security changes.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>Always confirm current limitations in official docs (service capabilities evolve). Common limitations\/gotchas for Layer 4 load balancers include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Not Layer 7:<\/strong> no HTTP path routing, header-based routing, cookie persistence, or rewrites.<\/li>\n<li><strong>Observability gaps vs L7:<\/strong> detailed HTTP access logs and request-level tracing may not exist (or may differ). Use app-level logs and VCN flow logs as needed.<\/li>\n<li><strong>Health check nuance:<\/strong> TCP health checks confirm port reachability, not full application correctness.<\/li>\n<li><strong>Security rule complexity:<\/strong> NLB + private subnets commonly fail due to missing NSG rules or wrong CIDR sources.<\/li>\n<li><strong>Subnet placement constraints:<\/strong> NLB is attached to specific subnet(s); multi-subnet designs differ from L7 load balancers. <strong>Verify<\/strong> current NLB subnet requirements.<\/li>\n<li><strong>Quotas:<\/strong> listener limits, backend limits, and NLB count per compartment can block deployments.<\/li>\n<li><strong>Traffic distribution behavior:<\/strong> some L4 load balancers distribute by connection\/flow; repeated requests from one client may look \u201csticky\u201d depending on client behavior.<\/li>\n<li><strong>Hybrid routing:<\/strong> when clients come from on-prem, ensure DRG route tables and security rules permit traffic to the NLB and backends.<\/li>\n<li><strong>Data transfer billing surprises:<\/strong> internet egress and inter-region transfer can dominate costs at scale.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Alternatives inside Oracle Cloud<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Oracle Cloud Load Balancer<\/strong> (the broader load balancer service): better for HTTP\/HTTPS and advanced features.<\/li>\n<li><strong>DNS-based distribution \/ Traffic Management<\/strong> (where applicable): good for global routing and failover, not a replacement for L4\/L7 balancing.<\/li>\n<li><strong>Self-managed HAProxy\/Nginx\/Envoy on Compute:<\/strong> maximum flexibility at the cost of operations burden.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Alternatives in other clouds<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS Network Load Balancer<\/strong> (L4)<\/li>\n<li><strong>Azure Load Balancer<\/strong> (L4)<\/li>\n<li><strong>Google Cloud TCP\/UDP Load Balancing<\/strong> (regional\/global variants)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison table<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Oracle Cloud Network Load Balancer<\/strong><\/td>\n<td>TCP\/UDP services needing low latency<\/td>\n<td>Managed HA, L4 performance, VCN-native<\/td>\n<td>Not L7; fewer HTTP features<\/td>\n<td>Non-HTTP or simple TCP\/UDP entry points; private\/internal endpoints<\/td>\n<\/tr>\n<tr>\n<td><strong>Oracle Cloud Load Balancer<\/strong><\/td>\n<td>HTTP\/HTTPS and application delivery<\/td>\n<td>More app-aware capabilities (routing, TLS termination features depending on config)<\/td>\n<td>More overhead; not ideal for raw UDP workloads<\/td>\n<td>Web apps, HTTP APIs, need L7 controls<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI DNS \/ Traffic Management (where applicable)<\/strong><\/td>\n<td>Global routing\/failover<\/td>\n<td>Great for multi-region steering<\/td>\n<td>Not a per-connection load balancer<\/td>\n<td>Multi-region active\/active steering combined with regional LBs<\/td>\n<\/tr>\n<tr>\n<td><strong>Self-managed HAProxy\/Nginx on Compute<\/strong><\/td>\n<td>Custom features or edge cases<\/td>\n<td>Full control, custom modules<\/td>\n<td>Operational burden, patching, HA design<\/td>\n<td>When managed services don\u2019t meet requirements or for specialized protocols<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS NLB \/ Azure Load Balancer \/ GCP TCP\/UDP LB<\/strong><\/td>\n<td>Cross-cloud parity<\/td>\n<td>Mature ecosystems, familiar patterns<\/td>\n<td>Different IAM\/networking models<\/td>\n<td>If you\u2019re implementing the same architecture across multiple clouds<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: Hybrid financial services risk engine<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> An on-prem risk engine must call OCI-hosted pricing services over TCP with strict uptime and private connectivity.