AWS Adds TCP Reset to Gateway Load Balancer: What Proxy Recovery Teams Should Test

AWS announced TCP Reset support for Gateway Load Balancer on September 2, 2026. The feature can actively return a TCP reset when a target becomes unhealthy, finishes deregistration, or receives traffic after a configured idle timeout. Instead of leaving an existing flow to wait through repeated TCP retransmissions, the reset tells the sender that the flow is over so the application can establish a new connection.

For teams operating authorized data collection, regional validation or proxy-backed browser workloads behind network security appliances, this is more than a load-balancer setting. It changes the failure signal seen by the client. Recovery logic, session handling and monitoring should therefore be tested before the option reaches production.

What AWS changed

Gateway Load Balancer distributes flows to virtual appliances such as firewalls and inspection systems. AWS says the previous fail-open behavior could keep forwarding an existing flow toward an unhealthy appliance. The sender could then wait from tens of seconds to several minutes while normal TCP backoff ran.

With TCP Reset enabled, GWLB removes the affected flow entry and sends a reset in response to new traffic on that flow. The next application attempt becomes a new flow that can be assigned to a healthy target.

AWS documents three independent triggers:

The feature is off by default. AWS also states that it requires five-tuple flow stickiness and that Flow Rebalance takes precedence when both behaviors are configured.

Faster signaling is not instant recovery

A reset removes one source of ambiguity, but total recovery time still contains several clocks:

1. failure detection — health-check interval multiplied by the unhealthy threshold, plus processing time;
2. reset delivery — detection to the first relevant packet receiving the reset;
3. client reaction — application classification, backoff and connection creation;
4. route recovery — the new flow reaching a healthy appliance and approved proxy path;
5. business recovery — the first response passing content, location, session and compliance validation.

AWS notes that default health checks may still produce a multi-minute detection window. More aggressive checks can shorten it but can also create false positives. Do not describe the feature as “recovery in seconds” without measuring the complete path under your own health-check and application settings.

What proxy-backed applications should test

Classify RST separately

Record a TCP reset as its own transport outcome. Do not merge it with connect timeout, TLS error, authentication failure, HTTP denial or invalid content. Each has a different safe response.

Keep retries bounded

An RST can prompt an immediate reconnect, so a large worker fleet may retry at once. Apply jitter, a hard attempt limit, a task-level deadline and a circuit breaker. Report retry amplification as total attempts divided by original operations.

Revalidate the replacement route

A new connection must still use the intended gateway, protocol, address family and region. Block direct fallback. For sticky workloads, define whether a changed exit invalidates the application session.

Protect ambiguous operations

A reset confirms that a connection ended; it does not prove that a preceding write had no effect. Use idempotency keys where supported, checkpoint work and quarantine uncertain outcomes rather than replaying them automatically.

Monitor both infrastructure and outcome

AWS introduced the TCP_ELB_Reset_Count metric for reset activity. Pair it with target-health changes, connection failures, proxy gateway results, first-attempt success, valid-content rate, session loss and time to business recovery. A rising reset count without business impact may be expected during maintenance; a flat count during a simulated failure may reveal a configuration gap.

A controlled validation plan

Use an owned or explicitly authorized test environment.

1. Establish a low, fixed baseline through one healthy appliance.
2. Confirm the expected five-tuple stickiness, idle timeout and health-check settings.
3. Remove or fail one test appliance using a reversible method.
4. Timestamp the injected fault, health-state change, reset, new connection and first valid result.
5. Verify that no request escaped through a direct route.
6. Check whether sticky sessions, cookies and in-progress operations remained correct.
7. Compare total attempts, p95 latency and cost per valid result with the baseline.
8. Test deregistration and idle-timeout triggers separately; do not assume they behave like health failure.
9. Restore the target and confirm that traffic stabilizes without route flapping.
10. Document the rollout and rollback thresholds.

Release checklist

• [ ] TCP Reset is enabled only on the intended target groups and listeners.
• [ ] Five-tuple stickiness is configured and verified.
• [ ] Flow Rebalance interaction is understood.
• [ ] Health-check timing matches the recovery objective without excessive false positives.
• [ ] Clients classify RST distinctly and do not create synchronized retry storms.
• [ ] Direct fallback is blocked.
• [ ] Replacement routes preserve the required region, protocol and address family.
• [ ] Ambiguous writes are idempotent or quarantined.
• [ ] Infrastructure and business recovery metrics are both visible.
• [ ] Non-production failure drills pass before rollout.

FAQ

Does TCP Reset move an existing flow to another appliance?

No. It terminates the affected flow. The application must create a new connection, which GWLB can then assign to a healthy target.

Should application timeouts be removed?

No. AWS recommends keeping application-layer timeouts. The reset is an additional signal, not a replacement for bounded deadlines and retry policy.

Will this fix every proxy timeout?

No. It addresses specific GWLB flow conditions. Proxy authentication, upstream congestion, destination throttling, DNS, TLS and content validation remain separate failure layers.

What is the most important acceptance metric?

Measure time to the first valid business result, not only time to a new connection. Include session correctness, route compliance and duplicate protection.

For the application side of this change, use 98IP's guides to run a proxy failover drill, set a timeout budget, and control retry amplification.

Compliance note

Test only systems, accounts and traffic paths you own or are authorized to use. Respect destination terms, robots directives, rate limits, privacy obligations and applicable law. Do not use resets, retries or route changes to override an access decision. Keep credentials and session secrets out of logs.

Source note: Amazon Web Services, “Reduce Traffic Interruptions with Gateway Load Balancer TCP Reset,” published September 2, 2026.