What Is the Opposite of a Pass-Through Load Balancer?

The closest architectural opposite of a pass-through load balancer is a proxy-based load balancer, also known as a full-proxy load balancer.

Both distribute traffic among backend servers, but they handle network connections very differently.

How a Pass-Through Load Balancer Works

A pass-through load balancer forwards traffic to a selected backend without acting as the endpoint for the client’s connection.

The basic traffic flow is:

Client → Pass-Through Load Balancer → Backend Server

The backend server typically sees the original client’s source IP address and directly processes the connection. Depending on the platform and configuration, return traffic may pass through the load balancer or travel directly from the backend to the client.

Pass-through load balancers are commonly used when:

• Preserving the original client IP is important
• High throughput and low latency are priorities
• The backend must terminate the TCP or TLS connection
• The load balancer does not need to inspect application-layer content
• The application uses protocols other than HTTP or HTTPS

Because it performs limited connection processing, a pass-through load balancer can efficiently handle large volumes of network traffic.

How a Proxy-Based Load Balancer Works

A proxy-based load balancer sits between the client and the backend application. It terminates the client connection and then creates a separate connection to the selected backend server.

The traffic flow becomes:

Client → Proxy Load Balancer → Backend Server

Although this appears to be one continuous interaction from the user’s perspective, it consists of two separate connections:

1. A connection between the client and the load balancer
2. A connection between the load balancer and the backend server

This gives the load balancer greater control over the traffic.

A proxy-based load balancer can:

• Terminate TLS connections
• Inspect HTTP requests
• Route traffic according to hostnames, paths, headers, or cookies
• Apply web application firewall policies
• Perform authentication and authorization
• Add, remove, or modify HTTP headers
• Provide session persistence
• Retry failed backend requests
• Hide backend servers from direct client access

Layer 4 and Layer 7 Proxies

Not every proxy-based load balancer operates in the same way.

Layer 4 Proxy Load Balancer

A Layer 4 proxy works primarily with TCP or UDP traffic. It makes forwarding decisions using information such as:

• Source and destination IP addresses
• Source and destination ports
• Network protocol
• Connection health

It terminates the network connection but generally does not make routing decisions based on HTTP content.

Layer 7 Proxy Load Balancer

A Layer 7 load balancer understands application protocols such as HTTP and HTTPS. It can inspect a request and route it according to its content.

For example:

• /api can be sent to API servers
• /images can be sent to an image service
• shop.example.com can be routed to an e-commerce application
• Requests with a specific header can be sent to a new application version

Layer 7 proxy load balancers are often called application load balancers, HTTP load balancers, or reverse proxies.

Pass-Through vs. Proxy-Based Load Balancing

Capability	Pass-Through Load Balancer	Proxy-Based Load Balancer
Terminates the client connection	No	Yes
Creates a new backend connection	Generally no	Yes
Preserves the original client IP	Typically yes	Usually passed through a header or proxy protocol
Inspects HTTP content	No	Yes, with a Layer 7 proxy
Supports URL-based routing	No	Yes
Can terminate TLS	Usually handled by the backend	Yes
Adds network processing overhead	Lower	Higher
Provides advanced traffic control	Limited	Extensive
Hides backend infrastructure	Partially	More completely

What Happens to the Client IP?

With pass-through load balancing, the backend can usually see the client’s original IP address directly at the network layer.

With proxy-based load balancing, the backend sees the load balancer as the source of the new connection. The original client IP may instead be communicated through:

• The X-Forwarded-For HTTP header
• The standardized Forwarded header
• The PROXY protocol
• Platform-specific headers

Applications and security logs must be configured correctly to capture and trust this information. Otherwise, every request may appear to originate from the load balancer.

Which Architecture Should You Choose?

Choose a pass-through load balancer when you need:

• Very high network throughput
• Minimal processing overhead
• Native preservation of client IP addresses
• Backend-controlled TLS termination
• Support for non-HTTP protocols
• Limited application-aware routing

Choose a proxy-based load balancer when you need:

• Centralized TLS termination
• Host- or path-based routing
• Web application firewall integration
• Authentication or policy enforcement
• Header inspection and modification
• Better isolation between clients and backend systems
• Detailed application-level observability

Is “Proxy-Based” Always the Exact Opposite?

Not in every product’s terminology. Cloud providers and networking vendors use terms such as:

• Pass-through load balancer
• Proxy load balancer
• Full-proxy load balancer
• Network load balancer
• Application load balancer
• Reverse proxy
• Direct server return load balancer

These terms are not always interchangeable. A “network load balancer,” for example, may be implemented as either a pass-through system or a Layer 4 proxy, depending on the platform.

The most important architectural question is therefore:

Does the load balancer preserve and forward the original connection, or does it terminate that connection and establish a new one?

If it forwards the original connection, it is operating as a pass-through load balancer. If it terminates the connection and creates another one to the backend, it is operating as a proxy-based load balancer.

Conclusion

The practical opposite of a pass-through load balancer is a proxy-based or full-proxy load balancer.

A pass-through load balancer prioritizes efficient packet forwarding and direct backend connectivity. A proxy-based load balancer provides deeper inspection, centralized security controls, TLS termination, and intelligent application routing.

The right choice depends on whether the architecture values raw network performance and connection transparency—or advanced traffic management and application-level control.