Start practising

SYSTEM DESIGN · CONCEPTS · HOW THE WEB WORKS · EPISODE 6

Reverse Proxy vs Forward Proxy, Explained

What a proxy is, forward vs reverse proxies, everything a reverse proxy does (TLS, caching, compression, routing, rate limiting, security), and how it relates to load balancers and API gateways.

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
  16. 16
  17. 17
  18. 18
  19. 19
  20. 20
  21. 21
  22. 22
  23. 23
  24. 24
  25. 25
  26. 26
  27. 27
  28. 28
  29. 29
  30. 30
  31. 31
  32. 32
  33. 33
  34. 34
  35. 35
  36. 36
  37. 37
  38. 38
  39. 39
  40. 40
  41. 41
1 / 18

Press play to hear the narration, or step through at your own pace. Every picture here is the same one used in the YouTube video.

Notes

What is a proxy?

A proxy is a middleman. Instead of talking to the destination directly, you talk to the proxy, and the proxy talks to the destination for you. The question is: whose side is the middleman on?

Forward proxy

A forward proxy works for the clients. Picture an office network. Every laptop sends its web traffic through the company's proxy, and the proxy goes out to the internet for them.

The website sees the proxy's address, not yours. Companies and schools use forward proxies to filter and log browsing, and to cache popular downloads. Privacy tools use the same idea to hide who you are.

Forward proxy uses
  • hide the clients’ IP addresses
  • block or log sites (company, school)
  • cache popular downloads
  • reach blocked content (VPN-like)

Reverse proxy

A reverse proxy is the mirror image. It works for the servers. Clients think they're talking to the website, but they're talking to the proxy, which forwards each request to the right server behind it.

Here's the one-line difference. A forward proxy hides the clients from the servers. A reverse proxy hides the servers from the clients. You set up a forward proxy on your side. The website owner runs the reverse proxy on theirs.

The one-line difference
  • forward proxy: hides the clients
  • reverse proxy: hides the servers
  • clients choose a forward proxy;
  • the site owner runs the reverse proxy

Job 1 · TLS

So what does a reverse proxy actually do? Job one: TLS termination. It holds the certificate and does the encryption work, so the application servers don't have to.

Job 2 · Routing

Job two: routing. It reads each request and decides where it goes. Slash api goes to the application servers. Slash images goes to a static file server. You can even send a small share of users to a new version, to test it safely.

Job 3 · Caching

Job three: caching. If many users ask for the same poster, the proxy keeps a copy and answers straight from memory. The application servers never even see those requests.

Job 4 · Compression

Job four: compression. It shrinks responses with gzip or brotli, so a hundred and twenty kilobytes of JSON travels as maybe twenty. That's a big win on slow mobile networks.

Compression
  • gzip / brotli
  • 120 KB of JSON → ~20 KB
  • faster on slow phone networks

Job 5 · Security

Job five: security. The servers' real addresses stay hidden. The proxy can rate limit, so one client can't flood the system, block bad traffic with a web application firewall, and absorb attacks before they reach your servers.

Job 6 · Load balancing

Job six: load balancing. A reverse proxy that spreads requests across several servers is acting as a load balancer. That's why the two terms get mixed up.

Related terms

So how do they relate? A reverse proxy is the general idea. A load balancer is a proxy focused on spreading load. An API gateway is a proxy for APIs that adds authentication, rate limits, keys, and versioning. Many tools do all three.

And a CDN, like Cloudflare or CloudFront, is really a huge network of reverse proxies in hundreds of cities, caching your content close to your users.

Proxy vs LB vs API gateway
  • reverse proxy: the general middleman
  • load balancer: a proxy focused on
  • spreading load across servers
  • API gateway: a proxy for APIs, adding
  • auth, rate limits, API keys, versioning
CDNs are reverse proxies too
  • a CDN = reverse proxies in
  • hundreds of cities, caching
  • your content near users
  • Cloudflare, Akamai, CloudFront

Trade-offs

The trade-offs: one more hop adds a little latency. It must be redundant, or it becomes a single point of failure. And because servers now see the proxy's address, the proxy passes on the real client address in a header called X-Forwarded-For.

Trade-offs
  • one more hop: a little latency
  • must be redundant (or it’s a SPOF)
  • pass the client’s real IP on
  • X-Forwarded-For header

Interview questions

Forward proxy vs reverse proxy?

A forward proxy sits in front of clients and makes requests on their behalf (hides clients, filters and caches outbound traffic). A reverse proxy sits in front of servers and receives requests on their behalf (hides servers, terminates TLS, routes, caches, protects and balances).

What can a reverse proxy do?

TLS termination, path- or host-based routing, response caching, compression, rate limiting and WAF rules, hiding backend IPs, load balancing, retries, and serving static files.

Reverse proxy vs load balancer vs API gateway?

All are reverse proxies. A load balancer focuses on distributing traffic across servers; an API gateway adds API concerns like authentication, rate limits, API keys, request transformation and versioning. Tools like Nginx or Envoy can play several roles.

How does a backend server know the real client IP behind a proxy?

The proxy adds headers such as X-Forwarded-For (and X-Forwarded-Proto / Forwarded). The application should only trust these headers when they come from known proxies.

Is a CDN a reverse proxy?

Yes: a CDN is a globally distributed set of reverse proxies that cache content close to users and forward misses to the origin.