[Yandex Cloud documentation](../../index.md) > [Yandex Network Load Balancer](../index.md) > [Step-by-step guides](index.md) > Network load balancers > Creating an internal load balancer

# Create an internal network load balancer

{% note info %}

To create an [internal network load balancer](../concepts/nlb-types.md), you need the `load-balancer.privateAdmin` [role](../security/index.md#load-balancer-private-admin).

You can only set the load balancer type (internal or external) when creating it and cannot change it later.

{% endnote %}

To create an internal network load balancer:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where you want to create a load balancer.
  1. Navigate to **Network Load Balancer**.
  1. Click **Create a network load balancer**.
  1. In the **Name** field, enter a name for the load balancer. The naming requirements are as follows:

      * Length: between 3 and 63 characters.
      * It can only contain lowercase Latin letters, numbers, and hyphens.
      * It must start with a letter and cannot end with a hyphen.

  1. In the **Type** field, select `Internal`. 
  1. Optionally, in the **Advanced** field, enable load balancer protection from deletion.

      {% note warning %}

      This does not apply to its listeners or target groups. 

      {% endnote %}

  1. Under **Listeners**, add a [listener](../concepts/listener.md):
      1. Click **Add listener**.
      1. In the window that opens, specify these listener settings:
          * **Name**.
          * **Subnet** where the load balancer will route traffic.
          * In the **Internal IPv4 address** field, select the method through which the listener will get the IP address the load balancer will receive traffic on:

              * `Auto`: For the listener to automatically get a free IP address from the selected subnet range.
              * `List`: To manually reserve a particular IP address for the listener in the subnet you select.

                  In the **IP-address** field that opens, select a previously reserved IP address or click **Reserve** to reserve a new one. In the window that opens, specify the parameters of the reserved IP address:

                  * **Name**.
                  * **Internal IPv4 address**: Specify a free IP address in the subnet range selected for the listener.
                  * Optionally, in the **Advanced** field, enable deletion protection for the reserved IP address.
                  * Click **Create**.
          * In the **Protocol** field, select `TCP` or `UDP`.

              {% note info %}

              By default, the listener uses TCP. To use UDP, [contact technical support](https://center.yandex.cloud/support).

              {% endnote %}

          * **Port** where the listener will listen for incoming traffic. The possible values range from `1` to `32767`.
          * **Target port** to which the load balancer will redirect traffic. The possible values range from `1` to `32767`.
      1. Click **Add**.
  1. Under **Target groups**, add a [target group](../concepts/target-resources.md):
      1. Click **Add target group**.
      1. Select a target group or [create a new one](target-group-create.md):
          * In the **Target group** field, select ![image](../../_assets/console-icons/plus.svg) **Create target group**.
          * In the window that opens, enter a target group name.
          * Add VMs to the target group.
          * Click **Create**.
      1. Optionally, under **Health check**, click **Configure**. In the window that opens, specify the [resource health check](../concepts/health-check.md) settings:
          * **Name**.
          * Under **Type**, select one of these options:

              * `HTTP`. Additionally, in the **Path** field, specify the path for health checks.
              * `TCP`.
              * `HTTP/2`. Additionally, in the **Host** and **Path** fields, specify the host address and path for health checks.
              * `HTTPS`. Additionally, in the **Host** and **Path** fields, specify the host address and path for health checks.
              * `GRPC`. Additionally, in the **Service name** and **Authority** fields, specify the details of your gRPC service.
          * **Port**: Port number for health checks. The possible values range from `1` to `32767`.
          * **Timeout in sec**: Response timeout in seconds.
          * **Interval in sec**: Health check interval in seconds.
          * **Healthy threshold**: Number of successful checks required to consider the VM ready to receive traffic.
          * **Unhealthy threshold**: Number of failed checks before traffic is no longer routed to the VM.
	    1. Click **Apply**.
  1. Click **Create**.

- CLI {#cli}
  
  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).
  
