The Alibaba Gateway Load Balancer (GWLB) operates at Layer 3 (the network layer) of the OSI model, acting as a transparent load balancer that distributes traffic to various backend servers. It listens for traffic on all ports of a specified IP address, forwarding it to backend server groups using the Geneve protocol.

Backend servers capable of supporting the Geneve protocol can be grouped logically. Each server group contains one or more backend servers responsible for processing requests routed by the GWLB. A GWLB Endpoint(GWLBe) serves as the consumer-side connection within a Virtual Private Cloud (VPC), allowing VPC traffic to be seamlessly redirected to the GWLB and subsequently to appliances like firewalls.

The image below describes the integration of Alibaba GWLB with VM-Series. You attach a centralized security VPC to your transit gateway. The centralized security VPC includes a GWLB to scale and load-balance traffic across the stack of VM-Series firewalls.

For outbound traffic, the application server subnet's route table directs traffic to the GWLB endpoint. From there, the GWLB endpoint sends the traffic to the GWLB, which then forwards it to the firewalls. The firewalls conduct a security inspection of the traffic and return it to the GWLB. The GWLB then routes the traffic back to the GWLB endpoint via the connection established through the private link service. Traffic is forwarded to the NAT gateway based on the route table for the GWLB endpoint subnet. The gateway performs a Source Network Address Translation (SNAT) and subsequently routes the traffic to the Internet client.

For inbound traffic, the NAT-IPv4 gateway first receives business traffic from the Internet and performs a Destination Network Address Translation (DNAT). It then sends this traffic to the Gateway Load Balancer (GWLB) endpoint, guided by its route table. The GWLB endpoint subsequently forwards the traffic to the GWLB, which then directs it to the Firewalls (FWs). The FWs conduct security checks on the traffic and return it to the GWLB. The GWLB, in turn, forwards the traffic back to the GWLB endpoint via a connection established through the PrivateLink service. Finally, the traffic is sent to the application server, based on the route table configured for the GWLB endpoint subnet.