Forward Proxy

A forward proxy sits in front of clients and forwards their requests to origin servers. The server sees the proxy's IP, not the client's.

Key Functions

• Anonymity — Hides client IP from servers
• Access Control — Filters requests by policy
• Caching — Stores frequently requested content
• Logging — Records all outbound traffic

Use Cases

• Corporate network filtering
• Bypassing geographic restrictions
• Web scraping with IP rotation
• Client-side load balancing

Reverse Proxy

A reverse proxy sits in front of servers and distributes incoming client requests. Clients interact with the proxy, not the actual server.

Reverse Proxy Capabilities

Nginx as Reverse Proxy

Nginx is the most widely deployed reverse proxy, known for its event-driven architecture.

Nginx reverse proxy configuration:

upstream backend {
    least_conn;
    server 10.0.0.1:8080 weight=3;
    server 10.0.0.2:8080 weight=2;
    server 10.0.0.3:8080 weight=1;
    keepalive 32;
}

server {
    listen 443 ssl;
    ssl_certificate /etc/ssl/cert.pem;
    ssl_certificate_key /etc/ssl/key.pem;

    location / {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_connect_timeout 5s;
        proxy_read_timeout 60s;
    }

    location /static/ {
        proxy_cache_valid 200 1h;
        proxy_pass http://backend;
    }
}

HAProxy

HAProxy is purpose-built for load balancing and proxying TCP/HTTP traffic.

SSL/TLS Termination

Offloading SSL at the proxy layer simplifies backend services and enables centralized certificate management.

Forward Proxy vs Reverse Proxy

Proxy Chains

In complex architectures, requests may pass through multiple proxies:

Practice Exercises

1. Conceptual: Explain why SSL termination is typically done at the reverse proxy rather than on each backend server. What are the trade-offs?

2. Design: Design a reverse proxy layer for an e-commerce platform that handles 50,000 QPS with 99.99% availability. Include caching, rate limiting, and failover strategies.

3. Comparison: Compare Nginx and HAProxy for a microservices architecture requiring both L7 routing and TCP load balancing. When would you choose one over the other?

4. Security: A reverse proxy sits in a public subnet while backends are in a private subnet. What security measures should be in place for the proxy-to-backend communication?

What to Learn Next