Networking
Proxy
A proxy sits between a client and a server, same as a VPN — but for a different job. A VPN's whole point is encrypting and tunneling traffic; a proxy's point is acting on behalf of one side — caching, filtering, hiding an identity, or spreading load — and it may not involve encryption at all.
Quick reference
- What it is
- A server that sits between a client and a destination, making the request on one side's behalf.
- Mental model
- A personal assistant who places calls for you — the other party talks to your assistant, never directly to you.
- Key numbers
- The one question that tells the two kinds apart: which side is the proxy standing in front of — the clients, or the servers?
- Reach for it when
- Caching repeated requests, filtering/monitoring traffic, hiding a client's identity, or distributing load across several backend servers.
Forward proxy vs. reverse proxy
Both are the same basic idea — "stand in the middle" — pointed in opposite directions:
Why use one at all
- Caching — serving a repeated request straight from a stored copy instead of hitting the real origin again, whether that's a corporate forward proxy caching common downloads or a reverse proxy/CDN caching a popular page.
- Filtering — a forward proxy blocking access to certain destinations (corporate content policy); a reverse proxy blocking malicious-looking requests before they ever reach a real backend.
- Anonymity — a forward proxy hides the originating client's real address from whatever it's talking to.
- Load distribution — a reverse proxy spreading incoming requests across multiple backend servers, so no single server has to handle all the traffic alone.
Real-world applications
- Corporate outbound web filtering — a forward proxy that every employee's traffic passes through on the way out to the internet.
- Nginx/HAProxy in front of a web application — the standard reverse-proxy pattern, routing incoming requests to one of several backend application servers.
- CDN edge servers — functionally reverse proxies and caches placed physically close to users, serving cached content without a round trip to the real origin server.
- TLS termination — a reverse proxy handling TLS decryption once at the edge, so backend servers behind it only ever handle plain, already-decrypted traffic and don't each need their own certificate.
Gotchas
Field notes
- Mixing up "forward" and "reverse" is extremely common — always ask which side the proxy is standing in front of, not which direction traffic happens to be moving in any one example.
- A caching proxy serving stale data is a classic, genuinely hard bug class — cache invalidation is famously one of the notoriously difficult problems in computer science, and a proxy layer is exactly where it bites.
- An open forward proxy — reachable and usable by anyone on the internet, not just its intended clients — is a real abuse vector, the same class of misconfiguration as SMTP's open-relay problem.