Proxies: Forward vs Reverse

What is a Proxy?

A proxy server is an intermediary that sits between clients and servers, handling requests on behalf of one side or the other. The key distinction is whose side it's on: the client's side (forward proxy) or the server's side (reverse proxy).

Think of it like a translator or representative: they speak for you, but which "you"—the client or the server?

Forward Proxy (Client-Side Proxy)

A forward proxy sits between clients and the internet, acting on behalf of clients.

How It Works

1. Client configures browser to use proxy
2. Client sends request to proxy
3. Proxy forwards request to destination server
4. Server sees proxy's IP address, not client's
5. Proxy returns response to client

Use Cases

1. Anonymity & Privacy

Client IP: 192.168.1.100 (hidden)
     ↓
Forward Proxy IP: 203.0.113.50
     ↓
Website sees: 203.0.113.50 (not your real IP)

Examples:

• HTTP or SOCKS proxies; a VPN is a different network-tunneling mechanism
• Tor network (onion routing through multiple proxies)
• Privacy-focused browsers

2. Access Control & Bypass Restrictions

# Pseudocode: an organization applies an outbound policy
if request.url.contains("facebook.com"):
    return "403 Forbidden"

# But employees can use forward proxy outside network
employee → home proxy → facebook.com ✓

Examples:

• Bypass geographic restrictions (Netflix region locks)
• Access blocked websites in restrictive countries
• Circumvent corporate firewalls

3. Content Filtering (Corporate/School Networks)

# Squid proxy configuration (not Nginx syntax)
acl blocked_sites dstdomain .facebook.com .youtube.com
http_access deny blocked_sites

Examples:

• Schools blocking gaming sites
• Companies blocking streaming services
• Parental controls

4. Caching (Save Bandwidth)

100 employees request same software update
Without proxy: 100 downloads × 500MB = 50GB bandwidth
With proxy cache: 1 download × 500MB = 500MB bandwidth

Popular forward proxy software:

• Squid
• Apache HTTP Server (mod_proxy)
• SOCKS5 proxies

Reverse Proxy (Server-Side Proxy)

A reverse proxy sits in front of backend servers, acting on behalf of servers.

How It Works

1. Client sends request to public-facing reverse proxy
2. Proxy decides which backend server should handle it
3. Proxy forwards request to chosen backend
4. Backend processes request
5. Proxy returns response to client
6. Backend selection can be hidden, but headers, errors or application content can still reveal infrastructure

Use Cases

1. Load Balancing

Distribute traffic across multiple servers:

# Nginx reverse proxy config
upstream backend {
    server backend1.example.com weight=3;
    server backend2.example.com;
    server backend3.example.com;
}

server {
    location / {
        proxy_pass http://backend;
    }
}

Algorithms:

• Round Robin: Server1 → Server2 → Server3 → Server1...
• Least Connections: Send to server with fewest active connections
• IP Hash: Stable IP-based mapping while backend membership/configuration permits it

2. SSL/TLS Termination

Client ----HTTPS----> Reverse Proxy ----HTTP----> Backend Servers
       (encrypted)                      (plain)

Benefits:

• Backend TLS is a separate decision; re-encrypt traffic when the trust boundary requires it
• Centralized certificate management
• Reduced CPU load on backend (no encryption overhead)
• Easier to implement HTTP/2 or HTTP/3

Example (Nginx):

server {
    listen 443 ssl;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    
    location / {
        proxy_pass http://backend:8080;  # Plain HTTP to backend
    }
}

3. Security & Hiding Backend

Attacker scans: reverse-proxy.com
Finds: Nginx server
Cannot see: Database at 10.0.0.5, App servers at 10.0.0.10-20

Security benefits:

• Hide backend server IPs and topology
• DDoS protection (Cloudflare, AWS Shield)
• WAF (Web Application Firewall) integration
• Rate limiting at proxy level

4. Caching Static Content

This configuration fragment belongs in Nginx’s http context, with the location inside a server. Cache only explicitly public responses; authenticated content needs a separate policy.

