AWS Adds Conditional Routing to Network Load Balancer
AWS added listener rules to Network Load Balancer on July 22, 2026. The feature is available in all AWS commercial Regions and the AWS GovCloud (US) Regions. There is no additional charge. Standard NLB pricing for load balancer hours and LCUs applies.
The change is narrow in scope but consequential in practice. A single dual-stack NLB can now send IPv6 client traffic to IPv6 targets and IPv4 client traffic to IPv4 targets. No protocol translation occurs in either direction. The original client IP address is preserved end to end for both address families.
The Problem This Replaces
Before this release, serving mixed IPv4 and IPv6 clients from one NLB forced a choice between two bad options.
The first option was running two load balancers, one per IP version, with separate DNS records splitting clients by address family. Each NLB carried its own listeners, target groups, health checks, and hourly and LCU charges. Teams operated and paid for two parallel stacks fronting the same application.
The second option was pointing a single dual-stack NLB at one target group and letting the load balancer translate the other family. At the network layer, targets saw the load balancer address instead of the original client. Security groups, network ACLs, and VPC Flow Logs no longer showed the real source.
Recovering the client IP required enabling Proxy Protocol version 2 (PPv2) and updating every target application to parse the PPv2 header, adding operational overhead across the fleet.
Both workarounds imposed real costs: financial, operational, or both.
How Listener Rules Work
Listener rules add conditional routing to an NLB listener at Layer 3. You define rules that match on the source IP address type of the connection and forward matching traffic to a target group of the same type.
A typical dual-stack configuration uses two rules. An IPv4 rule forwards IPv4 source connections to an IPv4 target group. An IPv6 rule forwards IPv6 source connections to an IPv6 target group. Rules evaluate in priority order. Connections that match no rule fall through to the listener's default action.
Rules can be modified, reordered, described, and deleted at any time. Changes take effect immediately.
The feature works alongside existing NLB capabilities: connection draining, target group stickiness, cross-zone load balancing, weighted target groups, and client IP preservation all remain available. Rules are supported on TCP, UDP, TCP_UDP, and TLS listeners.
One tooling note from the AWS blog: the AWS CLI must be version 2.35.24 or newer to use the IpAddressType parameter in rule conditions. Older CLI versions return an error.
What You Can Do Without Recreating Anything
You can add listener rules to existing dual-stack NLBs without recreating them. That means the consolidation path is low-disruption. You add target groups for the address family you were previously translating, create the rules, and remove the second load balancer or the PPv2 configuration.
The AWS documentation lists two prerequisites: a dual-stack NLB with an existing listener, and one or more target groups to route traffic to. If your NLB is already dual-stack, the upgrade is additive.
What Cloud Platform Owners Should Audit Now
Three architecture patterns are now candidates for review.
Split-stack DNS. If you operate an A record pointing at an IPv4 NLB and a AAAA record pointing at a separate IPv6 NLB, that second load balancer is now redundant. Metrotechs analysis: consolidating to one NLB removes a parallel set of hourly charges, health check configurations, and change-management surface. The exact savings depend on your LCU consumption, which the announcement does not quantify.
PPv2 implementations. Any application parsing Proxy Protocol v2 headers to recover client IPs is carrying integration debt that listener rules make unnecessary. Review whether that parsing logic can be retired after consolidation. This is an application-side change; the announcement does not confirm it is automatic.
Security policy and logging dependencies. If your security groups, network ACLs, or SIEM rules rely on seeing original client IPs in VPC Flow Logs, verify those sources continue to receive them after migration. Listener rules restore end-to-end IP preservation by design, but your logging pipeline should be tested explicitly before you retire the old configuration.
GovCloud workloads. The feature is available in AWS GovCloud (US) Regions. Teams running regulated workloads that require client IP visibility for compliance purposes have a supported consolidation path. The announcement does not interpret specific regulatory obligations; confirm applicability with your compliance team.
For teams running both address families today with translation in place, the decision is whether to consolidate now or defer. The feature is generally available, costs nothing extra, and requires no infrastructure replacement. The primary action item is auditing which existing dual-stack NLBs are still using the old patterns and scheduling the rule additions.