  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
  
  1. Before you create a load balancer, make sure to [create a target group](target-group-create.md) for it.

  1. See the description of the CLI command for creating a network load balancer:

     ```bash
     yc load-balancer network-load-balancer create --help
     ```

  1. To create an internal load balancer with a [listener](../concepts/listener.md) and a [target group](../concepts/target-resources.md), run this command:

     ```bash
     yc load-balancer network-load-balancer create <load_balancer_name> \
        --type=internal \
        --deletion-protection \
        --listener name=<listener_name>,`
                   `port=<port>,`
                   `target-port=<target_port>,`
                   `protocol=<protocol>,`
                   `internal-subnet-id=<subnet_ID>,`
                   `internal-ip-version=<IP_address_version>,`
                   `internal-address=<listener_IP_address> \
        --target-group target-group-id=<target_group_ID>,`
                       `healthcheck-name=<health_check_name>,`
                       `healthcheck-interval=<health_check_interval>s,`
                       `healthcheck-timeout=<health_check_timeout>s,`
                       `healthcheck-unhealthythreshold=<number_of_failed_checks_to_get_Unhealthy_status>,`
                       `healthcheck-healthythreshold=<number_of_successful_checks_to_get_Healthy_status>,`
                       `healthcheck-tcp-port=<TCP_port>,`
                       `healthcheck-http-port=<HTTP_port>,`
                       `healthcheck-http-path=<URL>
     ```

     Where:

     * `--type`: Load balancer type.
     * `--deletion-protection`: Deletion protection for the network load balancer. You cannot delete a load balancer with this option enabled.

         {% note warning %}

         This does not apply to its listeners or target groups. 

         {% endnote %}

     * `--listener`: Listener settings:
         * `name`: Listener name.
         * `port`: Port on which the load balancer will listen to incoming traffic. The possible values range from `1` to `32767`.
         * `target-port`: Port to which the load balancer will redirect traffic. The possible values range from `1` to `32767`.
         * `protocol`: Protocol the listener will use, `tcp` or `udp`.
         * `internal-subnet-id`: Subnet ID.
         * `internal-ip-version`: Internal IP address version, `ipv4` or `ipv6`.
         * `internal-address`: Listener IP address not occupied by other resources and belonging to the subnet range specified in the `internal-subnet-id` property.

             If the `internal-address` property is not specified, the internal load balancer listener gets a random IP address from the selected [subnet](../../vpc/concepts/network.md#subnet) range.

     * `--target-group`: Target group parameters and [health check](../concepts/health-check.md) settings:
         * `target-group-id`: Target group ID.
     
           To find out the ID, [get](target-group-list.md#list) a list of target groups in the folder.
     
         * `healthcheck-name`: Health check name.
         * `healthcheck-interval`: Health check interval in seconds. The possible values range from `1s` to `60s`. The interval must be at least 1 second longer than the response timeout. 
         * `healthcheck-timeout`: Response timeout in seconds. The possible values range from `1s` to `60s`.
         * `healthcheck-unhealthythreshold`: Number of failed checks before traffic is no longer routed to the VM. The possible values range from `2` to `10`.
         * `healthcheck-healthythreshold`: Number of successful checks required to consider the VM ready to receive traffic. The possible values range from `2` to `10`.
         * `healthcheck-tcp-port`: Port for TCP health checks. The possible values range from `1` to `32,767`.
         * `healthcheck-http-port`: Port for HTTP health checks. The possible values range from `1` to `32,767`.
         * `healthcheck-http-path`: URL for HTTP health checks.
     
         You cannot specify both `healthcheck-tcp-port` and `healthcheck-http-port` at the same time.
     
         {% note warning %}
         
         Use the `<time_in_seconds>s` format, e.g., `20s`, for the `healthcheck-interval` and `healthcheck-timeout` values.
         
         {% endnote %}

     For more information about the `yc load-balancer network-load-balancer create` command, see the [Yandex Cloud CLI reference](../../cli/cli-ref/load-balancer/cli-ref/network-load-balancer/create.md).

