A frequently misunderstood piece of network infrastructure is the proxy server. Many have heard of the term proxy before, but few understand what exactly it is. At their most basic level, proxy servers serve as intermediaries between clients and servers during network communications. They intercept traffic flows and perform certain tasks on the session data on behalf of the hosting organization. There are two types of proxies, one for each traffic direction:

  1. Forward Proxy
  2. Reverse Proxy

Forward Proxies act on a client’s behalf. Their goal is to intercept client requests before they leave the internal network and apply defined policies or settings to the traffic before sending it off to its destination. Commonly, forward proxies are used on client traffic leaving an internal network for an unsecured network such as the Internet. In return, the server out on the Internet sends its data back to the forward proxy, rather than directly to the internal client. Some of the features forward proxies can apply to client traffic include:

  • Filtering/restricting access to blacklisted content
  • Hides the client’s IP address from the destination
  • Caches copies of commonly accessed content on the proxy itself, avoiding the need to constantly download the same content and preserve bandwidth.
  • Logs outbound requests such as web searches for auditing and investigations.

Reverse Proxies work on the server’s behalf. It sits in front of the servers, and intercepts traffic destined for specific server addresses. A common, business-oriented scenario for using a reverse proxy is when an organization or user needs to open several services to the Internet. They may only have a single public IP address that is NAT-ed to their internal network, meaning they cannot assign a unique routable IP address to each server. Instead, the organization can use Port Forwarding, which involves opening specific ports inbound on their router and assigning each open port to a specific destination address. This way, when an external user tries to access the organization’s IP/domain with a specific port, they are sent directly to the system assigned to that port. Port Forwarding is extremely risky, and for the best security hygiene, it is not recommended to forward ports straight up. This is where a reverse proxy comes in. Instead of opening dozens of ports on the edge router, the organization can only open the HTTP (80) and HTTPS (443) ports. Traffic destined for these ports from outside the network is sent to the reverse proxy. The proxy knows the actual destinations for each specific server and forwards the client traffic to the address of the specific resource they are trying to access. This hides the specific addresses and implementation details from the external clients, since they are actually connecting to the proxy, not directly to the servers.

Additional functionalities that reverse proxies can provide are:

  • Load balancing requests among multiple servers hosting the same resource.
  • Caching certain responses to reduce load on the destination servers.
  • Centralizing certificate management for HTTPS.
  • Can apply rate limiting, filtering, security rules, and traffic blocking to improve server performance and security.