Skip to content

Proxy Types#

A proxy sits between client and server, relaying connections. The differences come down to: which side initiates, who knows the proxy is there, and what layer of the stack it speaks.

flowchart LR
  subgraph Forward[Forward proxy]
    F1[Client] -->|knows proxy| FP[Forward proxy] --> FS[Server]
  end
  subgraph Reverse[Reverse proxy]
    R1[Client] --> RP[Reverse proxy] -->|hidden backends| RS[Server]
  end
  subgraph Transparent[Transparent proxy]
    T1[Client] --> TP[Transparent proxy<br/>client doesn't know] --> TS[Server]
  end

    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    class FP,RP,TP edge;

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
Reverse proxy fronting internal servers
Source: Wikimedia Commons. CC BY-SA / public domain.

Forward proxies represent the client (egress filtering, anonymization). Reverse proxies represent the server (TLS termination, load balancing, caching). Transparent proxies are intercepted at the network layer without client cooperation. SOCKS proxies tunnel arbitrary TCP/UDP.

A proxy relays traffic between two endpoints. The same word covers everything from a corporate web filter to a CDN's edge to a development debugging tool. The vocabulary matters because the security and operational properties differ.

Forward proxy#

flowchart TB
  C([Client]) -->|configured proxy| FP[Forward proxy<br/>Squid, NGINX, corporate]
  FP -->|on behalf of client| Web[(Internet)]

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    class C client;
    class FP edge;

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
  • Client knows about the proxy; configures it explicitly.
  • Server sees the proxy's IP, not the client's.
  • Uses: corporate egress filtering, content blocking, bandwidth caching, anonymization.

Reverse proxy#

flowchart LR
  C([Internet client]) --> RP[Reverse proxy<br/>NGINX, Envoy, HAProxy]
  RP --> B1[Backend 1]
  RP --> B2[Backend 2]
  RP --> B3[Backend 3]

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
  • Client thinks it's talking to the proxy; backends are hidden.
  • Server fleet is behind one or more reverse proxies.
  • Uses: TLS termination, load balancing, request routing, caching, WAF, compression, header rewriting.
  • Examples: NGINX, HAProxy, Envoy, Apache Traffic Server, every CDN's edge.

Transparent proxy#

flowchart LR
  C([Client - no config]) -.routed.-> TP[Transparent proxy<br/>iptables / WCCP] --> Net[Server]

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
  • Client makes no special config; network routing diverts the connection.
  • Often used by ISPs (caching), schools (filtering), enterprises (DLP).
  • TLS makes traditional transparent proxies blind to content; "TLS-intercepting" variants must install a root CA on every client.

SOCKS proxy#

SOCKS (Secure Sockets - historical) tunnels arbitrary TCP and (in SOCKS5) UDP. Used by SSH dynamic port forwarding (ssh -D 1080), Tor, and corporate egress.

ssh -D 1080 jumpbox      # local port 1080 is now a SOCKS proxy
curl --socks5 localhost:1080 https://internal.example.com

L4 vs L7#

Layer Sees Examples Use
L4 (TCP/UDP) IP+port; bytes HAProxy TCP mode, AWS NLB Pass-through, mTLS pass-through
L7 (HTTP) Hostname, path, headers NGINX, Envoy, ALB Routing, WAF, observability

L4 is faster (no parsing); L7 is smarter (can route by URL).

API gateway as proxy#

An API gateway (Kong, Tyk, Apigee) is a specialized reverse proxy with API-specific features: key auth, rate limiting, request transformation, schema validation. See api-gateway.

Sidecar proxy#

In a service mesh, every pod has a sidecar proxy (Envoy, Linkerd). The proxy is both reverse (for inbound) and forward (for outbound). See sidecar-pattern.

Common pitfalls#

  • X-Forwarded-For trust: a reverse proxy must overwrite (not append) the client IP header if the previous hop is untrusted, otherwise spoofing.
  • WebSocket upgrade: not all L7 proxies handle Upgrade: websocket transparently. Test.
  • Connection coalescing: HTTP/2 multiplexing means a reverse proxy can hold a single TCP connection to many clients on one backend. Tune accordingly.
  • TLS termination location: terminating at the LB is convenient but means traffic from LB to backend is plaintext. Use mTLS between LB and backend if needed.
  • Proxy protocol: when L4 LB passes through to backend, use HAProxy's "proxy protocol" header so backend sees original client IP.

Where proxies fit#

flowchart TB
  PR((Proxy types))
  LB[Load balancer<br/>reverse proxy = LB]
  L47[L4 vs L7 LB<br/>layer dive]
  GW[API Gateway<br/>specialised reverse proxy]
  SC[Sidecar pattern<br/>fwd + rev in one]
  PR --> LB
  PR --> L47
  PR --> GW
  PR --> SC

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class PR service;
    class LB,L47,GW,SC datastore;

Glossary & fundamentals#

Tag Concept What it is Page
HLD Load balancer most reverse proxies are also LBs load-balancer
HLD Load balancer L4 L7 layer-specific deep dive load-balancer-l4-l7
HLD API Gateway API-specialised reverse proxy api-gateway
HLD Sidecar Pattern sidecar is forward + reverse proxy sidecar-pattern

Quick reference#

Types#

Type Direction Visibility Use
Forward Client → Internet Client knows Egress filter, anonymize
Reverse Internet → Server Hidden backends LB, TLS termination, cache
Transparent Either Client doesn't know ISP cache, school filter
SOCKS Any TCP/UDP Client knows Tunneling, SSH -D

L4 vs L7#

Layer Sees Speed Smart
L4 IP+port Faster No
L7 URL, headers Slower Yes

Specialized variants#

  • API gateway: reverse + API features (auth, rate limit)
  • Sidecar (Envoy/Linkerd): forward + reverse in one
  • Edge proxy (CDN): geo-distributed reverse

Pitfalls#

  • X-Forwarded-For spoofing if previous hop untrusted
  • WebSocket Upgrade not always supported on L7
  • TLS termination = plaintext LB→backend
  • Use proxy protocol for L4 client IP

Common products#

Type Examples
Reverse NGINX, HAProxy, Envoy, ALB
Forward Squid, NGINX
API gateway Kong, Apigee, AWS API GW
Sidecar Envoy, Linkerd, Consul

Refs#

  • NGINX reverse proxy docs
  • HAProxy proxy protocol
  • Envoy architecture
  • RFC 1928 (SOCKS5)

FAQ#

What is the difference between a forward and reverse proxy?#

A forward proxy fronts clients and hides them from servers. A reverse proxy fronts servers and hides backends from clients. Both relay traffic but face opposite directions.

What is a transparent proxy?#

A transparent proxy intercepts traffic without the client configuring it. It is common for corporate filtering, ISP caching, and traffic shaping at network edges.

What is a SOCKS proxy used for?#

SOCKS is a generic TCP and UDP relay that works for any protocol, not just HTTP. Tools like SSH dynamic forwarding use SOCKS to tunnel arbitrary application traffic.

Is a reverse proxy the same as a load balancer?#

All load balancers are reverse proxies, but reverse proxies also handle TLS termination, caching, header rewrites, and routing. NGINX and Envoy do both jobs.

When should I use a forward proxy?#

Use a forward proxy for egress control, central caching, censorship circumvention, or to enforce policy on outbound traffic from corporate or developer networks.

Further reading#