License & Deployment Mix: 18 tools – 9 OSS, 3 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
What Is Load Balancing?
Load balancing is the process of distributing network traffic across multiple servers to ensure no single server bears too much demand. An Application Delivery Controller (ADC) extends this concept with advanced traffic management, SSL offloading, connection pooling, content switching, application acceleration, and web application firewall (WAF) capabilities.
This directory evaluates load balancing and ADC tools – both open-source and commercial solutions. For API gateways (which overlap with L7 load balancers), see API Gateway. For web servers that also serve as reverse proxies, see web-servers/. For Kubernetes ingress and service mesh, see Container Orchestration.
Load Balancing vs Related Technologies
| Concern | Load Balancer | Reverse Proxy | API GW | Svc Mesh |
|---|---|---|---|---|
| Primary | Distribute traffic | Forward requests | API mgmt | Svc-to-svc |
| Layer | L4 and/or L7 | L7 | L7 | L7 |
| Health checks | Core feature | Basic | Basic | Sidecar |
| SSL offload | Core feature | Yes | Yes | mTLS |
| Algorithms | Many (RR, LC, etc.) | Basic | Basic | Basic |
| HA/failover | Core feature | Limited | Limited | Built-in |
| WAF | ADC feature | Plugin | Plugin | No |
| Rate limiting | ADC feature | Limited | Core | Core |
| API auth | Limited | Limited | Core | Core |
Key Concepts
- L4 load balancing – operates at the transport layer (TCP/UDP); routes connections based on IP and port without inspecting application data; fastest and most scalable
- L7 load balancing – operates at the application layer (HTTP/HTTPS, gRPC, etc.); can route based on URL path, headers, cookies, and content; enables content switching and advanced routing
- Health checking – periodic probes (TCP, HTTP, custom) to verify backend servers are responsive; unhealthy backends are automatically removed from the pool
- SSL termination / offloading – the load balancer decrypts TLS traffic and forwards plaintext to backends; reduces CPU load on application servers
- SSL passthrough – the load balancer forwards encrypted traffic directly to backends without decryption; preserves end-to-end encryption
- Session persistence (sticky sessions) – ensures a client’s requests are routed to the same backend server for the duration of a session; implemented via cookies, source IP, or application tokens
- Connection pooling – reuses TCP connections between the load balancer and backends to reduce connection overhead and latency
- Content switching – routing decisions based on request attributes (URL path, Host header, query parameters, HTTP method)
- GSLB (Global Server Load Balancing) – DNS-based traffic distribution across geographically dispersed data centers for disaster recovery and latency optimization
- VRRP (Virtual Router Redundancy Protocol) – protocol that provides automatic failover between load balancer nodes by sharing a virtual IP address
- DSR (Direct Server Return) – optimization where backend servers respond directly to clients, bypassing the load balancer on the return path; reduces LB bandwidth requirements
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
SSO / OIDC (Authentik)
| Tool | Admin OIDC | Admin SAML | Admin LDAP | Mgmt UI |
|---|---|---|---|---|
| HAProxy | No | No | No | Stats page |
| Nginx | No | No | No | No |
| Envoy | No | No | No | No (ext ctrl) |
| Caddy | No | No | No | API only |
| Traefik | No | No | No | Dashboard |
| Keepalived | N/A | N/A | N/A | No UI |
| LVS | N/A | N/A | N/A | No UI |
| Seesaw | N/A | N/A | N/A | CLI only |
| GLB Director | N/A | N/A | N/A | CLI only |
| HAPEE | Yes | No | Yes | Web UI |
| Nginx Plus | No | No | No | Dashboard |
| F5 BIG-IP | Yes | Yes | Yes | TMUI |
| Citrix ADC | Yes | Yes | Yes | NSIP UI |
| Kemp | Yes | No | Yes | Web UI |
| AWS ALB/NLB | Yes | Yes | Yes | Console |
| Azure LB | Yes | Yes | Yes | Portal |
| GCP LB | Yes | Yes | Yes | Console |
| A10 Thunder | No | Yes | Yes | aXAPI UI |
Best Authentik integration: F5 BIG-IP, Citrix ADC, and cloud providers (native OIDC/SAML for management). For OSS tools, management UI SSO is typically handled via reverse-proxy forward-auth (Authentik in front of HAProxy stats, Traefik dashboard, etc.).