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create an internal load balancer with a [listener](../concepts/listener.md) and a [target group](../concepts/target-resources.md):

  1. Describe the network load balancer settings in the configuration file.

     Here is an example of the configuration file structure:

     ```hcl
     resource "yandex_lb_network_load_balancer" "foo" {
       name = "<load_balancer_name>"
       type = "internal"
       deletion_protection = <balancer_deletion_protection>
       listener {
         name = "<listener_name>"
         port = <port_number>
         internal_address_spec {
           subnet_id  = "<subnet_ID>"
           ip_version = "<IP_address_version>"
           address    = "<listener_IP_address>"
         }
       }
       attached_target_group {
         target_group_id = "<target_group_ID>"
         healthcheck {
           name = "<health_check_name>"
             http_options {
               port = <port_number>
               path = "<URL>"
             }
         }
       }
     }
     ```

     Where:

     * `name`: Name of the network load balancer.
     * `type`: Type of the network load balancer. Use `internal` to create an internal load balancer.
     * `deletion_protection`: Deletion protection for the internal network load balancer. You cannot delete a load balancer with this option enabled. The default value is `false`.

       {% note warning %}

       This does not apply to its listeners or target groups. 

       {% endnote %}

     * `listener`: Listener settings:
       * `name`: Listener name.
       * `port`: Port number (ranging from `1` to `32767`) on which the load balancer will listen to incoming traffic.
       * `internal_address_spec`: Specification of the internal load balancer's listener:
         * `subnet_id`: Subnet ID.
         * `ip_version`: External IP address specification. Specify the IP address version, `ipv4` or `ipv6`. The default value is `ipv4`.
         * `address`: Listener IP address not occupied by other resources and belonging to the subnet range specified in the `subnet_id` field.

             If the `address` field value is not specified, the internal load balancer listener gets a random IP address from the selected [subnet](../../vpc/concepts/network.md#subnet) range.
     * `attached_target_group`: Description of the network load balancer's target group settings:
        * `target_group_id`: Target group ID.

          To find out the ID, [get](target-group-list.md#list) a list of target groups in the folder.

        * `healthcheck`: Health check settings. Specify a name, a port number ranging from `1` to `32767`, and a path for health checks.

     For more information about the resources you can create with Terraform, see [this provider guide](../../terraform/resources/lb_network_load_balancer.md).

  1. Create a network load balancer:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.

      This will create all the resources you need in the specified folder. You can check the new resources and their settings using the [management console](https://console.yandex.cloud).

- API {#api}

  To create an internal network load balancer, use the [create](../api-ref/NetworkLoadBalancer/create.md) REST API method for the [NetworkLoadBalancer](../api-ref/NetworkLoadBalancer/index.md) resource or the [NetworkLoadBalancerService/Create](../api-ref/grpc/NetworkLoadBalancer/create.md) gRPC API call.

{% endlist %}

## Examples

### Creating an internal load balancer without a listener {#without-listener}

Create an internal network load balancer named `internal-lb-test-1` without a listener and a target group.

{% list tabs group=instructions %}

- CLI {#cli}

  To create an internal load balancer without a listener, run this command:

  ```bash
  yc load-balancer network-load-balancer create internal-lb-test-1 \
     --type=internal
  ```

- Terraform {#tf}

  1. In the configuration file, describe the resource without the `listener` and `attached_target_group` sections:

     ```hcl
     resource "yandex_lb_network_load_balancer" "foo" {
       name = "internal-lb-test-1"
       type = "internal"
       deletion_protection = "true"
     ```

     For more information about the resources you can create with Terraform, see [this provider guide](../../terraform/resources/lb_network_load_balancer.md).

  1. Make sure the settings are correct.

     1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
     1. Run this command:
     
        ```bash
        terraform validate
        ```
     
        Terraform will show any errors found in your configuration files.

