Getting started
Last updated on
This page helps you decide which STACKIT Load Balancing and Content Delivery service fits your workload. It answers two questions that most users face when they start: which load balancer to use, and which web application firewall to protect your traffic with. Once you have decided, follow the linked guides to set up the service.
Prerequisites
Section titled “Prerequisites”- You have a STACKIT customer account: Create a customer account.
- You have a STACKIT user account: Create a user account.
- You have a STACKIT project: Create a project.
Choose a load balancer
Section titled “Choose a load balancer”STACKIT offers two load balancers. They differ mainly in the OSI layer they operate on, which determines how they route traffic. The Network Load Balancer (NLB) works at layer 4 (TCP/UDP) and forwards traffic based on IP and port. The Application Load Balancer (ALB) works at layer 7 (HTTP/HTTPS) and can route based on the content of each request.
Here’s a direct comparison of the two load balancers, so you can see at a glance, which one might be more suitable for your use case:
| Dimension | Network Load Balancer (NLB) | Application Load Balancer (ALB) |
|---|---|---|
| OSI layer | Layer 4 (TCP/UDP) | Layer 7 (HTTP/HTTPS) |
| Routing basis | IP address and port | Host, path, headers, query parameters |
| TLS handling | TLS passthrough | TLS offloading and TLS bridging |
| Session persistence | Source IP | Cookie |
| Firewall option | Not available | ALB WAF (per listener) |
| Typical workloads | Databases, game servers, custom TCP/UDP protocols, high-throughput traffic | Web applications, REST APIs, content-based routing |
Choose the STACKIT Network Load Balancer when:
- Your workload uses a non-HTTP protocol, or raw TCP/UDP (for example databases, message brokers, or game servers).
- You need maximum throughput and the lowest possible latency with minimal processing overhead.
- You want the client’s TLS session to terminate on your backend (TLS passthrough) rather than on the load balancer.
Learn more about NLB features or create an NLB.
Choose the STACKIT Application Load Balancer when:
- You serve HTTP(S) traffic and want to route requests by host, path, header, or query parameter.
- You need layer 7 features such as TLS offloading, cookie-based session persistence, or WebSocket support.
- You want to protect the application with a layer 7 web application firewall (the ALB WAF).
Learn more about ALB features or create an ALB.
Choose a web application firewall
Section titled “Choose a web application firewall”STACKIT offers two web application firewalls. Both inspect HTTP(S) traffic and block common attacks such as SQL injection and cross-site scripting (XSS) using the OWASP Core Rule Set. The key difference is where in the traffic path they run, which in turn depends on which product you are already using.
The CDN WAF runs at the CDN edge. The CDN operates many Points of Presence (PoPs) around the world, each client is routed to the PoP closest to it (by latency and proximity), and the CDN WAF inspects the request there before it flows through the distribution to your origin.
The ALB WAF runs on the application load balancer, which is a single entry point that receives traffic from all clients and inspects layer 7 traffic per listener before distributing it to your target pools.
The diagram below illustrates both cases:
Here’s a direct comparison of the two web application firewalls, so you can see at a glance, which one might be more suitable for your use case:
| Dimension | ALB WAF | CDN WAF |
|---|---|---|
| Where it runs | On the application load balancer, per listener | At the CDN edge, per distribution |
| Prerequisite | A STACKIT Application Load Balancer | A STACKIT CDN distribution |
| Custom rules | Custom rule groups (structured SecLang abstraction) | On the roadmap (Premium tier) |
| Best for | Protecting apps behind the ALB, including non-cached and internal traffic | Protecting cached, globally delivered content at the edge |
ALB WAF
Section titled “ALB WAF”Use the STACKIT Application Load Balancer Web Application Firewall when:
- Your traffic is fronted by an application load balancer and you want layer 7 protection directly at the load balancer.
- You need application-specific detection logic through custom rule groups, in addition to the managed OWASP rules.
- You want to protect traffic that does not flow through a CDN, such as internal or non-cacheable requests.
Learn more about ALB WAF features.
CDN WAF
Section titled “CDN WAF”Use the STACKIT Content Delivery Network Web Application Firewall when:
- Your content is already delivered through a STACKIT CDN distribution and you want to block malicious requests at the edge.
- You want to stop attacks before they reach your origin, reducing load on your backend.
- You want edge-level controls such as paranoia levels and request allow-listing alongside caching.
Learn more about CDN WAF features or how to manage your CDN WAF.