Understanding AWS Load Balancer Routing with Cloudflare and Different Clients

When deploying web applications on AWS using multiple Network Load Balancers (NLBs), understanding how traffic is routed across different clients—such as browsers (Chrome, Edge, Firefox, Safari) and mobile apps (React Native-based)—is essential. This article explores how routing works when using Cloudflare DNS with and without the proxy feature enabled.

---

1. Overview of Routing Mechanisms

When a client (browser or app) accesses a domain, the request follows these key steps:

1. DNS Resolution: The client queries a DNS resolver (e.g., Cloudflare, Google DNS 8.8.8.8, or the system resolver) to resolve the domain to an IP address.
2. IP Selection: If multiple A records exist (pointing to different AWS NLBs), the DNS resolver returns all of them, and the client chooses one.
3. Connection Establishment: The client connects to the chosen IP, which could be either:
   • A Cloudflare edge server (if proxy is enabled).
   • A direct AWS NLB IP (if proxy is disabled).
4. Load Balancing: The AWS NLB distributes traffic to its registered backend instances.

---

2. Routing with Cloudflare Proxy Enabled

When Cloudflare’s proxy (orange cloud ☁️ in DNS settings) is enabled:

1. DNS Resolution: Clients receive Cloudflare’s anycast IPs, not the actual AWS NLB IPs.
2. Cloudflare Edge Routing:
   • Requests are routed to the nearest Cloudflare edge server based on latency and location.
   • Cloudflare applies caching, security filtering (WAF, DDoS protection), and optimizations.
3. Forwarding to AWS NLBs: Cloudflare forwards dynamic requests to the backend AWS NLBs based on its internal load-balancing mechanism.

Advantages of Cloudflare Proxy:

✅ Faster performance via Cloudflare’s edge caching

✅ Improved security (hiding backend IPs, DDoS protection, WAF)

✅ Optimized global traffic routing

---

3. Routing with Cloudflare Proxy Disabled

If Cloudflare proxy is not enabled (gray cloud ☁️ in DNS settings):

1. DNS Resolution: Cloudflare’s DNS returns the public IPs of AWS NLBs directly.
2. Client-Side IP Selection:
   • If multiple A records exist, the client picks an IP via round-robin or random selection.
   • Some clients (e.g., Chrome) may prioritize the first IP in the list.
3. Direct Connection to AWS NLB: The client connects directly to the chosen AWS NLB.
4. AWS Load Balancing: The NLB distributes traffic to backend servers.

Key Differences Without Proxy:

❌ No caching or performance optimizations.

❌ AWS NLBs’ public IPs are exposed.

❌ Clients rely on DNS resolvers for load distribution.

---

4. Routing Behavior for Different Clients

Client Type	DNS Handling	Failover Handling	Cloudflare Proxy Support
Web Browsers (Chrome, Edge, Firefox, Safari)	Uses system DNS resolver	Retries another IP if first fails	Fully supported
React Native Apps (Axios, Fetch API)	Uses system DNS (unless custom DNS is implemented)	Requires explicit retry logic	Fully supported
IoT/Custom Clients	May cache DNS for longer durations	Some may not retry on failure	Dependent on implementation

Key Considerations for React Native Apps:

• Implement manual retry logic in case the first connection fails.
• Use Cloudflare proxy to reduce backend load and latency.
• If Cloudflare proxy is disabled, configure short DNS TTLs for quick failover.

---

5. Summary of Best Practices

🔹 Use Cloudflare Proxy for Enhanced Security & Performance: Hide AWS backend IPs, enable caching, and improve traffic routing.

🔹 Ensure AWS Load Balancers Have Health Checks: Prevent routing traffic to unhealthy instances.

🔹 Optimize React Native Apps for Network Failures: Implement connection retries and fallback mechanisms.

🔹 Consider AWS Global Accelerator: For better proximity-based routing when not using Cloudflare.

By implementing these strategies, you can ensure high availability, better security, and improved performance for web and mobile clients accessing your AWS infrastructure.

---

Conclusion

Understanding how Cloudflare DNS interacts with AWS Network Load Balancers across different clients is critical for optimizing application performance and reliability. Whether you enable Cloudflare’s proxy or not, configuring your infrastructure correctly ensures a seamless user experience across web browsers and mobile applications.