Load Balancing Features
| Tool | L4 | L7 | Algorithms | Health Checks |
|---|---|---|---|---|
| HAProxy | Yes | Yes | 10+ | TCP, HTTP, custom |
| Nginx | Yes | Yes | 6+ | TCP, HTTP |
| Envoy | Yes | Yes | 8+ | TCP, HTTP, gRPC |
| Caddy | No | Yes | 5+ | TCP, HTTP |
| Traefik | Yes | Yes | 3 | Docker/K8s |
| Keepalived | LVS | No | LVS algos | TCP, HTTP, custom |
| LVS | Yes | No | 10+ | Via keepalived |
| Seesaw | Yes | No | LVS algos | TCP, HTTP, DNS |
| GLB Director | Yes | No | Maglev | External |
| HAPEE | Yes | Yes | 10+ | TCP, HTTP, custom |
| Nginx Plus | Yes | Yes | 8+ | TCP, HTTP, custom |
| F5 BIG-IP | Yes | Yes | 20+ | All types |
| Citrix ADC | Yes | Yes | 15+ | All types |
| Kemp | Yes | Yes | 8+ | TCP, HTTP, custom |
| AWS ALB/NLB | ALB+NLB | ALB | 2 | TCP, HTTP, gRPC |
| Azure LB | Yes | App GW | 2 | TCP, HTTP |
| GCP LB | Yes | Yes | 3 | TCP, HTTP, gRPC |
| A10 Thunder | Yes | Yes | 12+ | All types |
Best L4 performance: LVS (kernel-level, millions of connections), GLB Director (eBPF/Maglev), HAProxy (user-space, very high throughput)
Best L7 features: HAProxy, Envoy, F5 BIG-IP, Citrix ADC (full content switching, WAF, advanced routing)
SSL/TLS Capabilities
| Tool | Termination | Passthrough | SNI Route | ACME |
|---|---|---|---|---|
| HAProxy | Yes | Yes | Yes | Plugin |
| Nginx | Yes | Yes | Yes | Plugin |
| Envoy | Yes | Yes | Yes | SDS |
| Caddy | Yes | Yes | Yes | Built-in |
| Traefik | Yes | Yes | Yes | Built-in |
| Keepalived | No | N/A | No | No |
| LVS | No | N/A | No | No |
| Seesaw | No | N/A | No | No |
| GLB Director | No | N/A | No | No |
| HAPEE | Yes | Yes | Yes | Yes |
| Nginx Plus | Yes | Yes | Yes | No |
| F5 BIG-IP | Yes | Yes | Yes | Yes |
| Citrix ADC | Yes | Yes | Yes | Yes |
| Kemp | Yes | Yes | Yes | Yes |
| AWS ALB/NLB | ALB | NLB | Yes | ACM |
| Azure LB | App GW | LB | App GW | No |
| GCP LB | Yes | Yes | Yes | Managed |
| A10 Thunder | Yes | Yes | Yes | Yes |
Best automatic HTTPS: Caddy and Traefik (built-in ACME with zero configuration)
High Availability & Clustering
| Tool | Active-Passive | Active-Active | VRRP | Clustering |
|---|---|---|---|---|
| HAProxy | Keepalived | DNS/ECMP | Via KA | Peers |
| Nginx | Keepalived | DNS/ECMP | Via KA | No |
| Envoy | External | xDS | No | Control plane |
| Caddy | External | DNS | No | No |
| Traefik | External | Redis/Consul | No | KV store |
| Keepalived | Yes | Yes | Core | VRRP sync |
| LVS | Via KA | ECMP | Via KA | No |
| Seesaw | Yes | Yes | VRRP | Peer sync |
| GLB Director | No | BGP/ECMP | No | BGP |
| HAPEE | Yes | Yes | Yes | Native |
| Nginx Plus | Yes | Yes | Yes | Zone sync |
| F5 BIG-IP | Yes | Yes | Yes | DSC cluster |
| Citrix ADC | Yes | Yes | Yes | Cluster/GSLB |
| Kemp | Yes | Yes | Yes | GEO/cluster |
| AWS ALB/NLB | N/A (managed) | Built-in | N/A | Multi-AZ |
| Azure LB | N/A (managed) | Built-in | N/A | Zones |
| GCP LB | N/A (managed) | Built-in | N/A | Global |
| A10 Thunder | Yes | Yes | Yes | aVCS cluster |
Best HA for OSS: HAProxy + Keepalived (proven VRRP-based failover, industry standard), Seesaw (built-in VRRP)
Session Persistence
| Tool | Cookie | Source IP | URL Param | Custom |
|---|---|---|---|---|
| HAProxy | Yes | Yes | Yes | Yes |
| Nginx | No* | Yes | No | No |
| Envoy | Yes | Yes | Yes | Header |
| Caddy | Yes | Yes | No | No |
| Traefik | Yes | No | No | No |
| Keepalived | No | Yes | No | No |
| LVS | No | Yes | No | No |
| Seesaw | No | Yes | No | No |
| GLB Director | No | Hash | No | No |
