Cloud Load Balancing — the current type names, which are global, and proxy against passthrough
The load balancer names changed and the old ones are still in everyone's memory. The three families with their current names, which variants are global and which regional, the protocols each handles, and the one distinction that decides a design: a passthrough balancer preserves the source IP by direct server return, a proxy terminates the connection.
markdownreferencev1E2QX-4BPMstage: designtrust: officialfamily: networkingservice: cloud-load-balancinginterface: anycloud load balancingglobal external Application Load Balancerregional externalcross-region internalproxy Network Load Balancerpassthrough Network Load Balancerdirect server returnDSRpremium tierstandard tierSSL offload
Cloud Load Balancing
1. Three families, and the current names
Application Load Balancers — layer 7, HTTP and HTTPS
| Variant | Scope |
|---|---|
| global external | global — "distributes HTTP and HTTPS traffic to backends hosted on a variety of Google Cloud platforms" |
| regional external | one region |
| classic | global in Premium Tier, regional in Standard Tier |
| regional internal | one region, inside the VPC |
| cross-region internal | internal, across multiple regions |
Proxy Network Load Balancers — layer 4, TCP
| Variant | Scope and note |
|---|---|
| global external | multi-region, TCP with optional SSL offload |
| regional external | one region, TCP |
| classic | global in Premium, regional in Standard; TCP with SSL offload |
| regional internal | TCP, no SSL offload |
| cross-region internal | TCP, no SSL offload |
Passthrough Network Load Balancers — layer 4, many protocols
| Variant | Protocols |
|---|---|
| global external (Preview) | TCP, UDP, ESP, GRE, ICMP, ICMPv6 |
| regional external | the same range |
| internal | TCP, UDP, ICMP, ICMPv6, SCTP, ESP, AH, GRE |
2. The distinction that decides the design
Passthrough load balancers use "direct server return (DSR)" with the source IP preserved. Proxy variants terminate the connection at the balancer.
Read it as three separate consequences:
- Source IP. If the backend needs the client's real address — for allowlisting, for geo logic, for an
audit trail — a passthrough balancer gives it natively. Behind a proxy you are reading a forwarded header, which is a different trust problem.
- Protocols. Only passthrough carries UDP, ESP, AH, GRE, SCTP and ICMP. A workload that is not
TCP-or-HTTP has exactly one family available.
- Features. TLS termination, header manipulation, Cloud CDN and Cloud Armor's richer policies live on the
proxy side, because they need a terminated connection.
3. The naming, and why it matters to an agent
These are current names. "HTTP(S) Load Balancing", "TCP Proxy", "Network Load Balancing" and
"Internal TCP/UDP Load Balancing" are the previous generation of names and are what a model answers from
memory. Writing IaC or a runbook against an old name produces something that does not match the console, the
API or the gcloud surface.
The pattern of the current names is itself the lookup: scope (global / regional / cross-region) + reach (external / internal) + family (Application / proxy Network / passthrough Network) Load Balancer.
4. Premium and Standard Tier change the answer
The classic Application and proxy Network balancers are global in Premium Tier and regional in Standard Tier. That is the same product being a different shape depending on a network-tier setting, and it is the subtlest trap on this page: a design validated in one tier can be regional in the other.
5. What is not here
No quota, capacity or price values. Backend services, health checks, URL maps, forwarding rules and
certificates are the next layer down and are not in this release —
changelog/2026-10-21-networking-family.md records that.
Next: reference/networking/cloud-armor.md for what attaches to which of these, and
guides/parity/networking.md for the ELB/ALB/NLB and Azure Load Balancer / Application Gateway / Front Door
mapping.