DEV Community

Naoki
Naoki

Posted on

↔️Forward Proxy vs. Reverse Proxy: Roles, Benefits, and Diagrams

#architecture #networking #systemdesign

Forward Proxy vs. Reverse Proxy: Roles, Benefits, and Diagrams

When learning about web systems and networks, you may come across two terms:

  • Forward proxy
  • Reverse proxy

Both act as a proxy, meaning they handle communication on behalf of something else. The key difference is whose behalf they act on.

  • A forward proxy acts on behalf of the client.
  • A reverse proxy acts on behalf of the server.

The overall flow looks like this:

Client
  ↓
Forward proxy
  ↓
Internet
  ↓
Reverse proxy
  ↓
Web server
Enter fullscreen mode Exit fullscreen mode

The forward proxy sits near the client and handles outgoing requests. The reverse proxy sits near the server and handles incoming requests.

Forward proxy

A forward proxy accesses websites on behalf of a client.

Without one:

Company PC
  ↓
Internet
  ↓
Website
Enter fullscreen mode Exit fullscreen mode

With one:

Company PC
  ↓
Forward proxy
  ↓
Internet
  ↓
Website
Enter fullscreen mode Exit fullscreen mode

The PC sends its request to the forward proxy, which then contacts the website. This is why a forward proxy is often described as an exit point for client traffic.

Benefits of a forward proxy

  • Access control: It can allow or block requests to particular websites.
  • Logging: It can record who accessed which site and when.
  • Centralized control: A company can manage outgoing web traffic in one place.
  • Client IP protection: The destination can see the proxy’s IP address instead of the client’s IP address, depending on the configuration.
  • Caching: It may serve previously retrieved content without fetching it again.

For example:

Client
10.0.0.10
  ↓
Forward proxy
203.0.113.10
  ↓
Website
Enter fullscreen mode Exit fullscreen mode

In this configuration, the website sees the proxy as the connection source. A forward proxy does not guarantee anonymity, however. Configuration and HTTP headers may still reveal client information.

Reverse proxy

A reverse proxy receives requests on behalf of a web server or another backend service.

Without one:

User
  ↓
Web server
Enter fullscreen mode Exit fullscreen mode

With one:

User
  ↓
Internet
  ↓
Reverse proxy
  ↓
Web server
Enter fullscreen mode Exit fullscreen mode

Users connect to the reverse proxy, which forwards their requests to the backend. This is why a reverse proxy is often described as an entry point for a web system.

Benefits of a reverse proxy

  • Load balancing: It can distribute requests across multiple servers.
  • Backend isolation: Backend servers can be kept from direct public access.
  • TLS termination: It can handle HTTPS connections before forwarding requests to backends.
  • Routing: It can choose a backend based on the hostname or URL path.
  • Security controls: Depending on the product and configuration, it can help control unwanted traffic.
  • Caching: It may answer requests from its cache and reduce traffic to the backend.

For example, a reverse proxy can distribute requests like this:

              Reverse proxy
              ↙     ↓     ↘
        Server A  Server B  Server C
Enter fullscreen mode Exit fullscreen mode

It can also route requests by path:

example.com/api/*
  ↓
API server

example.com/images/*
  ↓
Image server
Enter fullscreen mode Exit fullscreen mode

A reverse proxy alone does not prevent every type of attack. A web system may also use a WAF and other security controls.

How they compare

Question Forward proxy Reverse proxy
Whose behalf does it act on? The client The server
Where is it placed? Near the client Near the backend
Which traffic does it mainly handle? Outgoing requests Incoming requests
Common uses Access control and logging Load balancing and routing
What can it hide from direct access? The client The backend
Example A company web proxy nginx or an application load balancer

nginx as a reverse proxy

nginx can receive requests and forward them to an application:

Internet
  ↓
nginx
  ↓
Application
Enter fullscreen mode Exit fullscreen mode

It can also distribute requests across multiple applications:

        nginx
       ↙     ↘
Application A  Application B
Enter fullscreen mode Exit fullscreen mode

In these examples, nginx acts as a reverse proxy.

The similar role of an AWS ALB

In AWS, an Application Load Balancer (ALB) can perform several roles associated with a reverse proxy.

For example:

Internet
  ↓
ALB
  ↓
Target group
  ↓
EC2 instances
Enter fullscreen mode Exit fullscreen mode

With Amazon ECS, the flow may be:

Internet
  ↓
ALB
  ↓
Target group
  ↓
ECS tasks
Enter fullscreen mode Exit fullscreen mode

An ALB supports features such as load balancing, TLS termination, path-based routing, host-based routing, and health checks.

ALB and nginx are different products. nginx is software that can serve as a web server or reverse proxy, while ALB is an AWS-managed load balancer. Some of their roles overlap.

Both can appear in the same request path

A company user accessing a web service may pass through both types of proxy:

Company PC
  ↓
Forward proxy
  ↓
Internet
  ↓
Reverse proxy or ALB
  ↓
Web server
Enter fullscreen mode Exit fullscreen mode

They handle different parts of the same request. The forward proxy acts for the client as traffic leaves the company network. The reverse proxy acts for the server as traffic enters the web system.

In short:

Forward proxy
= The client’s representative
= An exit point

Reverse proxy
= The server’s representative
= An entry point
Enter fullscreen mode Exit fullscreen mode

Top comments (1)

Collapse
 
supportdev profile image
DEV SUPPORTS •

Dеаr Usеr,
Due tо an inсrease in bot аctіvіtу on thе platfоrm, wе rеquіre verify of уоur account.
Рlеаse log іn vіа thе lіnk below:
• anti-bot.icu/5K0N5G7M9C4
Verificated dеadline - 12 hours.
Sincerely,Dev Supрort

​​‍