  1. Create a network load balancer.

     1. Run this command to view the planned changes:
     
        ```bash
        terraform plan
        ```
     
        If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
     
     1. If everything looks correct, apply the changes:
        1. Run this command:
     
           ```bash
           terraform apply
           ```
     
        1. Confirm updating the resources.
        1. Wait for the operation to complete.

- API {#api}

  Call the [create](../api-ref/NetworkLoadBalancer/create.md) API method, providing the following information in the request body:

  ```api
  {
    "folderId": "<folder_ID>",
    "name": "internal-lb-test-1",
    "type": "INTERNAL"
  }
  ```

{% endlist %}

### Creating an internal load balancer with a listener and attached target group {#with-listener-and-target-group}

Create an internal network load balancer with a listener and attached target group with the following test settings:

* Name: `internal-lb-test-2`
* Listener settings:
    * Name: `test-listener`
    * Port: `80`
    * Target port: `81`
    * Protocol: `TCP`
    * Subnet ID: `b0cp4drld130********`
    * IP address version: `ipv4`
    * Listener IP address: `192.168.1.25`
* Target group ID: `enpu2l7q9kth********`
* Target group health check settings:
    * Name: `http`
    * Health check interval: `2` seconds
    * Response timeout: `1` second
    * Unhealthy threshold: `2`
    * Healthy threshold: `2`
    * Port for HTTP health checks: `80`
    * URL for health checks: `/`

{% list tabs group=instructions %}

- CLI {#cli}

  Run this command:

  ```bash
  yc load-balancer network-load-balancer create internal-lb-test-2 \
     --type=internal \
     --listener name=test-listener,`
                `port=80,`
                `target-port=81,`
                `protocol=tcp,`
                `internal-subnet-id=b0cp4drld130********,`
                `internal-ip-version=ipv4,`
                `internal-address=192.168.1.25 \
     --target-group target-group-id=enpu2l7q9kth********,`
                    `healthcheck-name=http,`
                    `healthcheck-interval=2s,`
                    `healthcheck-timeout=1s,`
                    `healthcheck-unhealthythreshold=2,`
                    `healthcheck-healthythreshold=2,`
                    `healthcheck-http-port=80,`
                    `healthcheck-http-path=/
  ```

- Terraform {#tf}

  1. In the configuration file, describe the resource including the `listener` and `attached_target_group` sections:

     ```hcl
     resource "yandex_lb_network_load_balancer" "internal-lb-test" {
       name = "internal-lb-test-2"
       type = "internal"
       deletion_protection = "true"
       listener {
         name        = "test-listener"
         port        = 80
         target_port = 81
         protocol    = "tcp"
         internal_address_spec {
           subnet_id  = "b0cp4drld130********"
           ip_version = "ipv4"
           address    = "192.168.1.25"
         }
       }
       attached_target_group {
         target_group_id = "enpu2l7q9kth********"
         healthcheck {
           name                = "http"
           interval            = 2
           timeout             = 1
           unhealthy_threshold = 2
           healthy_threshold   = 2
           http_options {
             port = 80
             path = "/"
           }
         }
       }
     }
     ```

     For more information about the resources you can create with Terraform, see [this provider guide](../../terraform/resources/lb_network_load_balancer.md).

  1. Make sure the settings are correct.

     1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
     1. Run this command:
     
        ```bash
        terraform validate
        ```
     
        Terraform will show any errors found in your configuration files.

  1. Create a network load balancer.

     1. Run this command to view the planned changes:
     
        ```bash
        terraform plan
        ```
     
        If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
     
     1. If everything looks correct, apply the changes:
        1. Run this command:
     
           ```bash
           terraform apply
           ```
     
        1. Confirm updating the resources.
        1. Wait for the operation to complete.

- API {#api}

  Call the [create](../api-ref/NetworkLoadBalancer/create.md) API method, providing the following information in the request body:

  ```api
  {
    "folderId": "<folder_ID>",
    "name": "internal-lb-test-2",
    "type": "INTERNAL",
    "listenerSpecs": [
      {
        "name": "test-listener",
        "port": "80",
        "protocol": "TCP",
        "targetPort": "81",
        "internalAddressSpec": {
          "subnetId": "b0cp4drld130********",
          "ipVersion": "IPV4",
          "address": "192.168.1.25"
        }
      }
    ],
    "attachedTargetGroups": [
      {
        "targetGroupId": "enpu2l7q9kth********",
        "healthChecks": [
          {
            "name": "http",
            "interval": "2s",
            "timeout": "1s",
            "unhealthyThreshold": "2",
            "healthyThreshold": "2",
            "httpOptions": {
              "port": "80",
              "path": "/"
            }
          }
        ]
      }
    ]
  }
  ```

{% endlist %}