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>On-prem \u2192 FastConnect \u2192 DRG \u2192 VCN<\/li>\n<li><strong>Private Network Load Balancer<\/strong> fronting multiple pricing service instances in private subnets<\/li>\n<li>Backends spread across fault domains\/availability domains (where available)<\/li>\n<li>Monitoring alarms on backend health and latency indicators<\/li>\n<li><strong>Why Network Load Balancer was chosen:<\/strong><\/li>\n<li>L4 TCP service, no need for HTTP routing<\/li>\n<li>Private endpoint aligns with compliance and segmentation<\/li>\n<li>Managed HA reduces operations risk<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Stable endpoint for on-prem clients<\/li>\n<li>Automated failover from unhealthy instances<\/li>\n<li>Reduced change windows (backend rotation without client-side changes)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: IoT telemetry ingestion<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A small team ingests telemetry from devices over a custom TCP protocol and needs to scale quickly.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Public <strong>Network Load Balancer<\/strong> on TCP\/9000<\/li>\n<li>Backends are autoscaled compute instances running ingestion service<\/li>\n<li>Data stored in managed database\/streaming service (depending on design)<\/li>\n<li>Alerts when backend health drops below threshold<\/li>\n<li><strong>Why Network Load Balancer was chosen:<\/strong><\/li>\n<li>Supports generic TCP without forcing HTTP<\/li>\n<li>Simple operational model<\/li>\n<li>Allows the team to keep backends private and replace them frequently<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Smooth scaling during device onboarding waves<\/li>\n<li>Fewer outages due to single instance failures<\/li>\n<li>Simpler deployments with immutable backend replacement<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Is Oracle Cloud Network Load Balancer Layer 4 or Layer 7?<\/strong><br\/>\n   Network Load Balancer is primarily a <strong>Layer 4<\/strong> service for <strong>TCP and UDP<\/strong> traffic. If you need HTTP-aware routing, evaluate Oracle Cloud Load Balancer.<\/p>\n<\/li>\n<li>\n<p><strong>Can I use Network Load Balancer for HTTP\/HTTPS web apps?<\/strong><br\/>\n   You can forward TCP\/80 or TCP\/443, but you won\u2019t get Layer 7 features like path routing. For typical web apps, Oracle Cloud Load Balancer is often a better fit.<\/p>\n<\/li>\n<li>\n<p><strong>Does Network Load Balancer support UDP?<\/strong><br\/>\n   Yes, UDP is a key use case for Network Load Balancer.<\/p>\n<\/li>\n<li>\n<p><strong>Can I create an internal-only load balancer?<\/strong><br\/>\n   Yes. Use a <strong>private<\/strong> Network Load Balancer in a private subnet and ensure clients have private network reachability.<\/p>\n<\/li>\n<li>\n<p><strong>Do my backend servers need public IP addresses?<\/strong><br\/>\n   No. A common best practice is to keep backends on <strong>private IPs<\/strong> in private subnets.<\/p>\n<\/li>\n<li>\n<p><strong>How does health checking work?<\/strong><br\/>\n   The NLB performs health checks (often TCP-based) to decide whether a backend should receive traffic. Configure intervals and thresholds appropriate to your application\u2019s recovery time.<\/p>\n<\/li>\n<li>\n<p><strong>What is the most common reason for unhealthy backends?<\/strong><br\/>\n   Security rules: missing NSG\/security list ingress allowing the NLB subnet to reach backend ports, or OS firewall blocking the port.<\/p>\n<\/li>\n<li>\n<p><strong>Can I attach Network Load Balancer to multiple subnets?<\/strong><br\/>\n   Subnet attachment models vary by load balancer type and OCI implementation. <strong>Verify in official docs<\/strong> for current NLB subnet requirements in your region.<\/p>\n<\/li>\n<li>\n<p><strong>How do I do TLS termination?<\/strong><br\/>\n   If you need TLS termination at the load balancer, evaluate Oracle Cloud Load Balancer or confirm whether your NLB configuration supports it (<strong>verify in official docs<\/strong>). Many L4 designs do TLS passthrough and terminate on the backend.<\/p>\n<\/li>\n<li>\n<p><strong>Does Network Load Balancer preserve the client source IP?<\/strong><br\/>\n   Source IP preservation behavior can depend on the service and configuration. <strong>Verify in official docs<\/strong> and validate with packet captures or application logs.<\/p>\n<\/li>\n<li>\n<p><strong>Can I use Network Load Balancer with Kubernetes (OKE)?<\/strong><br\/>\n   OKE commonly provisions Oracle Cloud Load Balancer for <code>Service type=LoadBalancer<\/code>. NLB integration may be possible depending on OCI\/OKE features and annotations\u2014<strong>verify in official OKE docs<\/strong>.