Overview
A proxy is an intermediary that sits between clients and servers and forwards traffic on someone's behalf. A forward proxy acts for clients: it controls and hides outbound traffic from a company network. A reverse proxy acts for servers: it receives incoming traffic and forwards it to backend servers, hiding their details from the internet.
Proxies are how large systems add cross-cutting capabilities without changing application code: caching, TLS termination, authentication, rate limiting, logging, and compression. Load balancers, API gateways, CDNs, and service mesh sidecars are all specialized proxies.
A forward proxy is your personal assistant who makes calls for you, so the other side sees the assistant, not you. A reverse proxy is a company receptionist who answers all incoming calls and routes them to the right employee, who stays hidden behind the front desk.
When to use it
- Controlling or filtering outbound traffic from a corporate network (forward proxy).
- Hiding and protecting backend servers (reverse proxy).
- Adding caching, compression, TLS, or auth in one place.
- Routing requests to different services by path or host.
Where it shows up in interviews
Recognize it when: a single entry point for many backend services.
- Design an API gateway
- Design a CDN
Recognize it when: servers must call external APIs through a controlled path.
- Design a secure outbound integration platform
- Design a web crawler
Where it is used in real software
Companies route employee web traffic through proxies like Zscaler or Squid for filtering, logging, and data-loss prevention.
Nginx, HAProxy, Envoy, and Traefik front web applications; Cloudflare is a global reverse proxy.
Istio and Linkerd run a sidecar proxy next to every service to handle retries, mTLS, and metrics.
Key terms
- Forward proxy
- Configured by the client; represents clients to servers.
- Reverse proxy
- Configured by the server owner; represents servers to clients.
- Transparent proxy
- Intercepts traffic without client configuration.
- Sidecar
- A proxy deployed alongside each service instance.
How it works, step by step
- 1Client sends a request
To the proxy's address (reverse) or through the configured proxy (forward).
- 2Proxy applies policy
Authentication, filtering, rate limits, or cache lookup.
- 3Proxy forwards
Opens or reuses a connection to the target server.
- 4Proxy processes the response
Caches, compresses, rewrites headers, and logs.
- 5Proxy returns the response
The client never talks directly to the other side.
Forward vs reverse proxy
Same mechanism, different owner and purpose
| Aspect | Forward proxy | Reverse proxy |
|---|---|---|
| Acts on behalf of | Clients | Servers |
| Configured by | Client or corporate IT | Service owner |
| Hides | Client identity | Backend servers |
| Typical features | Filtering, anonymity, egress logging | Load balancing, TLS, caching, WAF |
| Examples | Squid, Zscaler | Nginx, Envoy, Cloudflare |
NOWAspect: Acts on behalf of | Forward proxy: Clients | Reverse proxy: Servers
If the proxy is between your users and the internet, it is forward. If it is between the internet and your servers, it is reverse.
Implementation
# Send a request through a forward proxycurl -x http://proxy.corp.example:3128 https://api.partner.com/status # Many tools respect proxy environment variablesexport HTTPS_PROXY=http://proxy.corp.example:3128export NO_PROXY=localhost,.internal.example # bypass for internal hostsComplexity and performance
In the same data center.
Client-proxy and proxy-server (often pooled).
Trade-offs
Proxies centralize policy but must be redundant and scaled, or they become a bottleneck.
TLS-intercepting proxies can inspect encrypted traffic but require trusting a corporate certificate on every device.
Variants and related techniques
A reverse proxy specialized in distributing traffic.
A reverse proxy with API-aware features: auth, quotas, versioning.
A globally distributed caching reverse proxy.
Common mistakes
- Losing the client IP.
Fix: Configure X-Forwarded-For or the PROXY protocol, and trust it only from your proxies.
- Proxy timeouts shorter than backend work.
Fix: Align timeouts across layers to avoid 504s for long requests.
Interview questions
What is the difference between a forward and a reverse proxy?
A forward proxy represents clients (for filtering, anonymity, egress control). A reverse proxy represents servers (for load balancing, TLS termination, caching, and protecting backends).
Why put a reverse proxy in front of an app server?
To terminate TLS, serve static files, compress, buffer slow clients, rate limit, and hide and balance multiple app instances.
Practice problems
| Problem | Difficulty | What it trains |
|---|---|---|
| Draw where forward and reverse proxies sit in a company network | Easy | Placement. |
| Design egress control for servers calling third-party APIs | Medium | Forward proxy policy. |