# NetworkLoadBalancerProps

Properties for a network load balancer.

Extends: NetworkLoadBalancerProps
Extends: BaseLoadBalancerProps
Used as props by: NetworkLoadBalancer

- Source: [`aws-elasticloadbalancingv2/lib/nlb/network-load-balancer.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/nlb/network-load-balancer.ts#L43)
- Type last changed: v2.222.0 · 4 Nov 2025

## Example

```ts
declare const vpc: ec2.Vpc;

const lb = new elbv2.NetworkLoadBalancer(this, 'LB', {
  vpc,
  ipAddressType: elbv2.IpAddressType.DUAL_STACK,
  enablePrefixForIpv6SourceNat: true,
});

const listener = lb.addListener('Listener', {
  port: 1229,
  protocol: elbv2.Protocol.UDP,
});
```

## Properties

- `clientRoutingPolicy`: [ClientRoutingPolicy](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.ClientRoutingPolicy.html) — The AZ affinity routing policy.

  **Default:** AZ affinity is disabled.

- `crossZoneEnabled`: boolean — Indicates whether cross-zone load balancing is enabled.

  **Default:** false for Network Load Balancers and true for Application Load Balancers. This can not be `false` for Application Load Balancers.

- `deletionProtection`: boolean = false — Indicates whether deletion protection is enabled.

- `denyAllIgwTraffic`: boolean — Indicates whether the load balancer blocks traffic through the Internet Gateway (IGW).

  **Default:** false for internet-facing load balancers and true for internal load balancers

- `disableSecurityGroups`: boolean = false — Create a Network Load Balancer without security groups.

  When true, creates an NLB that cannot have security groups attached.
  This is useful when you need to create a traditional NLB without security group associations.

  This property only takes effect when the feature flag
  `@aws-cdk/aws-elasticloadbalancingv2:networkLoadBalancerWithSecurityGroupByDefault` is enabled.

- `enablePrefixForIpv6SourceNat`: boolean — Indicates whether to use an IPv6 prefix from each subnet for source NAT.

  **Default:** undefined - NLB default behavior is false

  The IP address type must be IpAddressType.DUALSTACK.

- `enforceSecurityGroupInboundRulesOnPrivateLinkTraffic`: boolean = true — Indicates whether to evaluate inbound security group rules for traffic sent to a Network Load Balancer through AWS PrivateLink.

- `internetFacing`: boolean = false — Whether the load balancer has an internet-routable address.

- `ipAddressType`: [IpAddressType](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.IpAddressType.html) = IpAddressType.IPV4 — The type of IP addresses to use.

  If you want to add a UDP or TCP_UDP listener to the load balancer,
  you must choose IPv4.

- `loadBalancerName`: string — Name of the load balancer.

  **Default:** Automatically generated name.

- `minimumCapacityUnit`: number — The minimum capacity (LCU) for a load balancer.

  **Default:** undefined - ELB default is 0 LCU

- `securityGroups`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html)[] — Security groups to associate with this load balancer.

  **Default:** No security groups associated with the load balancer.

- `subnetMappings`: [SubnetMapping](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.SubnetMapping.html)[] — Subnet information for the load balancer.

  **Default:** undefined - The VPC default strategy for subnets is used

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) (required) — The VPC network to place the load balancer in.

- `vpcSubnets`: [SubnetSelection](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.SubnetSelection.html) — Which subnets place the load balancer in.

  **Default:** the Vpc default strategy.

- `zonalShift`: boolean = false — Indicates whether zonal shift is enabled.