<\/p>\n<\/li>\n<li>\n<p><strong>How do I monitor Network Load Balancer health?<\/strong><br\/>\n   Use OCI <strong>Monitoring<\/strong> metrics and create alarms on healthy backend count and traffic anomalies. Use OCI <strong>Audit<\/strong> for configuration changes.<\/p>\n<\/li>\n<li>\n<p><strong>How do I restrict who can change the load balancer?<\/strong><br\/>\n   Use compartment-scoped <strong>IAM policies<\/strong> and separate admin roles. Limit \u201cmanage\u201d permissions to a small group.<\/p>\n<\/li>\n<li>\n<p><strong>What happens during backend maintenance?<\/strong><br\/>\n   Put backend into maintenance by stopping the service or removing it from the backend set; health checks should mark it unhealthy and drain traffic (depending on behavior). Plan maintenance windows and validate.<\/p>\n<\/li>\n<li>\n<p><strong>Is Network Load Balancer global?<\/strong><br\/>\n   It is generally <strong>regional<\/strong> in scope and attached to regional networking constructs. Use DNS\/traffic steering for multi-region architectures.<\/p>\n<\/li>\n<li>\n<p><strong>What is the difference between NLB and a reverse proxy?<\/strong><br\/>\n   NLB is a managed L4 traffic distributor; a reverse proxy is typically L7 and can modify HTTP traffic. Choose based on protocol needs and operational preference.<\/p>\n<\/li>\n<li>\n<p><strong>How do I estimate cost accurately?<\/strong><br\/>\n   Use the official OCI <strong>price list<\/strong> and <strong>cost estimator<\/strong> for your region and expected traffic profile. Costs are sensitive to runtime duration and data processed.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Network Load Balancer<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>Network Load Balancer docs: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/NetworkLoadBalancer\/home.htm<\/td>\n<td>Primary reference for capabilities, limits, and configuration steps<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Networking overview: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Network\/home.htm<\/td>\n<td>Helps you understand VCNs, subnets, routing, gateways, and security<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI IAM overview: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm<\/td>\n<td>Required to secure who can manage NLB resources<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>Oracle Cloud Price List: https:\/\/www.oracle.com\/cloud\/price-list\/<\/td>\n<td>Authoritative pricing categories and SKUs (region-dependent)<\/td>\n<\/tr>\n<tr>\n<td>Official calculator<\/td>\n<td>OCI Cost Estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html<\/td>\n<td>Build realistic estimates for lab and production<\/td>\n<\/tr>\n<tr>\n<td>Official limits<\/td>\n<td>Service Limits: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/General\/Concepts\/servicelimits.htm<\/td>\n<td>Understand quotas and request limit increases<\/td>\n<\/tr>\n<tr>\n<td>Architecture center<\/td>\n<td>Oracle Architecture Center: https:\/\/docs.oracle.com\/en\/solutions\/<\/td>\n<td>Reference architectures and patterns for production designs<\/td>\n<\/tr>\n<tr>\n<td>Official CLI docs<\/td>\n<td>OCI CLI install\/use: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/API\/SDKDocs\/cliinstall.htm<\/td>\n<td>Automate NLB provisioning and operations<\/td>\n<\/tr>\n<tr>\n<td>Terraform provider docs<\/td>\n<td>OCI Terraform Provider: https:\/\/registry.terraform.io\/providers\/oracle\/oci\/latest\/docs<\/td>\n<td>Infrastructure-as-code patterns for repeatable deployments<\/td>\n<\/tr>\n<tr>\n<td>Official tutorials<\/td>\n<td>Oracle Cloud Tutorials (landing): https:\/\/docs.oracle.com\/en\/learn\/<\/td>\n<td>Hands-on learning paths; search for load balancing and networking labs<\/td>\n<\/tr>\n<tr>\n<td>Official YouTube<\/td>\n<td>Oracle Cloud Infrastructure channel: https:\/\/www.youtube.com\/@OracleCloudInfrastructure<\/td>\n<td>Videos and walkthroughs (search within channel for load balancing)<\/td>\n<\/tr>\n<tr>\n<td>Community (reputable)<\/td>\n<td>OCI GitHub org: https:\/\/github.com\/oracle<\/td>\n<td>Samples and tooling; validate relevance and currency to NLB<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<p>The following training providers may offer Oracle Cloud, networking, and load balancing-oriented learning. Confirm current course catalogs directly on their sites.