| HAPEE | Yes | Yes | Yes | Yes |
| Nginx Plus | Yes | Yes | Yes | Yes |
| F5 BIG-IP | Yes | Yes | Yes | iRules |
| Citrix ADC | Yes | Yes | Yes | Policy |
| Kemp | Yes | Yes | Yes | Yes |
| AWS ALB/NLB | ALB | NLB | No | No |
| Azure LB | No | Yes | No | No |
| GCP LB | Yes | Yes | No | No |
| A10 Thunder | Yes | Yes | Yes | aFleX |
* = Nginx OSS supports ip_hash but not cookie- based sticky sessions (Nginx Plus adds cookie-based)
Monitoring Integration
| Tool | Prometheus | Stats/Metrics EP | Logs | SNMP |
|---|---|---|---|---|
| HAProxy | Exporter | CSV/Prometheus | Syslog | No |
| Nginx | Exporter | stub_status | Access/err | No |
| Envoy | Native | /stats (Prometheus) | Access | No |
| Caddy | Native | /metrics | Structured | No |
| Traefik | Native | /metrics | Structured | No |
| Keepalived | Exporter | SNMP | Syslog | Yes |
| LVS | Exporter | ipvsadm | Kernel | No |
| Seesaw | No | CLI | Syslog | No |
| GLB Director | No | CLI | Syslog | No |
| HAPEE | Native | Prometheus EP | Syslog | SNMP |
| Nginx Plus | Native | JSON API | Access/err | No |
| F5 BIG-IP | Exporter | iControl REST | Syslog | SNMP |
| Citrix ADC | Exporter | NITRO API | Syslog | SNMP |
| Kemp | No | REST API | Syslog | SNMP |
| AWS ALB/NLB | No | CloudWatch | CloudWatch | No |
| Azure LB | No | Azure Monitor | Diagnostics | No |
| GCP LB | No | Cloud Monitoring | Cloud Logging | No |
| A10 Thunder | Exporter | aXAPI | Syslog | SNMP |
Best monitoring integration: HAProxy (Prometheus endpoint or CSV stats → Telegraf, syslog → Fluent Bit), Envoy (native Prometheus /stats → Telegraf, structured access logs → Fluent Bit), Traefik (native Prometheus /metrics, structured logs)
Deployment & Licensing
| Tool | License | Docker | VM/Bare | Cloud | Min RAM |
|---|---|---|---|---|---|
| HAProxy | GPL-2.0 | Yes | Yes | No | 128 MB |
| Nginx | BSD-2 | Yes | Yes | No | 64 MB |
| Envoy | Apache 2.0 | Yes | Yes | No | 256 MB |
| Caddy | Apache 2.0 | Yes | Yes | No | 64 MB |
| Traefik | MIT | Yes | Yes | No | 128 MB |
| Keepalived | GPL-2.0 | Yes | Yes | No | 16 MB |
| LVS | GPL-2.0 | Host | Yes | No | Kernel |
| Seesaw | Apache 2.0 | No | Yes | No | 128 MB |
| GLB Director | BSD | No | Yes | No | 128 MB |
| HAPEE | Proprietary | Yes | Yes | Cloud | 256 MB |
| Nginx Plus | Proprietary | Yes | Yes | Cloud | 128 MB |
| F5 BIG-IP | Proprietary | No | VE/HW | Cloud | 8 GB |
| Citrix ADC | Proprietary | Yes | VPX/HW | Cloud | 4 GB |
| Kemp | Proprietary | Yes | VM/HW | Cloud | 2 GB |
| AWS ALB/NLB | Proprietary | N/A | N/A | AWS | N/A |
| Azure LB | Proprietary | N/A | N/A | Azure | N/A |
| GCP LB | Proprietary | N/A | N/A | GCP | N/A |
| A10 Thunder | Proprietary | No | VM/HW | Cloud | 4 GB |
Pricing
Open Source
| Tool | License | Pricing |
|---|---|---|
| HAProxy | GPL-2.0 | Free |
| Nginx | BSD-2-Clause | Free |
| Envoy | Apache 2.0 | Free |
| Caddy | Apache 2.0 | Free |
| Traefik | MIT | Free |
| Keepalived | GPL-2.0 | Free |
| LVS | GPL-2.0 | Free (kernel) |
| Seesaw | Apache 2.0 | Free |
| GLB Director | BSD | Free |
Commercial
| Tool | Pricing |
|---|---|
| HAPEE | From ~$3,500/yr per instance |
| Nginx Plus | From ~$2,500/yr per instance |
| F5 BIG-IP | From ~$10,000/yr (VE); HW $30k+ |
| Citrix ADC | From ~$3,000/yr (VPX); HW $15k+ |
| Kemp | From ~$1,500/yr (VM); free tier avail |
| AWS ALB/NLB | Pay-per-use (~$0.02/hr + LCU) |
| Azure LB | Pay-per-use (free basic tier) |
| GCP LB | Pay-per-use (~$0.02/hr + data) |
| A10 Thunder | From ~$5,000/yr (VM); HW $20k+ |
Tools
18 tools.