# http context:
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m
                 max_size=1g inactive=1d;
# server context:
# Cache eligible images, CSS and JS for up to 1 day
location ~* \.(jpg|jpeg|png|gif|css|js)$ {
    proxy_pass http://backend;
    proxy_cache my_cache;
    proxy_cache_valid 200 1d;
    add_header X-Cache-Status $upstream_cache_status;
}

Result:

• First request: Proxy fetches from backend, caches result
• Later eligible requests may be served from the cache
• The hit ratio depends on reuse, cache keys, TTL, eviction and cache-control rules

5. Compression

gzip on;
gzip_types text/plain text/css application/json;
proxy_pass http://backend;

Proxy compresses responses before sending to clients, saving bandwidth.

6. Routing & API Gateway

# Route based on URL path
location /api/users {
    proxy_pass http://user-service:3000;
}

location /api/orders {
    proxy_pass http://order-service:4000;
}

location /api/payments {
    proxy_pass http://payment-service:5000;
}

Forward vs Reverse Proxy Comparison

Visual Comparison

Forward Proxy Flow:
[Client] ---config---> [Forward Proxy] ---------> [Internet/Server]
                           (hides client)

Reverse Proxy Flow:
[Client] ---------> [Reverse Proxy] ---hidden---> [Backend Servers]
     (public)       (public-facing)      (hidden)

Real-World Examples

Controlled outbound access

In a hypothetical office, a forward proxy provides one place to apply outbound allowlists and record approved access. It also becomes a trust and availability dependency. An address change alone does not guarantee anonymity: account logins, forwarded headers and browser identifiers remain relevant.

Cloudflare (Reverse Proxy)

yourwebsite.com points to Cloudflare IP (public)
Cloudflare proxies requests to your origin server (hidden IP: 203.0.113.100)

Benefits:
- DDoS protection (Cloudflare absorbs attack)
- Global CDN caching
- SSL termination
- Rate limiting
- WAF rules

Nginx Reverse Proxy for Microservices

# docker-compose.yml
services:
  nginx:
    image: nginx
    ports:
      - "80:80"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
  
  user-service:
    image: user-api
    ports:
      - "3000:3000"
  
  order-service:
    image: order-api
    ports:
      - "4000:4000"

# nginx.conf
server {
    location /users/ {
        proxy_pass http://user-service:3000/;
    }
    
    location /orders/ {
        proxy_pass http://order-service:4000/;
    }
}

Proxy Technologies

Popular Reverse Proxies

Popular Forward Proxies

Interview Tips 💡

When discussing proxies in system design interviews:

1. Clarify which type: "Are we using a forward proxy for client privacy or reverse proxy for load balancing?"
2. Explain the benefit: "A reverse proxy lets us hide backend servers and terminate SSL in one place..."
3. Mention specific tools: "We'd use Nginx as a reverse proxy for load balancing and SSL termination..."
4. Discuss caching: "The reverse proxy can cache static assets, reducing backend work in proportion to the measured cache-hit rate..."
5. Security considerations: "A configured WAF integrated with a reverse proxy can reject selected malicious requests before they reach our application..."
6. Scale implications: "With Cloudflare as reverse proxy, we can handle DDoS attacks and cache globally..."

Worked failure: one user sees another user’s page

A reverse proxy caches /account using only the URL as its key. User A’s personalized response is then served to user B. The proxy is working according to its configuration, but the cache policy is wrong. Keep private responses out of shared caches and test both authenticated and anonymous requests before enabling a broad file-extension or URL rule. Also define which proxies may set trusted forwarding headers; a client-supplied header is not proof of identity.

Nginx documents cache controls and forwarding behavior in its HTTP proxy module reference.

Related Concepts

• Load Balancing — Reverse proxies distribute load
• CDN — CDNs are specialized reverse proxies
• API Gateway — API gateways are reverse proxies with routing
• Caching — Proxies implement caching strategies
• Microservices — Reverse proxies route to services