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Institute<\/th>\n<th>Suitable Audience<\/th>\n<th>Likely Learning Focus<\/th>\n<th>Mode<\/th>\n<th>Website<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>Beginners to working engineers<\/td>\n<td>DevOps, cloud operations, CI\/CD, networking fundamentals<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>ScmGalaxy.com<\/td>\n<td>Students, junior engineers<\/td>\n<td>SCM, DevOps foundations, cloud basics<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.scmgalaxy.com\/<\/td>\n<\/tr>\n<tr>\n<td>CLoudOpsNow.in<\/td>\n<td>Cloud\/ops practitioners<\/td>\n<td>Cloud operations, monitoring, reliability practices<\/td>\n<td>Check website<\/td>\n<td>https:\/\/cloudopsnow.in\/<\/td>\n<\/tr>\n<tr>\n<td>SreSchool.com<\/td>\n<td>SREs, platform teams<\/td>\n<td>SRE principles, observability, reliability engineering<\/td>\n<td>Check website<\/td>\n<td>https:\/\/sreschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>AiOpsSchool.com<\/td>\n<td>Ops + automation teams<\/td>\n<td>AIOps concepts, automation, monitoring analytics<\/td>\n<td>Check website<\/td>\n<td>https:\/\/aiopsschool.com\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<p>These sites may function as trainer profiles, training portals, or platforms. Verify offerings, credentials, and course relevance before purchase.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Platform\/Site<\/th>\n<th>Likely Specialization<\/th>\n<th>Suitable Audience<\/th>\n<th>Website<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>RajeshKumar.xyz<\/td>\n<td>DevOps\/cloud coaching (check specifics)<\/td>\n<td>Beginners to intermediate engineers<\/td>\n<td>https:\/\/rajeshkumar.xyz\/<\/td>\n<\/tr>\n<tr>\n<td>devopstrainer.in<\/td>\n<td>DevOps training and mentoring<\/td>\n<td>DevOps engineers, SREs<\/td>\n<td>https:\/\/www.devopstrainer.in\/<\/td>\n<\/tr>\n<tr>\n<td>devopsfreelancer.com<\/td>\n<td>DevOps consulting\/training marketplace (verify)<\/td>\n<td>Teams seeking short-term help<\/td>\n<td>https:\/\/devopsfreelancer.com\/<\/td>\n<\/tr>\n<tr>\n<td>devopssupport.in<\/td>\n<td>Operational support and training resources (verify)<\/td>\n<td>Ops teams and engineers<\/td>\n<td>https:\/\/www.devopssupport.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<p>These organizations may provide consulting services related to cloud architecture, DevOps, and operations. Validate service scope and references directly with each provider.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Company<\/th>\n<th>Likely Service Area<\/th>\n<th>Where They May Help<\/th>\n<th>Consulting Use Case Examples<\/th>\n<th>Website<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cotocus.com<\/td>\n<td>Cloud\/DevOps services (verify specialization)<\/td>\n<td>Architecture, migrations, operations<\/td>\n<td>Designing VCN + NLB patterns; implementing monitoring\/alarms; IaC rollout<\/td>\n<td>https:\/\/cotocus.com\/<\/td>\n<\/tr>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps and cloud consulting\/training<\/td>\n<td>DevOps transformation, platform engineering<\/td>\n<td>Standardizing NLB + compute deployment patterns; CI\/CD + Terraform enablement<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>DEVOPSCONSULTING.IN<\/td>\n<td>DevOps consulting (verify portfolio)<\/td>\n<td>Automation, reliability, operations<\/td>\n<td>Building production-ready OCI networking landing zone; NLB operational runbooks<\/td>\n<td>https:\/\/devopsconsulting.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before this service<\/h3>\n\n\n\n<p>To use Oracle Cloud Network Load Balancer effectively, learn:\n&#8211; OCI fundamentals: compartments, VCNs, subnets, route tables, gateways\n&#8211; IP networking: CIDR, TCP vs UDP, stateful firewalls, NAT\n&#8211; Security basics: least privilege, NSGs vs security lists\n&#8211; Linux server basics: systemd, firewall, ports, troubleshooting tools (<code>ss<\/code>, <code>tcpdump<\/code>, <code>curl<\/code>)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after this service<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Oracle Cloud Load Balancer (for L7 needs)<\/li>\n<li>OCI DNS and multi-region design (failover and traffic steering)<\/li>\n<li>Observability: Monitoring, Logging, alarms, dashboards, SLOs<\/li>\n<li>IaC: Terraform modules, drift detection, policy-as-code<\/li>\n<li>Advanced networking: DRG, FastConnect, VPN, peering architectures<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Engineer \/ Cloud Network Engineer<\/li>\n<li>Solutions Architect<\/li>\n<li>DevOps Engineer \/ Platform Engineer<\/li>\n<li>Site Reliability Engineer (SRE)<\/li>\n<li>Security Engineer (network segmentation and exposure)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>Oracle offers OCI certifications; availability and names can change. Start by checking Oracle University and OCI certification pages and map your learning plan to:\n&#8211; OCI Foundations\n&#8211; OCI Architect\n&#8211; OCI Networking-focused training (if available)<\/p>\n\n\n\n<p>Verify current certifications here:\n&#8211; https:\/\/education.oracle.com\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a private NLB fronting an internal TCP service reachable via VPN\/DRG.