A10 Thunder ADC
A10 Thunder ADC is an enterprise Application Delivery Controller that provides L4-L7 load balancing, SSL offloading, DDoS protection, WAF, and application acceleration.
License: Proprietary (proprietary) · Kind: web · Deploy: appliance · SSO: none
AWS Elastic Load Balancing (ALB / NLB)
AWS Elastic Load Balancing (ELB) is Amazon’s managed load balancing service, consisting of three product types: Application Load Balancer (ALB) for L7 HTTP/HTTPS traffic, Network Load Balancer (NLB) for L4 TCP/UDP/TLS traffic, and Gateway L…
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native, appliance · SSO: OIDC, SAML
Azure Load Balancer
Azure Load Balancer is Microsoft’s managed L4 load balancing service for distributing TCP and UDP traffic across virtual machines, VM scale sets, and availability sets within Azure.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native, k8s · SSO: none
Caddy
Caddy is a modern web server with automatic HTTPS as its defining feature. It provisions and renews TLS certificates from Let’s Encrypt and ZeroSSL automatically, with zero configuration.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none
Citrix ADC (NetScaler)
Citrix ADC (formerly NetScaler) is a full-featured enterprise Application Delivery Controller providing L4-L7 load balancing, SSL offloading, GSLB, Web Application Firewall (WAF), content switching, and application acceleration.
License: Proprietary (proprietary) · Kind: web · Deploy: appliance · SSO: none
Envoy
Envoy is a modern, high-performance L7 proxy and communication bus designed for large microservices architectures.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
F5 BIG-IP
F5 BIG-IP is the dominant enterprise Application Delivery Controller (ADC), providing comprehensive L4-L7 load balancing, SSL offloading, Web Application Firewall (WAF), Global Server Load Balancing (GSLB), and application acceleration.
License: Proprietary (proprietary) · Kind: web · Deploy: appliance · SSO: none
GLB Director (GitHub)
GLB Director is GitHub’s open-source L4 load balancer, designed for distributing traffic across multiple proxy servers (typically HAProxy instances) in a data center.
License: BSD-3-Clause (OSS) · Kind: web · Deploy: native · SSO: none
Google Cloud Load Balancing
Google Cloud Load Balancing is GCP’s fully managed, software-defined load balancing service built on Google’s global network infrastructure.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native, k8s · SSO: none
HAProxy
HAProxy (High Availability Proxy) is the de facto standard open-source load balancer and reverse proxy. Created by Willy Tarreau in 2000, it is widely deployed by companies including GitHub, Reddit, Stack Overflow, Twitter, and Airbnb.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none
HAProxy Enterprise (HAPEE)
HAProxy Enterprise (HAPEE) is the commercial edition of HAProxy, developed and supported by HAProxy Technologies (now part of F5 Networks following the 2025 acquisition).
License: Proprietary (proprietary) · Kind: web · Deploy: native, docker · SSO: none
Keepalived
Keepalived provides high availability for Linux systems through VRRP (Virtual Router Redundancy Protocol) and health checking for LVS (Linux Virtual Server) load balancing.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none
Kemp LoadMaster
Kemp LoadMaster is a commercial Application Delivery Controller that provides L4/L7 load balancing, SSL offloading, WAF (via add-on), Global Server Load Balancing (GSLB), and content switching.
License: Proprietary (proprietary) · Kind: web · Deploy: appliance · SSO: none
LVS (Linux Virtual Server)
LVS (Linux Virtual Server) is a kernel-level L4 load balancer built into the Linux kernel via the IPVS (IP Virtual Server) module.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: docker, k8s, package · SSO: none
Nginx (OSS)
Nginx is one of the most widely deployed web servers in the world, also functioning as a reverse proxy, load balancer, and HTTP cache.
License: BSD-2-Clause (OSS) · Kind: web · Deploy: native, docker · SSO: none
Nginx Plus
Nginx Plus is the commercial edition of Nginx from F5, adding active health checks, session persistence, dynamic reconfiguration via API, live activity monitoring, and JWT/OIDC authentication.
License: Proprietary (proprietary) · Kind: web · Deploy: native, docker · SSO: none
Seesaw
Seesaw is an open-source load balancer developed by Google and released in 2016. It is built on top of LVS (Linux Virtual Server / IPVS) and provides a management layer with health checking, VRRP-based failover, and a CLI interface.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
Traefik
Traefik is a cloud-native reverse proxy and load balancer designed to integrate seamlessly with container orchestrators and service discovery systems.
License: MIT (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none
