System Design / Networking Basics
What is a proxy?
Start with one simple idea: a proxy is an intermediary between two computers.
A computer that passes a request along
A proxy is a computer or service that receives a request from one computer and passes it to another computer. The reply travels back through the proxy to the first computer.
The proxy acts on behalf of one side while communicating with the other. What the proxy can see or change depends on how it is set up; we’ll explore the two common arrangements next.
Two common types of proxy
The difference is which side the proxy represents.
A forward proxy works on behalf of clients. A person, device, or organization configures the client to send requests through it. The proxy receives each request, contacts the internet server, and relays the server’s reply back to the client.
For example, a company may use a forward proxy to apply browsing rules, record network requests, or cache frequently requested content. The destination server connects with the proxy; depending on the proxy’s configuration, request details may also identify the original client.
A reverse proxy works on behalf of servers. A website owner places it at the public entrance to their service. Clients send requests to that proxy; it forwards each request to an appropriate backend server and relays the response back to the client.
For example, a reverse proxy can distribute requests across several servers, handle HTTPS encryption, or cache responses. Clients connect to the proxy’s public address instead of connecting directly to a backend server. A load balancer often acts as a reverse proxy when it receives requests and selects a backend server.
Reverse proxy vs. load balancer
These terms describe different things. A reverse proxy describes the proxy’s position and role: it receives requests for servers behind it. A load balancer describes a job: it spreads requests or connections across multiple servers.
| Question | Reverse proxy | Load balancer |
|---|---|---|
| Main role | Acts as the public-facing intermediary for one or more backend servers. | Distributes traffic across multiple servers or destinations. |
| Does it have to distribute traffic? | No. It can forward every request to one backend server. | Yes. Its purpose is to choose among multiple destinations. |
| Can one system do both? | Yes. A reverse proxy can also balance traffic across backends. | Many application-level load balancers work as reverse proxies. |
For example, NGINX can receive a website request as a reverse proxy and send it to one of several application servers as a load balancer. The two names overlap because one system can perform both roles; they are not synonyms.
What can a proxy do?
Every proxy passes requests between computers. Depending on its type and configuration, it may also provide one or more of these capabilities:
- Control access: allow or block requests according to rules. For example, an organization’s forward proxy can block access to selected websites.
- Check identity: ask a user or client to authenticate before forwarding a request.
- Record traffic: log request details, such as the time, destination, and result, to help with monitoring or troubleshooting.
- Cache responses: keep a copy of some responses and reuse it for later requests when the content is safe and appropriate to cache. This can reduce repeated work and speed up responses.
- Mask network addresses: a forward proxy can make the destination connect to the proxy rather than directly to the client. Some proxy configurations also pass the client’s address in request headers, so this does not always make the client anonymous.
- Distribute requests: a reverse proxy can choose a backend server for each request. This is how a load balancer can spread work across servers.
- Handle HTTPS: a reverse proxy can accept an encrypted HTTPS connection, decrypt it, and forward the request to a backend. The connection between proxy and backend can also be encrypted, depending on configuration.
A particular proxy may provide only some of these features. The features depend on the proxy software and how it is configured.
Common proxy software
These are examples of software used to run proxies. They are tools, while forward proxy and reverse proxy describe the proxy’s role. Some tools can be configured for more than one role.
- Squid: often used as a forward proxy for web access policies and caching.
- NGINX: commonly configured as a reverse proxy in front of web applications and servers.
- HAProxy: commonly used as a proxy and load balancer for TCP and HTTP traffic.
- Apache HTTP Server: its
mod_proxymodules can provide forward or reverse proxying. - Envoy: used as an edge proxy and for communication between services.
These examples are not interchangeable in every situation. The right choice depends on the traffic, features, and environment.
How do you set up a proxy?
The exact steps depend on the proxy software, but the basic setup follows the same pattern: decide what should pass through the proxy, configure where it listens, and tell the client or network to send traffic there.
Setting up a forward proxy
- Choose proxy software and run it on a computer or server that clients can reach.
- Configure its listening address and port, plus any access rules or authentication.
- Configure each browser, device, or application to use that proxy for internet requests.
- Test a request and inspect the proxy’s logs to confirm it was forwarded.
Security: restrict access to trusted clients. An unrestricted public forward proxy can be abused by strangers.
Setting up a reverse proxy
- Run the proxy where it can receive incoming requests and connect to your application servers.
- Configure the public hostname and listening port, then map requests to one or more backend servers.
- Point the hostname or incoming traffic to the proxy, and keep backend addresses reachable from it.
- Test requests and responses, then check logs, access rules, and HTTPS settings.
For a hands-on reverse proxy example, continue to the NGINX load-balancer setup →. It shows NGINX forwarding requests to two local web servers.