<\/li>\n<li>Deploy blue\/green backends and practice safe cutover using backend membership changes.<\/li>\n<li>Create Terraform modules for NLB + NSGs + backend compute and add CI validation.<\/li>\n<li>Implement alarms on backend health and run a chaos test (stop one backend).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Backend:<\/strong> A target server (usually an IP:port) that receives traffic from the load balancer.<\/li>\n<li><strong>Backend set:<\/strong> A logical group of backends with a shared health check policy.<\/li>\n<li><strong>CIDR:<\/strong> IP address range notation (e.g., <code>10.0.0.0\/16<\/code>).<\/li>\n<li><strong>Compartment:<\/strong> OCI governance boundary used for access control and cost tracking.<\/li>\n<li><strong>DRG (Dynamic Routing Gateway):<\/strong> OCI gateway for hybrid connectivity (VPN\/FastConnect) and advanced routing.<\/li>\n<li><strong>Fault domain:<\/strong> OCI construct for spreading instances across hardware to reduce correlated failures.<\/li>\n<li><strong>Health check:<\/strong> Probe used to decide if a backend should receive traffic.<\/li>\n<li><strong>IAM policy:<\/strong> Authorization rules defining who can manage OCI resources.<\/li>\n<li><strong>Listener:<\/strong> Front-end port\/protocol configuration that accepts client traffic.<\/li>\n<li><strong>NSG (Network Security Group):<\/strong> Virtual firewall applied to VNICs\/resources to control traffic.<\/li>\n<li><strong>Public subnet:<\/strong> Subnet that can host resources reachable from the internet via an Internet Gateway (with proper routing and security).<\/li>\n<li><strong>Private subnet:<\/strong> Subnet without direct internet exposure (no direct route to Internet Gateway).<\/li>\n<li><strong>Layer 4 (L4):<\/strong> Transport layer (TCP\/UDP) load balancing, not application-aware.<\/li>\n<li><strong>VCN (Virtual Cloud Network):<\/strong> OCI virtual network containing subnets, routing, and security controls.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>Oracle Cloud <strong>Network Load Balancer<\/strong> (in <strong>Networking, Edge, and Connectivity<\/strong>) is a managed <strong>Layer 4<\/strong> load balancer for <strong>TCP and UDP<\/strong> services. It matters because it provides a stable endpoint, health-based failover, and managed high availability without the operational burden of running your own load balancer fleet.<\/p>\n\n\n\n<p>It fits best in Oracle Cloud architectures where you need <strong>low-latency transport load balancing<\/strong>, private backend segmentation, and straightforward scaling. Cost is driven by <strong>how long the NLB runs<\/strong> and <strong>how much traffic it processes<\/strong>, plus indirect networking costs (especially internet egress). Security success depends on correct <strong>IAM policies<\/strong>, <strong>subnet routing<\/strong>, and <strong>NSG\/security list rules<\/strong>\u2014most real-world issues come from misconfigured network controls.<\/p>\n\n\n\n<p>Use Network Load Balancer when you need TCP\/UDP distribution and don\u2019t need HTTP-aware routing; choose Oracle Cloud Load Balancer when you need Layer 7 features.<\/p>\n\n\n\n<p><strong>Next learning step:<\/strong> implement the same lab via <strong>Terraform<\/strong> and add <strong>Monitoring alarms<\/strong> for backend health so you can operate Network Load Balancer like production infrastructure.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Networking, Edge, and Connectivity<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[74,62],"tags":[],"class_list":["post-947","post","type-post","status-publish","format-standard","hentry","category-networking-edge-and-connectivity","category-oracle-cloud"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/947","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=947"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/947\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=947"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=947"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=947"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}