Forward Proxy vs Reverse Proxy: What Is the Difference?
A forward proxy sits in front of the clients and acts on their behalf, so the destination server sees the proxy rather than the real client. A reverse proxy sits in front of the servers and acts on their behalf, so the client reaches the proxy and never learns which server answered. Both are proxy servers, which means a machine that relays requests and responses for another party. The direction is the difference.
Everything else follows from that direction. A forward proxy is normally configured by the client, so the client knows it is there. A reverse proxy belongs to the website's own infrastructure, so the client usually cannot tell that it exists.
Forward Proxy vs Reverse Proxy: Side by Side
| Question | Forward proxy | Reverse proxy |
|---|---|---|
| Who does it represent? | the clients | the origin servers |
| Where does it sit? | at the edge of the client network | at the edge of the server network |
| Who knows about it? | the client configures it, and the destination server sees only the proxy | the client cannot see it, and the servers are configured behind it |
| Typical purposes | access control, filtering, outbound caching, one exit address | TLS termination, load balancing, caching, hiding the origin, routing by path |
| Typical software | Squid | nginx, HAProxy, Envoy, Cloudflare |
| Who operates it? | the network the client is on, such as a company or a school | the team that owns the website or the API |
What a Forward Proxy Does
A forward proxy serves the people on one network. The company, school, or data center that owns that network runs it, and the clients are configured to send their requests through it. That configuration lives in the browser, in the operating system, in a proxy auto-config file, or in an environment variable such as HTTP_PROXY.
Four uses are common.
- Access control. The proxy allows or denies destinations by policy, which is how an employer blocks categories of sites or limits which external services an application may call.
- One outbound address. All traffic leaves through the proxy, so a partner can permit a small, fixed set of source addresses.
- Caching. A shared cache serves the second request for the same file locally, which saves bandwidth on a slow or expensive link.
- Debugging. A developer points an application at a local intercepting proxy, such as mitmproxy, to read the requests it actually sends.
Squid is a widely used open source forward proxy. It accepts requests from configured clients, applies access rules, caches what it is permitted to cache, and forwards the rest.
Encrypted traffic needs one extra step. The client asks the proxy for a tunnel with the HTTP CONNECT method, and the proxy relays the encrypted bytes without reading them. Inspecting that traffic requires the proxy to present its own certificate, which the clients must be set up to trust.
Anonymity is a genuine property of a forward proxy, since the destination sees only the proxy address, but it is a side effect rather than the usual reason a team deploys one.
What a Reverse Proxy Does
A reverse proxy serves the owner of the servers. The public name of the site resolves to the proxy, so every request reaches it first, and the proxy decides what to do next. The application servers behind it often have no public address at all.
Five jobs are common.
- TLS termination. The proxy holds the certificate, decrypts the HTTPS connection, and passes a plain request to the application.
- Load balancing. It spreads requests across a pool of identical servers and stops sending traffic to any server that fails its health check.
- Caching and compression. It stores responses that may be reused and compresses them in one place instead of in every server.
- Hiding the origin. Clients cannot address the application servers directly, so an attacker cannot reach them directly either.
- Routing by path. Requests for /api go to one service and requests for /images go to another, while the client sees a single hostname.
nginx, HAProxy, and Envoy are common reverse proxies that a team runs itself. Cloudflare is the common one bought as a service: the site's DNS record points at its network, which filters and caches before anything reaches the origin.
A content delivery network is a reverse proxy spread across many locations, explained in what a CDN is. An API gateway is a reverse proxy with request-level features added on top, such as authentication and rate limiting.
Reverse Proxy and Load Balancer Overlap
A load balancer distributes requests across several servers. A reverse proxy may do that, but it can also stand in front of a single server and still be worth running for TLS termination and caching. The two ideas overlap without being equal, and one program often fills both roles: nginx is a reverse proxy that can balance load, and HAProxy is a load balancer that works as a reverse proxy. The longer comparison is in reverse proxy versus load balancer.
Which Proxy the Question Means
The word proxy on its own is ambiguous, and the context usually settles it. In a networking or security discussion, a bare proxy almost always means a forward proxy. In a system design diagram, a box labeled proxy between the internet and the application servers is almost always a reverse proxy.
Name the direction yourself rather than guessing. Say which side the proxy represents, then describe what it does.
The plain comparison of a proxy against a reverse proxy, without the forward label, is answered in the difference between a proxy and a reverse proxy.
How to Prepare
- State the direction first. Begin every proxy answer with the side the proxy represents, then give the purpose.
- Learn the five reverse proxy jobs by name. TLS termination, load balancing, caching, hiding the origin, and path routing appear in almost every design of a public service.
- Place each one correctly in a diagram. A reverse proxy belongs between the clients and the application tier, while a forward proxy belongs inside a client network and rarely appears at all.
- Fill in the networking basics. Start with networking concepts every software engineer should know, then return to the proxy question.
- Study the pieces together in a course. Grokking System Design Fundamentals covers proxies, load balancers, and caching, and Grokking the System Design Interview uses them in complete designs.
GET YOUR FREE
Coding Questions Catalog
$98
$197
$72
