How Gateway Load Balancer Actually Inserts Into a Traffic Path

Gateway Load Balancer alone doesn't automatically see any traffic — it requires VPC ingress routing to be explicitly configured, typically by modifying the route table associated with an Internet Gateway or Transit Gateway attachment so that traffic destined for a protected subnet is first routed through a GWLB endpoint before continuing to its actual destination. Once that routing is in place, GWLB forwards the traffic (encapsulated using the GENEVE protocol on port 6081) to a target group of third-party appliance instances, which inspect or transform the traffic and return it, after which GWLB forwards it onward to its original destination — all transparent to both the original client and the destination workload, neither of which needs any awareness that inspection occurred. This is architecturally different from ALB/NLB, which terminate traffic at the load balancer and distribute it directly to application targets; GWLB instead sits as an inline detour in an existing traffic path.